Reports of data breaches and thefts have been recorded in PoS, and it is now a very common occurrence. As companies are targeted by newer and more sophisticated malware, a huge market for stolen credit card information has been established and is constantly growing.
While investigating the breach cases, CISCO discovered a new family of malicious scripts, which it named PoSeidon malware.
The PoS system infection results from a keylogger that, after being installed on the system, deletes the user's profile from the database. This forces the user to re-type their details, which are recorded by the keylogger and sent to the server, from where the attacker can penetrate the system remotely in order to steal the details stored in the database.
While searching the system, PoSeidon runs the algorithm to verify whether it finds card information or not, and sends it to the remote server for further use. It also installs another keylogger, FindStr, which searches the system data for sequences of numbers starting with 6, 5, 4 and 16 digits long for Discover, Visa, Mastercard cards, or 15 digits long for AMEX cards.
The malware can also update itself based on its communication with the server, and developers are working on using this technology in other, more sophisticated malware.
Faced with new malware technologies, businesses with POS systems must be vigilant and adopt new ways to provide security to their customers, as well as assistance to them after such incidents.
