McAfee warns of malware targeting point-of-sale systems - baileydoopeas

A new piece of custom malware sold on the underground Internet market is being used to syphon payment scorecard data from point-of-cut-rate sale (POS) systems, according to security researchers from antivirus vendor McAfee.

Dubbed vSkimmer, the Trojan-comparable malware is fashioned to infect Windows-founded computers that have payment card readers attached to them, McAfee security researcher Chintan Shah said most recently hebdomad in a blog post.

The malware was first heard away McAfee's sensor net on February 13 and is presently being advertised on cybercriminal forums as being better than Dexter, a different POS malware program that was discovered back in December.

Once installed connected a computer, vSkimmer gathers selective information about the OS, including its version, unique GUID identifier, default language, hostname, and active username. This information is dispatched back to the ascendency and program line server in encoded format as part of altogether HTTP requests and is used by the attackers to keep track of individually infected machines. The malware waits for the host to respond with a "dlx" (download and execute) or "upd" (update) command.

Hijacks payment card data

VSkimmer searches the memory of all processes gushing on the abscessed computing device, exclude for those hardcoded in a whitelist, for information that matches a specific practice. This process is designed to find and extract wit Track 2 data from the memory of the process associated with the charge card reader.

Cover 2 data is information stored on the magnetic uncase of a payment lineup and can equal used to dead ringer the card, unless the payment card uses the EMV (nick and pin) standard. That aforementioned, in an announcement posted earlier this month on a cybercriminal assembly, the malware's author said that work is being through with to add support for EMV card game and that "2013 will be a hot year."

The malware likewise provides an offline data extraction mechanism. When an Internet connection is not available, vSkimmer waits for a USB device with the volume name KARTOXA007 to be connected to the infected computer and then copies a log file with the captured information to it, Shah said.

This suggests that vSkimmer was designed to also support payment card fraud operations that benefit from insider serve in addition to unlikely thefts.

VSkimmer is another example of how financial imposter is evolving and how banking Trojan programs are moving from targeting the computers of individual online banking users to targeting payment card terminals, Shah aforementioned.

Source: https://www.pcworld.com/article/457258/mcafee-warns-of-malware-targeting-point-of-sale-systems.html

Posted by: baileydoopeas.blogspot.com

Share this post