Visa Inc. · NYSE:V
Visa — Technical Presentation (December 2015)
23 slides from Visa's technical presentation, Dec 17, 2015
Slide 1: “BlackPOS” Malware Revisited Webinar
“BlackPOS” Malware Revisited Webinar 17 December 2015 Visa Public
Slide 2: Disclaimer
Disclaimer The information or recommendations contained herein are provided "AS IS" and intended for informational purposes only and should not be relied upon for operational, marketing, legal, technical, tax, financial or other advice. When implementing any new strategy or practice, you should cons
Slide 3: Agenda
Agenda • The Discovery of BlackPOS • Malware Capabilities • Attack Characteristics • BlackPOS Detection Strategies • POS Malware Prevention • Questions and Answers 3 | “BlackPOS” Malware Revisited | 17 December 2015 Visa Public
Slide 4: Criminals are launching more sophisticated attacks targeting merchants
Trends in Data Compromises Criminals are launching more sophisticated attacks targeting merchants Frequency Magnitude Sophistication Organization 4 | “BlackPOS” Malware Revisited | 17 December 2015 Visa Public
Slide 5: The Discovery of “BlackPOS”
The Discovery of “BlackPOS” 5 | “BlackPOS” Malware Revisited | 17 December 2015 Visa Public
Slide 6: Background and Discovery
BlackPOS Background and Discovery • Initially seen “in the wild” in early 2012 • Dubbed Kaptoxa, pronounced (“Kar-toe-sha”) based on strings found in the malware • Identified again in late 2013, believed to be found at several retailers • Linkages found to earlier POS malware • Source code has been
Slide 7: Research and Analysis
BlackPOS Research and Analysis • Security researchers are continually reverse-engineering • String found in one of the earlier versions: z:\Projects\Rescator\MmonNew\Debug\mmon.pdb • Since its discovery, many different versions have been identified –each with new or slightly different characteristic
Slide 8: Malware Capabilities
BlackPOS Malware Capabilities 8 | “BlackPOS” Malware Revisited | 17 December 2015 Visa Public
Slide 9: Point-of-Sale (POS) RAM Scraping
Point-of-Sale (POS) RAM Scraping Merchant Network Cardholder POS Hardware POS Software Visa Issuing Acquiring Bank Bank 9 | “BlackPOS” Malware Revisited | 17 December 2015 Visa Public
Slide 10: POS RAM Scraping Primer
POS RAM Scraping Primer • Authorization data temporarily stored in clear text system memory • Cybercriminals attack memory space because it is the easiest path to the data • RAM scrapers generally use logic to identify track 1 and 2 data • Some malware known to use Luhn algorithm to validate • Captu
Slide 11: (somewhat) Unique Characteristics
BlackPOS (somewhat) Unique Characteristics Recent Variations and Functionality • Additional functionality: • Self-deletion capability post exfiltration (reported in recent versions) • Not service dependent, so removal is more likely • Character shifting obfuscation • System level log scrubbing, e.g.
Slide 12: Capabilities
BlackPOS Capabilities Core Capabilities With Varying “bells and whistles” • Different variations each incident (no MD5 match, no A/V detection) • Installation and persistence mechanisms • Memory-scraping • Data encoding and masking • Data exfiltration • Self-removal 12 | “BlackPOS” Malware Revisited
Slide 13: Attack Characteristics
Attack Characteristics 13 | “BlackPOS” Malware Revisited | 17 December 2015 Visa Public
Slide 14: Attack Characteristics
BlackPOS Attack Characteristics Initial Attack Vectors • Common attack scenarios • Remote access credentials • Internet-facing systems with weak authentication • Botnet infection • Exfiltration occurs via ports / services commonly associated with data transfer • ICMP • TLS/HTTPS • NetBIOS • SSH • FT
Slide 15: Post-Attack Infrastructure Setup
Post-Attack Infrastructure Setup Once Inside: Network Exploration and Exploit Tools Accompanying BlackPOS • Network exploration and system mapping • Proxies • Privileged account identification • Account takeover • Data aggregation • Data exfiltration • Evidence cleanup / anti-forensics 15 | “BlackPO
Slide 16: Characteristics
BlackPOS Characteristics POS Malware Distribution, Data Aggregation, Hiding and Exfiltration • BlackPOS malware installation • Data movement timing mechanism • Aggregation servers • “Jump” servers for data exfiltration 16 | “BlackPOS” Malware Revisited | 17 December 2015 Visa Public
Slide 17: Detection Strategies
BlackPOS Detection Strategies 17 | “BlackPOS” Malware Revisited | 17 December 2015 Visa Public
Slide 18: Prevention and Detection Strategies
BlackPOS Prevention and Detection Strategies Prevention Layered Early defense warning signs IOCs 18 | “BlackPOS” Malware Revisited | 17 December 2015 Visa Public
Slide 19: Warning Signs
BlackPOS Warning Signs • Unexpected Windows services on the POS system • Unexplained SMB traffic from or from the POS system (possibly encrypted) • New, unexplained (likely encrypted or encoded) files on the POS • Newly installed Windows services on POS system • Outbound FTP traffic to the Internet
Slide 20: Prevention
BlackPOS Prevention • Ensure that overall payment processing environment is securely configured and maintained in accordance with the PCI DSS. • Ensure that firewall rules only allow remote access from known IP addresses • If remote connectivity is required, enable it only when needed • Contact your
Slide 21: Indicators of Compromise (IOCs)
Indicators of Compromise (IOCs) • Operating system target selection • Windows XP, mostly Professional • Processes activity • Searches for pos.exe to determine what to scrape • Exfiltration • Creates file output.txt which may contain card data • Creates .dll files (e.g., twain_32*.dll) which may cont
Slide 22: Upcoming Events and Resources
Upcoming Events and Resources Upcoming Webinars – Training tab on www.visa.com/cisp • “Kuhook” Point-of-Sale Malware ‒ 27 January 2016, 10 am PST Visa Data Security Website – www.visa.com/cisp • Alerts, Bulletins • Best Practices, White Papers • Webinars PCI Security Standards Council Website – www.
Slide 23: Questions?
Questions? Visa Public