Visa Inc. · NYSE:V
Visa — Technical Presentation (September 2014)
27 slides from Visa's technical presentation, Sep 24, 2014
Slide 1: Identifying, Containing, & Mitigating the “Backoff” Malware Webinar
Identifying, Containing, & Mitigating the “Backoff” Malware Webinar 24 September 2014 Visa Public
Slide 2: Disclaimer
Disclaimer The information or recommendations contained herein are provided "AS IS" and intended for informational purposes only and should not be relied upon for operational, marketing, legal, technical, tax, financial or other advice. When implementing any new strategy or practice, you should cons
Slide 3: Agenda
Agenda • The Discovery of “Backoff” • Malware Capabilities and Attack Vectors • Actionable Steps for Detection and Mitigation • Questions and Answers 3 | Identifying, Containing, & Mitigating the “Backoff” Malware | 24 September 2014 Visa Public
Slide 4: The Discovery of “Backoff”
The Discovery of “Backoff” 4 | Identifying, Containing, & Mitigating the “Backoff” Malware | 24 September 2014 Visa Public
Slide 5: Background
Background • Forensic investigations identified “Backoff” as a “family” of malware • Malware initially identified in October 2013 • Associated with a significant number of data breaches reported in 2014 • Remote Access Services/Applications Exploited • LogMeIn, Remote Desktop Protocol, PCAnywhere •
Slide 6: Point-of-Sale Malware Communications and Outreach
Point-of-Sale Malware Communications and Outreach • Visa Data Security Alert – 11 April 2013 ‒ Preventing Memory-Parsing Malware Attacks on Grocery Merchants • Visa Data Security Alert – August 2013 ‒ Retail Merchants Targeted by Memory-Parsing Malware (Update) • Visa Data Security Alert – February
Slide 7: Malware Capabilities and Attack Vectors
Malware Capabilities and Attack Vectors 7 | Identifying, Containing, & Mitigating the “Backoff” Malware | 24 September 2014 Visa Public
Slide 8: POS RAM Scraping
POS RAM Scraping Merchant network cardholder POS hardware POS software Issuing Acquiring Bank Bank 8 | Identifying, Containing, & Mitigating the “Backoff” Malware | 24 September 2014 Visa Public
Slide 9: POS RAM Scraping
POS RAM Scraping • Authorization data temporarily stored in clear text system memory • Cybercriminals attack memory space because it is the easiest path to the data • RAM scrapers generally use logic to identify track 1 and 2 data • Some malware known to use Luhn algorithm to validate • Captured dat
Slide 10: “Backoff” Attack Vectors
“Backoff” Attack Vectors Remote Access Brute Force Attack Web-based remote access Merchant Point of Sale environment Service 10 | Identifying, Containing, & Mitigating the “Backoff” Malware | 24 September 2014 Visa Public
Slide 11: “Backoff” Attack Vectors
“Backoff” Attack Vectors Remote Access Botnet-based Brute Force Attack Web-based remote access Merchant Point of Sale environment Service 11 | Identifying, Containing, & Mitigating the “Backoff” Malware | 24 September 2014 Visa Public
Slide 12: “Backoff” Characteristics
“Backoff” Characteristics • Core functionality: • RAM-scraping • Key logging • Command-and-Control communications • Data exfiltration • Additional bot functionality: • Upload • Download • Run • Upload key logs • Self-deletion capability (reported in recent versions) 12 | Identifying, Containing, & M
Slide 13: “Backoff” Characteristics – core functions
“Backoff” Characteristics – core functions Installation and RAM Scraping • When first launched, it copies itself to %APPDATA%\ORACLEJAVA\javaw.exe • The original executable is deleted as is the original “Backoff” process • “Backoff” then adds itself to the Windows registry under an Auto Start runkey
Slide 14: “Backoff” Characteristics
“Backoff” Characteristics Key Logging and Command and Control (C2) • “Backoff” calls system functions GetKeyState and GetKeyboardState to capture keystrokes • Logs keystrokes to %APPDATA%\ORACLEJAVA\Log.txt • All C2 communications over HTTP POST requests • Requests include information from infected
Slide 15: “Backoff” Characteristics
“Backoff” Characteristics Data Exfiltration • Content is encrypted with RC4 prior to being encoded with Base64 • Password for RC4 is generated from three components: 1. The ID parameter located in HKCU\SOFTWARE\Microsoft\Windows\Current Version\identifier 2. A static value of: ‘jhgtsd7fjmytkr’, ‘zXq
Slide 16: Actionable Steps for Mitigation
Actionable Steps for Mitigation 16 | Identifying, Containing, & Mitigating the “Backoff” Malware | 24 September 2014 Visa Public
Slide 17: “Backoff” Prevention and Detection Strategies
“Backoff” Prevention and Detection Strategies Prevention Early Warning Signs IOCs Multi-layered Defense The “Backoff” campaign is aggressive. Be vigilant and prepared. Fraudsters target the weakest link and can evolve quickly 17 | Identifying, Containing, & Mitigating the “Backoff” Malware | 24 Sept
Slide 18: “Backoff” Early Warning Signs
“Backoff” Early Warning Signs • Unexplained remote logins on the POS (is it normal for a user to log in at 3:00 AM?) • Unexplained outbound HTTP web traffic from the POS • Look for the existence of new, unexplained executables on the POS: • javaw.exe • mswinsvc.exe • mswinhost.exe • winserv.exe • Ex
Slide 19: “Backoff” Prevention
“Backoff” Prevention • Ensure all of your POS vendors, resellers and integrators are employing sufficient measures to prevent attacks and unauthorized access • Ensure that overall payment processing environment is securely configured and maintained in accordance with the PCI DSS. ‒ Ensure that firew
Slide 20: Indicators of Compromise (IOCs)
Indicators of Compromise (IOCs) 1.4 Packed MD5: 927AE15DBF549BD60EDCDEAFB49B829E Unpacked MD5: 6A0E49C5E332DF3AF78823CA4A655AE8 Install Path: %APPDATA%\AdobeFlashPlayer\mswinsvc.exe Mutexes: uhYtntr56uisGst uyhnJmkuTgD Files Written: %APPDATA%\mskrnl %APPDATA%\winserv.exe %APPDATA%\AdobeFlashPlayer\
Slide 21: Indicators of Compromise (IOCs)
Indicators of Compromise (IOCs) 1.55 “backoff” Packed MD5: F5B4786C28CCF43E569CB21A6122A97E Unpacked MD5: CA4D58C61D463F35576C58F25916F258 Install Path: %APPDATA%\AdobeFlashPlayer\mswinhost.exe Mutexes: Undsa8301nskal uyhnJmkuTgD Files Written: %APPDATA%\mskrnl %APPDATA%\winserv.exe %APPDATA%\AdobeF
Slide 22: Indicators of Compromise (IOCs)
Indicators of Compromise (IOCs) 1.55 “goo” Packed MD5: 17E1173F6FC7E920405F8DBDE8C9ECAC Unpacked MD5: D397D2CC9DE41FB5B5D897D1E665C549 Install Path: %APPDATA%\OracleJava\javaw.exe Mutexes: nUndsa8301nskal nuyhnJmkuTgD Files Written: %APPDATA%\nsskrnl %APPDATA%\winserv.exe %APPDATA%\OracleJava\javaw.
Slide 23: Indicators of Compromise (IOCs)
Indicators of Compromise (IOCs) 1.55 “MAY” Packed MD5: 21E61EB9F5C1E1226F9D69CBFD1BF61B Unpacked MD5: CA608E7996DED0E5009DB6CC54E08749 Install Path: %APPDATA%\OracleJava\javaw.exe Mutexes: nUndsa8301nskal nuyhnJmkuTgD Files Written: %APPDATA%\nsskrnl %APPDATA%\winserv.exe %APPDATA%\OracleJava\javaw.
Slide 24: Indicators of Compromise (IOCs)
Indicators of Compromise (IOCs) 1.55 “net” Packed MD5: 0607CE9793EEA0A42819957528D92B02 Unpacked MD5: 5C1474EA275A05A2668B823D055858D9 Install Path: %APPDATA%\AdobeFlashPlayer\mswinhost.exe Mutexes: nUndsa8301nskal Files Written: %APPDATA%\AdobeFlashPlayer\mswinhost.exe %APPDATA%\AdobeFlashPlayer\Lo
Slide 25: Indicators of Compromise (IOCs)
Indicators of Compromise (IOCs) 1.56 “LAST” Packed MD5: 12C9C0BC18FDF98189457A9D112EEBFC Unpacked MD5: 205947B57D41145B857DE18E43EFB794 Install Path: %APPDATA%\OracleJava\javaw.exe Mutexes: nUndsa8301nskal nuyhnJmkuTgD Files Written: %APPDATA%\nsskrnl %APPDATA%\winserv.exe %APPDATA%\OracleJava\javaw
Slide 26: Upcoming Events and Resources
Upcoming Events and Resources Upcoming Webinars – Training tab on www.visa.com/cisp • Fraud Prevention Strategies for Merchants ‒ 15 October 2014, 10 am PST • Strategies to Effectively Manage Data Compromise Events ‒ 12 November 2014, 10 am PST Visa Data Security Website – www.visa.com/cisp • Alerts
Slide 27: Questions?
Questions? Visa Public