Feeds

Dexter malware targets point of sale systems worldwide

Payment cards plundered in 40 countries

Next gen security for virtualised datacentres

You could be getting more than you bargained for when you swipe your credit card this holiday shopping season, thanks to new malware that can skim credit card info from compromised point-of-sale (POS) systems.

First spotted by security firm Seculert, the malware dubbed "Dexter" is believed to have infected hundreds of POS systems in 40 countries worldwide in recent months. Companies targeted include retailers, hotel chains, restaurants, and private parking providers.

The US, the UK, and Canada top the list of countries where the malicious app has been found, accounting for 30 per cent, 19 per cent, and 9 per cent of the total number of affected systems, respectively.

This certainly isn't the first time cybercrooks have targeted POS systems. In fact, such attacks are becoming increasingly common – which is no surprise, given how lucrative they can be.

In September, four Romanian hackers pled guilty to charges that they hacked into the POS systems of 150 Subway sandwich shops in the US. Their scheme reportedly lasted two years, during which time they were able to make off with more than $10m in fraudulent charges and funds transfers from stolen payment cards.

What sets Dexter apart from earlier incidents, however, is its relative sophistication.

Most hacks targeting POS systems – the Romanian job included – are essentially spyware attacks in which crooks use Remote Desktop exploits or other means to grab screenshots of the affected systems. In essence, the thieves are simply reading credit card information off the POS screens.

Dexter, on the other hand, uses a more subtle approach – and a more thorough one. Once the malware is installed on a POS system, it grabs the machine's list of active processes and sends them to a command-and-control server – a highly unusual step for POS malware, according to security researchers at Trustwave.

If the server determines that any of the programs currently running on the machine correspond to known POS software, it orders Dexter to dump the memory of those processes, parse them for payment card–related data, and upload that data to the server, so that criminals can use it to clone the cards.

That much we know. What isn't known is just how Dexter finds its way onto POS terminals to begin with. According to Seculert, about 30 per cent of the POS systems targeted were running Windows Server, which makes it unlikely that the malware was installed using typical social-engineering or drive-by web download methods.

Still, if you do encounter unrecognized charges on your credit card bill in the coming months, now you know what to tell the bank when you call to dispute the transactions: "It wasn't me. It was that POS system that swiped my card!" ®

The essential guide to IT transformation

More from The Register

next story
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
New twist as rogue antivirus enters death throes
That's not the website you're looking for
ISIS terror fanatics invade Diaspora after Twitter blockade
Nothing we can do to stop them, says decentralized network
prev story

Whitepapers

A new approach to endpoint data protection
What is the best way to ensure comprehensive visibility, management, and control of information on both company-owned and employee-owned devices?
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Maximize storage efficiency across the enterprise
The HP StoreOnce backup solution offers highly flexible, centrally managed, and highly efficient data protection for any enterprise.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.