Stealthy ModPOS Is Most Sophisticated PoS Malware Ever

More than just a point-of-sale card scraper, its modular malware, and every module is a rootkit.

Just in time for the holidays, researchers at iSIGHT Partners are warning retailers about ModPOS -- malware in their point-of-sale systems that is nearly impossible to detect, can do a whole lot more than just scrape customers credit card data, and has already successfully breached U.S. retailers.
This is by far the most sophisticated PoS malware Ive ever seen, says Maria Noboa, senior threat analyst at iSight.
BlackPOS was behind the monster breach at Target, BackOff hit UPS and over a thousand others, and now new PoS malware like CherryPicker and AbaddonPOS have hit the scene. Yet, none of them have the same level of complexity and committment to stealth that ModPOS does.
It took us two to three weeks just to determine it was malicious, says Noboa. It then took researchers several more weeks to pick ModPOS apart and figure out how it works. In comparison, it only took them about 20 minutes to reverse engineer CherryPicker, says Noboa.
[PoS malware proves that Cyber Monday isnt the only thing retailers and shoppers have to worry about over the holidays. Read
Black Friday Security: Brick-and-Mortar Retailers Have Cyber Threats Too
.]
ModPOS is modular. In addition to the PoS card scraper module, it also has a keylogger, an uploader/downloader (with which it could add other pieces), and plug-ins for scraping credentials, and gathering local system and network information.
So, explains Noboa, if it compromises the point-of-sale system and finds that the retailer has wisely encrypted all of the cardholder data or stored it elsewhere, ModPOS can still find ways to make its attack fruitful for them and damaging to the target.
The code was written by someone with exceptional skill, says Noboa. The shell code they use, she says, are effectively full programs. They found one piece of shell code contained over 600 functions.
The malware is able to stay persistent and obfuscated because every one of those modules operates in kernel mode, so, each one is a rootkit, says Noboa.
Its also difficult to detect because all hashes are unique to the victim system. So the researchers cant just hand out a list of hashes along with indicators of compromise, because it wouldnt do anybody any good.
The researchers have not found any evidence of anyone selling ModPOS or even discussing it on underground forums.
All of this points to [the malware] being a profit center for someone, says Noboa. Theyre making their money from use of the malware, not sale of it, and theyre not interested in sharing.
All of this has helped ModPOS be quietly lucrative. iSight researchers believe the ModPOS attacks began as early as 2013, and have since stolen millions of credit and debit cards from unnamed U.S. retailers.
They dont know yet how its being distributed right now or have a fix on the threat actor. They do say there are indications that point to Eastern Europe.

Last News
▸ Feds probe cyber breaches at JPMorgan, other banks. ◂ Discovered: 23/12/2024 Category: security	▸ Security Problem Growing for Dairy Queen, UPS & Retailers, Back off ◂ Discovered: 23/12/2024 Category: security	▸ Veritabile Defecte de Proiectare a Securitatii in Software -> Top 10 Software Security Design Flaws ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Stealthy ModPOS Is Most Sophisticated PoS Malware Ever