Botnet aims brute-force attacks at point-of-sale systems
A new malware threat scans the Internet for POS systems and tries to access them using common usernames and passwords
IDG News Service - Thousands of compromised computers are actively trying to break into point-of-sale (POS) systems using brute-force techniques to guess remote administration credentials.
The computers are part of a botnet, dubbed BrutPOS by researchers from security firm FireEye, that has been active since at least February. The botnet scans attacker-specified IP (Internet Protocol) address ranges for systems that accept Remote Desktop Protocol (port 3389) connections.
When an RDP service is identified, the BrutPOS malware attempts to log in with user names and passwords from a predefined list.
"Some of the usernames and passwords indicate that the attackers are looking for specific brands of POS systems such as Micros," the FireEye researchers said Wednesday in a blog post.
Micros Systems is based in Columbia, Maryland, and provides software applications, services and hardware systems, including POS terminals, to the hospitality and retail industries.
If the BrutPOS malware successfully guesses the remote access credentials of an RDP-enabled system it sends the information back to a command-and-control server. Attackers then use the information to determine whether the system is a POS terminal and if it is, to install a malware program that's designed to extract payment card details from the memory of applications running on it.
This kind of memory monitoring program is known as a RAM scraper and has increasingly been used in attacks against POS systems over the past year. A data breach last year at Target that led to the compromise of 40 million payment cards resulted from the retailer's POS terminals being infected RAM scraping malware.
Researchers from cyberthreat intelligence firm IntelCrawler have also monitored the BrutPOS malware, which they believe appeared in the cybercriminal underground in May as a project called @-Brt. According to them, it doesn't only target RDP, but other remote administration protocols like VNC and PCAnywhere as well.
FireEye has identified a total of five BrutPOS command-and-control servers, two of which are still online. The two remaining servers are located in Russia and were set up in late May and early June respectively.
Data collected from these servers suggests that the botnet is made up of 5,622 compromised computers from 119 countries. The researchers identified 60 RDP-enabled systems -- most likely POS terminals -- that have been compromised, 51 of which are based in the U.S.
"The most common username was 'administrator' (36) and the most common passwords were 'pos' (12) and 'Password1' (12)," the FireEye researchers said.
According to IntelCrawler's data, other remote access passwords frequently used on the compromised systems were aloha12345, micros, pos12345, posadmin and javapos.
"While there is insufficient information to determine attribution, there is some information which indicates that the attackers are in Eastern Europe, probably Russia or Ukraine," the FireEye researchers said.
- Step Out of the Bull's-Eye Learn about the evolution of targeted attacks, the latest in security intelligence, and strategic steps to keep your business safe.
- Using Cyber Insurance and Cybercrime Data to Limit Your Business Risk This paper examines the challenges of understanding cyber risks, the importance of having the right cyber risk intelligence, and how to use this...
- 5 Tips to Secure Small Business Backdoors in the Enterprise Supply Chain This paper examines the insecurity of the small businesses in the supply chain and offers tips to close those backdoors into the enterprise.
- Comprehensive Advanced Threat Defense The hot topic in the information security industry these days is "Advanced Threat Defense" (ATD). This paper describes a comprehensive, network-based approach to...
- Live Webcast Security Vulnerabilities Associated With Having Local Administrator Privileges Viewfinity will demonstrate how removing admin rights and granularly managing privileges at the application level reduces the attack surface.
- Security Vulnerabilities Associated With Having Local Administrator Privileges Viewfinity will demonstrate how removing admin rights and granularly managing privileges at the application level reduces the attack surface.
- Keep Servers Up and Running and Attackers in the Dark An SSL/TLS handshake requires at least 10 times more processing power on a server than on the client. SSL renegotiation attacks can readily... All Cybercrime and Hacking White Papers | Webcasts