Retailers shot up by PoS scraping brute force cannon

The US Computer Emergency Response Team has warned of a new point of sale malware that is targeting retailers.
The malware is a RAM-scraper of the kind made infamous by the Target breach that saw attackers plant wares on terminals to nab credit cards while they were temporarily unencrypted.

This attack uses a new tool delivered through an increasingly common vector; Attackers implanted the malware dubbed BackOff on the point of sales (PoS) terminals of several unnamed retailers by brute forcing passwords protecting remote desktop protocol channels.
"Recent investigations revealed that malicious actors are using publicly available tools to locate businesses that use remote desktop applications," US-CERT warned in an alert.
"After gaining access to what was often administrator or privileged access accounts, the suspects were then able to deploy the PoS malware and subsequently exfiltrate consumer payment data via an encrypted POST request."
It was spotted in three forensic investigations dating to October last year which found it could scrap card track data from PoS memory, log keystrokes, and maintain persistence by tapping into explorer.exe.

Image: Slava Gomzin

The malware and its kin are a huge threat to retailers of all stripes because there is little business can do to prevent cards being swiped without significantly overhauling infrastructure, HP technologist Slava Gomzin warned.
The veteran PoS hacker considered the Payment Card Industry Data Security Standard (PCI DSS) all but bollocks and said it did little to prevent credit card theft.
The only way businesses could prevent carder raids was to stump up and pay for point-to-point encryption (P2PE).
"Deploying P2PE for large retailers is really realistic, but it requires a lot of financial resources and hardware changes. It is the primary reason why most retailers don't have it yet," Gomzin told The Register.
"Point to Point encryption requires a lot of changes to the back end."
Security controls included in or similar to PCI DSS were still required within data centres where credit card data was decrypted for server applications, but P2PE was generally a far more secure means of safeguarding transactions.
The technology proved itself during the Target breach, Gomzin said, where US stores that did not have P2PE in place had 40 million cards stolen by thieves, while the Canada chain which had deployed the crypto was untouched.

Image: Slava Gomzin

He said there were signs that retailers were moving to point to point encryption but did not have numbers on how many had adopted the technology since the Target icing. Most big businesses were aware of the need to, however, but were not keen on facing the disruption.
Neohapsis security consultant Joe Schumacher said organisations should check their remote access points for weaknesses.
"For limiting the risk of compromise with [BackOff], organisations should educate employees and provide an approved method for remote access," Schumacher said.
"Companies should also perform network scans to see if systems have specific ports enabled to provide the remote access services, then follow up to turn off the service. If a small organization must rely on a third-party for remote access services then trust within the industry should be examined along with security features that can be enabled for protection."

Roll out the welcome mat to hackers and crackers

A clear and easy to read policy is key to developing a good internal bug bounty program, according to BugCrowd which has published guidelines to help businesses encourage the security community to report vulnerabilities.
Bug bounties are an increasingly popular means to provide a legally safe avenue for security researchers to report bugs they find in hardware, software and services. Such programs help to overcome a prevailing fear that reporting flaws could prompt affected vendors to return the favour with legal action as result of unauthorised hacking.
BugCrowd suggests cash - not tee shirts - are the best way to encourage researchers to more regular and intense testing of products and services.
BugCrowd engineer Drew Sing (Drew_Sing) published the open source guidelines on Github and emphasised the need for simplicity and executive awareness.
"A high priority security issue handled improperly could damage the reputation of the organisation ... the development, IT and communications team are all critical components to a successful program," Sing wrote.
"Receiving your first vulnerability report from the outside world can be a scary and confronting experience, but keep in mind that the researcher is pro-actively trying to help you."
Sing's guide suggests a bug bounty program should be published in an obvious location on websites, preferably located with the /security subdomain, and sport a dedicated security contact who is well-briefed in handling disclosures.
The page should detail what vulnerabilities were in scope and those deemed off-limits.
When a bug arrives, acknowledgement is key. "Acknowledge initial receipt of any report, and set expectations for a response," Sing says in the guidelines. "Keep the researcher informed during each stage of the validation process."
Correspondence should be clear, purposeful and keep the bug hunter abreast of any updates, vulnerability triage or planned patching. Emails are the preferred medium for disclosures since they provide a paper trail. Those who run bug bounty programs should expect that correspondence about bugs will be made public.
"Make sure you resolve the vulnerability quickly. For most researchers, this is the most important part - seeing the positive impact of their work," Sing advises.
Researchers often allow the afflicted one to three months to fix vulnerabilities, making developments of patches or work-arounds was a priority. Failure to do act can land a vulnerable organisation in mailing lists like Full Disclosure or splattered across social media and news sites.
Rewards can take the form of a vulnerability hall of fame, where bug hunters were named for their contributions, and cash or prizes.
Vulture South recommends organisations offer rewards appropriate to the size of the business. A laudable bug bounty initiative by an individual security bod at Yahoo! became laughable after a serious security vulnerability that allowed accounts to be easily compromised was rewarded with a $12.50 voucher for tat in the Yahoo! store. Following a smattering of bad press, the Purple Palace setup a formal bug bounty.
Sing's efforts to define a good bounty program are not unique. Last year, Kiwi security bods under the New Zealand Internet Task Force published draft guidelines (PDF) they hoped would be adopted by business and government across the country.
Readers can tune in to a podcast (created in your correspondent's past life) detailing that draft and bug bounties more broadly, including tips for researchers, as part of a Kiwicon presentation by Lateral Security's Nick von Dadelszen and Department of Internal Affairs analyst Ben Creet.