Visa Inc. · NYSE:V
Visa — Technical Presentation (January 2016)
25 slides from Visa's technical presentation, Jan 27, 2016
Slide 1: "Kuhook" Point-of-Sale Malware
"Kuhook" Point-of-Sale Malware Sylvia Auyeung, Director, VISA, NA Merchant Risk Erik Rasmussen, Director, VISA, Cyber Intelligence and Investigations Jason Rebholz, Manager, MANDIANT, a FireEye Company “Kuhook” Point-of-Sale Malware | 27 January 2016
Slide 2: Disclaimer
Disclaimer The information or recommendations contained herein are provided "AS IS" and intended for informational purposes only and should not be relied upon for operational, marketing, legal, technical, tax, financial or other advice. When implementing any new strategy or practice, you should cons
Slide 3: Agenda
Agenda • Global Payment Card Compromise Landscape • “Kuhook” Overview • “Kuhook” Capabilities • “Kuhook” Detection Strategies • Questions and Answers “Kuhook” Point-of-Sale Malware | 27 January 2016 Visa Public 3
Slide 4: Global Payment Card Compromise Landscape
Global Payment Card Compromise Landscape Sylvia Auyeung, Director, VISA, NA Merchant Risk “Kuhook” Point-of-Sale Malware | 27 January 2016 Visa Public 4
Slide 5: Payment System Risk Landscape
Payment System Risk Landscape New Players in Data Security Fraud Trends Regulatory Attention the Eco-system • Frequency of data • Fraud levels and • Proliferation of third • Governments and breaches is increasing accounts are increasing party agents and regulators are paying nontraditional players i
Slide 6: Global Data Compromises 2011-2015
Global Data Compromises 2011-2015 Compromise Cases by Region • Global data compromise events are slightly higher in 2015 over those managed in 2014 • The U.S. is the largest contributor, CEMEA mainly due to its large mag stripe infrastructure and an increase in AP successful attacks on third party V
Slide 7: Global Data Compromises: Breach trends by merchant level
Global Data Compromises Breach trends by merchant level Breach events by merchant level Large breach events (levels 1 & 2) Entity Type 2012 2013 2014 2015 % % % % Level 1 <1% 1% 1% <1% Level 2 <1% 1% 1% <1% Level 3 1% 4% 4% 5% Level 4 95% 92% 93% 92% Agent <1% 1% 1% 2% Other 2% <1% 0% 0% Total 100%
Slide 8: "Kuhook" Overview
“Kuhook” Overview Erik Rasmussen, Director, VISA, Cyber Intelligence and Investigations “Kuhook” Point-of-Sale Malware | 27 January 2016 Visa Public
Slide 9: Kuhook Overview: Distinctions
Kuhook Overview: Distinctions Output file encryption…with unique 1 keys! Why is this malware Unconventional device interesting? 2 driver modules Possible exploitation of 3 symmetric keys vulnerability Victim merchant sample 4 dataset is extremely small “Kuhook” Point-of-Sale Malware | 27 January 201
Slide 10: PoS Malware Behavior
PoS Malware Behavior Malware exfiltration methods: NOTE: Malware in this presentation communicated via C&C servers “Kuhook” Point-of-Sale Malware | 27 January 2016 Visa Public 10 Graphic courtesy of Trend Micro
Slide 11: PoS Malware Types
PoS Malware Types 1 File scraper Malware will often 2 Network sniffer fall into one of these categories: 3 Keylogger NOTE: This malware exhibits all 4 characteristics. 4 Memory Scraper “Kuhook” Point-of-Sale Malware | 27 January 2016 Visa Public 11
Slide 12: Kuhook Tools Selection
Kuhook Tools Selection • “Hacker” Tools • “Dual Use” Tools – cain.exe – psexec • Network password scanner 200 • Microsoft remote/local • Password cracking capability administration cmd line utility • “recovery” tool 100 – sdelete.exe (aka SDelete) – mimikatz.exe • Microsoft cmd line utility for • Pa
Slide 13: Kuhook Tools Selection
Kuhook Tools Selection 200 100 0 cain.exe screenshot mimikatz.exe screenshot Note: These screenshots are demonstrative only and not from actual Visa or Mandiant investigations. “Kuhook” Point-of-Sale Malware | 27 January 2016 Visa Public 13
Slide 14: "Kuhook" Capabilities
“Kuhook” Capabilities Jason Rebholz, Manager, MANDIANT, a FireEye Company “Kuhook” Point-of-Sale Malware | 27 January 2016 Visa Public 14
Slide 15: How Compromises Are Being Detected
How Compromises Are Being Detected “Kuhook” Point-of-Sale Malware | 27 January 2016 Visa Public 15
Slide 16: Anatomy of a Targeted Attack
Anatomy of a Targeted Attack Maintain Move Presence Laterally Initial Establish Escalate Internal Complete Compromise Foothold Privileges Recon Mission Gain Initial Access Strengthen Position Steal Valid User Package and Steal Identify Target Data Into Target within Target Credentials Target Data “K
Slide 17: SOUMAT, MODPOS, Kuhook Malware
SOUMAT, MODPOS, Kuhook Malware • Packed device driver that targets the Windows XP operating system • Identified five variants – All packed with the same packer and contained nearly identical driver payloads – Primary difference was the functionality of the shell code – Variants identified by file si
Slide 18: Malware Variants
Malware Variants • Card data harvester – Injects malicious code into the POS process that handles card holder data – Searches process memory for track 2 data – Writes stolen card data out to files that were encrypted with a unique key per host! • Keystroke logger – Injects shell code into “explorer.
Slide 19: What happens when it loads?
What happens when it loads? • Driver unpacks itself and starts a new system thread Kernel Space User Space – Reports back to the system that the original driver failed to load – Does not appear to be loaded but is actually running separate from Packed Driver csrss.exe the original driver • Unpacked
Slide 20: "Kuhook" Detection Strategies
“Kuhook” Detection Strategies Erik Rasmussen, Director, VISA, Cyber Intelligence and Investigations “Kuhook” Point-of-Sale Malware | 27 January 2016 Visa Public 20
Slide 21: Breach prevention and detection strategy
Breach prevention and detection strategy Defense-in-depth, preparation, vigilance Adopt data devaluation technology Prevention PCI DSS as baseline controls Have a breach preparedness plan Monitor for known POS and other malware Layered Early Defense IOCs warning signs Know your environment Know the
Slide 22: Mitigation
Mitigation Best Practices** • Control the Windows Administrator account – Make privilege escalation difficult • Install application whitelisting on Point of Sale systems • Closely monitor activity on Point of Sale systems – Be aware of anomalous behavior and investigate all suspicious activity on th
Slide 23: Indicators of Compromise (IOCs)
Indicators of Compromise (IOCs) IOC Type Notes 91.207.61.208 Destination IP address Command and control server 109.72.149.42 Destination IP address Command and control server 130.0.237.22 Destination IP address Command and control server 5.187.1.198 Destination IP address Command and control server
Slide 24: Upcoming Events and Resources
Upcoming Events and Resources • Visa Data Security Website – www.visa.com/cisp • Alerts, Bulletins • Best Practices, White Papers • Past Webinar Presentations • PCI Security Standards Council Website – www.pcissc.org • Data Security Standards – PCI DSS, PA-DSS, PTS • Programs – ASV, ISA, PA-QSA, PFI
Slide 25: Questions?
Questions? “Kuhook” Point-of-Sale Malware | 27 January 2016 Visa Public