hp-security-research-cyber-risk-report-pdf-2-w-1408
hp-security-research-cyber-risk-report-pdf-2-w-1408
hp-security-research-cyber-risk-report-pdf-2-w-1408
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
HP Security Research | Cyber Risk Report 2015Capturing financial data: Process enumeration and memory acquisitionIn order to capture financial data, most POS malware uses a technique called RAM scraping.RAM scraping occurs when the malware enumerates the processes and virtual memory spaceof the target machine looking for track 1 and track 2 data. (Track 1 and track 2 data is storedon the magnetic strip on the back of the card. It includes the account number associated withthe card, its expiration date, and additional details that determine how and which transactionswill be processed.) Process enumeration is usually performed by the EnumProcesses API or theCreateToolhelp32Snapshot and related APIs. Regardless of this difference, the two methodsfunction in the same way.In order to limit the amount of enumeration that is required to capture data, POS malware mayuse different techniques for selecting which processes to target. Looking at our case studies, 131BlackPOS, for example, only scans a process named “pos.exe.” This is notable, as it implies thatthe authors of the malware had previous knowledge of the environment in which the malwarewould be run. The malware authors also save the “pos.exe” string in encoded form in the binary,so that the process being targeted isn’t obvious upon casual inspection of the executable. Incontrast, Mozart and other POS malware types use a blacklist approach. Blacklisting excludescommon process names from the scanning process. This approach is more generic, as themalware can then be used for different POS systems using different process names. ManyPOS systems still use Windows XP machines, which have limited CPU and memory capacity,so saving resources by more effectively targeting relevant processes is an essential feature ofmodern POS malware.After locating the processes to scan, the POS malware queries the virtual memory list allocatedon the target process using the VirtualQueryEx API. This routine is common to many differentPOS malware types. Then, after enumerating processes and virtual memory on the targetmachine, the POS malware uses the ReadProcessMemory API to read the process memory.Enumerating processes and virtual memory is a very common feature of POS malware. Whilespecial customized code is not required for these tasks, for malware analysts, the process andexclusion lists can provide clues as to which product line the malware may be targeting.Getting on the right track: Track data location methodsAt this stage in the process, our example malware types diverge, and each uses a differentapproach to find the valuable track 1 and 2 data in the information that’s been scraped frommemory. While older POS malware (such as vSkimmer) often used regular expressions tosearch for track 1 and track 2 patterns, this can be very CPU-intensive. Considering that POSmachines have limited CPU and memory resources, better methods were required. Thus morerecent POS malware tends to use custom track search routines.DexterThe search routine used in Dexter is simple and only recognizes track 2 records. The recognitionof the track 2 pattern starts by locating the track 2 separator (denoted by “=”) and then checkingfor numeric characters before and after the separator character.BlackPOSBlackPOS searches for both track 1 and track 2 patterns. It checks if the current byte is eitherthe track 1 separator (denoted by “^”) or the track 2 separator (denoted by “=”). If it matches thepattern, it checks the length of numeric characters that come before the separator in order tofurther validate that this is the correct data.131http://h30499.www3.<strong>hp</strong>.com/t5/HP-Security-Research-Blog/Hacking-POS-Terminal-for-Funand-Non-profit/ba-p/6540620.43