Feeds

Evil Dexter lurks in card reader, ready to SLASH UP your credit score

Modified malware grabs credit card details of 20,000

The essential guide to IT transformation

Cybercrooks have created an improved version of the Dexter point-of-sale malware that's being blamed for slurping the credit and debit card details of holiday shoppers.

A new version of Dexter, first discovered by security researchers Seculert about a year ago, has been planted on 31 infected point-of-sale terminals, located in restaurants and famous shops in various major cities of the US, according to infosec start-up IntelCrawler.

The criminals behind the attack are using StarDust, a modified version of the earlier Dexter malware that takes features from other malware strains including BlackPOS and VSkimmer. StarDust (aka Dexter v.2) has been offered for sale on underground hacking forums since August. The new variant is capable of extracting credit card data from the RAM of compromised devices or by key-logging, as well as by capturing and exfiltrating internal network traffic, according to IntelCrawler. Data is sent via FTP to hosts based in Russia.

“Approximately 20,000 credit cards may have been compromised via this Stardust variation and evidence has been sent to the card associations to determine the points of compromise”, said Dan Clements, president of IntelCrawler.

The problem is far from confined to the US. Security researchers at Arbor Networks have been independently documenting the same threat. They note some infections in the US but a much greater number in the world's eastern hemispheres, as explained in a map and blog post here.

Point-of-sale malware is not unprecedented. One previous well known case involved the infection of 150 terminals at Subway sandwich shops. What sets the latest version of Dexter apart is its in-depth “knowledge” of the workings of PoS applications such as Clearview PoS.

It's unclear how the Dexter malware gets itself onto infected systems. Curt Wilson, a senior research analyst with Arbor Networks, does however have a few theories about how the Windows-based malware is spreading.

"The exact method of compromise is not currently known, however PoS systems suffer from the same security challenges that any other Windows-based deployment does,"Wilson writes. "Network and host-based vulnerabilities (such as default or weak credentials accessible over Remote Desktop and open wireless networks that include a PoS machine), misuse, social engineering and physical access are likely candidates for infection."

”Additionally, potential brittleness and obvious criticality of PoS systems may be a factor in the reportedly slow patch deployment process on PoS machines, which increases risk," he added. ®

Next gen security for virtualised datacentres

More from The Register

next story
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Snowden on NSA's MonsterMind TERROR: It may trigger cyberwar
Plus: Syria's internet going down? That was a US cock-up
Who needs hackers? 'Password1' opens a third of all biz doors
GPU-powered pen test yields more bad news about defences and passwords
Think crypto hides you from spooks on Facebook? THINK AGAIN
Traffic fingerprints reveal all, say boffins
Microsoft cries UNINSTALL in the wake of Blue Screens of Death™
Cache crash causes contained choloric calamity
Germany 'accidentally' snooped on John Kerry and Hillary Clinton
Dragnet surveillance picks up EVERYTHING, USA, m'kay?
prev story

Whitepapers

5 things you didn’t know about cloud backup
IT departments are embracing cloud backup, but there’s a lot you need to know before choosing a service provider. Learn all the critical things you need to know.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.