A Profile of the Backoff PoS Malware that Hit 1000+ Retail Businesses
Download as PPTX, PDF0 likes535 views
The Backoff malware has affected over 1,000 U.S. retailers by targeting point-of-sale (POS) systems and evading detection through various techniques such as timing evasion and code obfuscation. Attackers deploy Backoff by scanning for remote desktop applications and using brute force to infiltrate POS systems. Current security solutions struggle to protect against these sophisticated and evasive threats, necessitating more robust strategies like EMV payments and full system emulation.
![What is Backoff?
[1 Slide Summary from Kyle]
• Product screenshot?
• Mention evasive behaviors exhibited
Copyright ©2014 Lastline, Inc. All rights reserved. 4](https://image.slidesharecdn.com/backoff-evasive-malware-overview-final-engin-kirda-140910144808-phpapp02/85/A-Profile-of-the-Backoff-PoS-Malware-that-Hit-1000-Retail-Businesses-4-320.jpg)
A Profile of the Backoff PoS Malware that Hit 1000+ Retail Businesses
- 1. Backoff My Point-of-Sale Data! Profiling the Backoff PoS Malware Affecting Retailers Engin Kirda Ph.D., Co-Founder & Chief Architect, Lastline www.lastline.com
- 2. What is Backoff? • Malware used in numerous breaches in the last year • Secret Service currently estimates 1,000+ U.S. businesses affected • Targeted to PoS systems • Evades analysis Copyright ©2014 Lastline, Inc. All rights reserved. 2
- 3. Recent and Notable Retail/Payments Breaches • The last year has seen a dramatic escalation in the number of breached PoS systems • Many of these PoS payloads, like Backoff, evaded installed defenses and alarms Copyright ©2014 Lastline, Inc. All rights reserved. 3
- 4. What is Backoff? [1 Slide Summary from Kyle] • Product screenshot? • Mention evasive behaviors exhibited Copyright ©2014 Lastline, Inc. All rights reserved. 4
- 5. What is Backoff? • Timing evasion (an anti-VM technique) • Utilizes code obfuscation • Also uses rare and poorly emulated instructions to defeat simple emulators • Attempts to encrypt parts of the command and control traffic Copyright ©2014 Lastline, Inc. All rights reserved. 5
- 6. How are the attackers deploying it? • Scan for Internet facing Remote Desktop applications • Brute force login credentials • Often successfully find administrative credentials • Use admin credentials to deploy Backoff to remote PoS systems Copyright ©2014 Lastline, Inc. All rights reserved. 6
- 7. Understanding Evasive Malware Malware authors are not stupid • they got the news that sandboxes are all the rage now • since the code is executed, malware authors have options Evasion defined • Develop code that exhibits no malicious behavior in a traditional sandbox, but still infects the intended target • Can be achieved in a variety of ways… Copyright ©2014 Lastline, Inc. All rights reserved. 7
- 8. 8 The Evasive Malware Problem Current solutions fail to protect organizations from sophisticated, targeted attacks. Copyright ©2014 Lastline, Inc. All rights reserved.
- 9. Lastline Labs AV Vendor Review Antivirus systems take months to catch up to highly evasive threats. Copyright ©2014 Lastline, Inc. All rights reserved. 9
- 10. 3 Ways to Build a Sandbox Not all sandbox solutions can detect highly evasive malware. Copyright ©2014 Lastline, Inc. All rights reserved. 10
- 11. Virtualized Sandboxing vs. Full System Emulation Even APT Solutions with virtualized sandboxing fail to detect highly evasive malware. Copyright ©2014 Lastline, Inc. All rights reserved. 11
- 12. Securing Your Organization • At PoS: Accept EMV payments to limit exposure in case of a breach • At PoS: E2E encryption of transaction (POI never has cleartext) • Detect and protect against malware and C&C • Full system emulation approach with Lastline Copyright ©2014 Lastline, Inc. All rights reserved. 12
- 13. Detect Evasive Malware in Your Network Start your 30-day Lastline trial: http://landing.lastline.com/request-lastline-trial “I would highly recommend Lastline to any company that is entrusted with customer data. Retailers, restaurants, or any organization that is interested in elevating their handling and protection of data could benefit from working with Lastline.” Tom Lindblom CTO, CKE Restaurants Copyright ©2014 Lastline, Inc. All rights reserved. 13
- 14. Thank You! For more information visit www.lastline.com or contact us at [email protected].
Editor's Notes
- #6: rtdsc looping (timing evasion) obfuscation uses a mildly obfuscated code (oligomorphic decryptor), multistage encrypted shellcode, runpe/hollowing, encryption track/keylogger data sent to c2 is encrypted; networked based detection of the c2 still quite easy -> enterprise could detect it reliably, but DLP mechanisms would fail
- #7: Using publicly available services and tools for each step
- #13: emv reduces the value of stolen transaction data, as the transaction data has a limited number of “re-uses” end to end encryption prevents PoS malware from collecting transaction data, reducing the attack surface build verification and detailed behavioral analysis of all software being pushed to PoS systems could absolutely have stopped many these breaches comprehensive analysis of network traffic could have identified them quickly and easily… began providing protection before samples were seen, and alerts for the first c2 events