Feeds

ATTACK of the Windows ZOMBIES on point-of-sale terminals

Infosec bods infiltrate botnet, uncover crap password security

Internet Security Threat Report 2014

Security watchers have spotted a fresh Windows-based botnet that attempts to hack into point-of-sale systems.

Cyber threat intelligence firm IntelCrawler reports that the “@-Brt” project surfaced in May through underground cybercrime forums. The malware can be used to brute-force point-of-sale systems and associated networks, using data such as "subnet IP ranges and commonly used operators, supervisor, and back office administrator logins, some of which are default manufacturers' passwords".

The main tactic appears to be using botnets to scour the net for Remote Desktop Protocol (RDP) servers that have weak or default passwords before mapping and subsequently hacking vulnerable point of sale systems (POS). Compromised POS systems might then be loaded up with malware capable of scraping card details processed through affected terminal.

Official technical documentation from some POS vendors can be used to discover default passwords. In other cases the Windows PC botnet established by cybercrooks can be used to figure out login credentials by trying every possible combination, a classic brute-force attack tactic. Cybercrooks have optimised this process, as an advisory from IntelCrawler explains:

The bad actors distribution of the “@-Brt” botnet allows for active scanning of multiple IPv4 network ranges of specific TCP ports and parallel brute forcing of available remote administration protocols such as VNC, Microsoft RDP and PCAnywhere. The identified malware supports multithreading, which allows to speed-up the process of gaining unauthorised access to merchants for further data theft.

Windows PCs on the networks of merchants are among the hijacked systems getting press-ganged into the assault, whose ultimate aim is stealing credit card and information to carry out fraud, quite possibly on a grand scale. IntelCrawler suspects that several different team of crooks are running parallel campaigns based on the use of different approaches.

IntelCrawler’s analysts have successfully infiltrated the bot network. This has allowed them to figure out the most commonly used passwords for compromised POS terminals as well as the geographical distribution of the infected hosts taking part in the attack.

Weak passwords – such as “aloha12345” (13 per cent), “micros” (10 per cent), pos12345 (8 per cent), “posadmin” (7 per cent) and “javapos” (6.30 per cent) - predominate. IntelCrawler strongly recommends that strengthen passwords used for POS terminals, as well as to monitor suspicious incoming network traffic. ®

Internet Security Threat Report 2014

More from The Register

next story
George Clooney, WikiLeaks' lawyer wife hand out burner phones to wedding guests
Day 4: 'News'-papers STILL rammed with Clooney nuptials
Shellshock: 'Larger scale attack' on its way, warn securo-bods
Not just web servers under threat - though TENS of THOUSANDS have been hit
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
PEAK IPV4? Global IPv6 traffic is growing, DDoS dying, says Akamai
First time the cache network has seen drop in use of 32-bit-wide IP addresses
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.