The danger of having the data of thousands of credit cards recorded makes Point of Sale (POS) terminals a critical system, as well as an increasingly sought-after target of cybercrime. Attacking these devices anonymously online is relatively straightforward, and selling the data on the black market is profitable.

We’ve recently detected infections at a significant number of bars and restaurants in the United States whose POS terminals were attacked by two variants of credit card theft malware.

The malware samples that we’ll be analyzing are the following:

File name                          MD5

Epson.exe                           69E361AC1C3F7BCCE844DE43310E5259

Wnhelp.exe                       D4A646841663AAC2C35AAB69BEB9CFB3

Epson.exe presents an invalid certificate:

Both samples were compiled with Microsoft Visual C ++ 8, and are not packaged or encrypted. Once the malware is executed in the system, it proceeds to analyze the different system processes in search of credit cards.

Here we can see how they go through the different processes looking only for those that can contain credit cards in memory:

In the case of the “Epson.exe” sample, it will search for credit cards in the following processes:

Program name Description           
notepad++.exe Text editor
CreditCardService.exe Microsoft
DSICardnetIP_Term.exe NETePay for Mercury
DSIMercuryIP_Dial.exe NETePay for Mercury
EdcSvr.exe Aloha Electronic Draft Capture (EDC)
fpos.exe Future POS
mxSlipStream4 / mxSlipStream5 / mxSlipStream.exe / mxSwipeSVC.exe SlipStream POS System Transaction Processor by mXpress
NisSrv.exe Windows 8
spcwin.exe/ Spcwin.exe / SPCWIN.exe /SPCWIN.EXE POSitouch (Food Service Industry POS System)

On the other hand, the “Wnhelp.exe” sample contains a list that is used to discard the processes to be analyzed. If the process name coincides with any item on the list, it will not be analyzed in the search for credit cards:

Discarded processes:
explorer.exe alg.exe
chrome.exe wscntfy.exe
firefox.exe taskmgr.exe
iexplore.exe spoolsv.exe
svchost.exe QML.exe
smss.exe AKW.exe
csrss.exe OneDrive.exe
wininit.exe VsHub.exe
steam.exe Microsoft.VsHub.Server.HttpHost.exe
devenv.exe vcpkgsrv.exe
thunderbird.exe dwm.exe
skype.exe dllhost.exe
pidgin.exe jusched.exe
services.exe jucheck.exe
winlogon.exe lsass.exe

 

In both samples, once the process it wishes to analyze is obtained, whether because it was contained on the list – as with Epson.exe – or because it was discarded – as with Wnhelp.exe – it will create a new thread:

And will then proceed to analyze the memory using an algorithm specifically designed to check whether the found data is from credit cards:

The Wnhelp.exe sample is executed by the attackers with the command “install”, in such a way that it creates a service to ensure its persistence in the system:

The service is called “Windows Error Reporting Service Log”.

The sample Epson.exe works in the same way, although attackers can configure the name of the service as they want through parameters:

install [Service name] [Service description] [Third parameter]

Each variant connects to a different command and control (C&C) server:

Epson.exe dropalien.com/wp-admin/gate1.php
Wnhelp.exe www.rdvaer.com/ wp-admin/gate1.php

 

They can then receive different orders from the attacker:

Commands Description
update = [URL] Malware update.
dlex = [URL] Downloads and runs file.
chk = [CRC_Checksum] Updates the file’s checksum.

To connect the control panel, they use the following UserAgent:

“Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.22 (KHTML, like Gecko) Chrome/25.0.1364.152 Safari/537.22”

The communication is carried out by an SSL. The malware modifies the internet connection configuration to ignore unknown CAs (Certificate Authorities), thereby ensuring that it will be able to use its own certificate.

First it obtains the internet connection security flags through the InternetQueryOptionA API with the third argument set to the value INTERNET_OPTION_SECURITY_FLAGS (31). Once obtained, it carries out a binary OR with the flag SECURITY_FLAG_IGNORE_UNKNOWN_CA (100h).

Conclusion: How to Confront a POS Attack

Attacks on POS terminals are still very popular, especially in countries like the United States where the use of Chip & PIN is not mandatory. Many of these attacks target businesses that do not have specialized personnel in computer science, much less in security, an oversight that attackers can take advantage of.

POS terminals are computers that handle critical data and therefore must be fortified to the maximum in order to shield customer data from the inherent risks. Solutions such as Adaptive Defense 360 help to ensure that no malicious process is executed in these terminals. There is no need to hire a security specialist, because the solution includes Panda Security’s own technicians, who will be responsible for ensuring that everything all executed processes are safe.