For the last year Forcepoint X-Labs has been collecting samples of Point-of-Sale (POS) malware that stood out for their hand-crafted nature, were written in assembly code and were very small in size (2-7kB). In this article, we examine the attributes of TinyPOS and explore why retail organisations are still faced with POS malware and thus what can be done to protect organisations, consumers and their personal data.
What makes POS terminals such an attractive target?
Put simply, POS malware is still effective at collecting large amounts of personal information. For example, in March 2019 Earl Enterprises issued a public-facing notification of a data breach affecting multiple restaurants in their portfolio including the Planet Hollywood and Buca di Beppo brands. They had discovered that POS malware had been siphoning personal information from their systems for approximately 10 months.
On 9 April 2019 Microsoft ended support for Windows Embedded POSReady2009 (a Windows XP-derived POS OS). As systems continue to use legacy software, and hardware, it becomes increasingly difficult to protect from opportunistic and determined adversaries. We then have to factor in human fallibility. Consumers may still prefer to sign for their transaction, or even swipe their credit card, rather than convert to EMV Chip-and-PIN. Further, many regions have not yet benefited from the improved security afforded by wide-scale adoption of EMV to authenticate card transactions.
While Swipe-and-Sign still exists merchants may not be adopting the more secure standards demanded of EMV. Data from EMVCo shows the United States still lags behind other regions in that only 53% of card-present transactions are EMV, compared with up to 97% in Europe. As such we believe that POS malware looking for Track 1 and Track 2 credit card data will still continue for as long as wide-scale adoption of EMV remains a challenge.
TinyPOS – Point-of-Sale malware to collect swipe-and-sign data
During our study we collected 2000 unique samples within the Tiny ecosystem. We grouped these into “loaders”, “mappers”, “scrapers” and “cleaners”.
- Loaders – an obfuscated executable with simplistic downloader functionality. The core functionality of a loader is to establish communication with a hard-coded set of Command-and-Control servers. This communication results in longer code snippets being downloaded into memory, concatenated and executed. A system process list is then generated confirming the presence of a POS system. Additional downloads then occur. Remember that the loaders are incredibly small in size (2-7kB).
- Mappers – this component gathers information about the machine and environment upon which it was executed. Through this network reconnaissance activity, we believe mappers helped the operators to gather extensive knowledge of different POS system layouts and deploy campaigns targeting only specific retailers.
- Scrapers – these components work like any other POS memory scraper with the goal of collecting Track 1 and Track 2 credit card data.
- Cleaners – a component that cleans up running processes, registry keys, tasks, and files once the operation is finished.
The most probable initial vector would be a remote hack into the POS system to deliver the Loaders. Other options could include physical access (unlikely) or a rogue auto-update to deliver a compromised file to the POS operating system.
While Swipe-and-Sign exists as an authentication option for card-present transactions, POS malware like TinyPOS will continue to be effective. We strongly recommend that retailers and banks aggressively pursue a move to EMV (at least Chip-and-Signature, preferably Chip-and-PIN).
It is recommended that an audit be performed on any system storing and transmitting personal data in relation to how that data is managed and stored. The goal should be to make it harder for credit card data to be extracted from the retailer’s systems. This includes while in transit.