Tor-based ChewBacca botnet is infecting POS stealing Credit Card data

Pierluigi Paganini February 01, 2014

Researchers at RSA discovered a new variant of Tor-based malware ‘ChewBacca’, is able to infect Point-of-Sale stealing Credit Card data.

The recent data breaches at US retailers TargetNeiman Marcus and Michaels have raised the alert level of malware-based attacks against POS systems. More than one hundred million Americans is victims of scams that mainly used a malware known as BlackPOS or its variant, to infect POS system and capture data transaction during users’ purchases.

The author of BlackPOS was rapidly identified, but the malicious agent is very popular in the underground communities, the malicious code also represents a stimulus for other malware developers to design applications that offer similar functionality, including the capability to steal tracks from debit/credit cards used by victims.

One of the most interesting malware recently spotted by experts at Kaspersky Lab is ChewBacca, 

a Tor-based banking trojan which

appeared very attractive for cybercriminals that search for a financial malwareRecently security researchers at RSA have detected a new variant of ChewBacca, which implements also a stealing credit card capability, a feature that makes it attractive for attacks against POS systems.  The trend to use Tor networks is becoming very effective, bootmaster can hide their control infrastructures, making hard their eradication to law enforcement and security firms. In time I’m writing it is still unknown how the ChewBacca infection is propagated.

According RSA the botnet, based on the ChewBacca POS variant, is in use at least against customers of 11 countries (including US, Russia, Canada and Australia) since October 25 2013, it is able to steal credit card data with “keylogger” capabilities or dumping the content of the memory of the POS in search for credit card details.

ChewBacca features two distinct data-stealing mechanisms: a generic keylogger and a memory scanner designed to specifically target systems that process credit cards, such as Point-of-Sale (POS) systems. The memory scanner dumps a copy of a process’s memory and searches it using simple regular expressions for card magnetic stripe data. If a card number is found, it is extracted and logged by the server.” reports RSA in the blog post.

The bot is able to collect trackand track 2 data of payment card during purchases, following a description I provided in my previous post on the malware:
Chewbacca code was compiled with Free Pascal 2.7.1., once executed windows based system, it drops as spoolsv.exe in the startup folder and also drops a copy of Tor 0.2.3.25.

“After execution, the function “P$CHEWBACCA$_$TMYAPPLICATION_$__$$_INSTALL” is called, which drops itself as “spoolsv.exe” into the “Startup folder” (e.g. C:\Documents and Settings\All Users\Start Menu\Programs\Startup\) and requests the public IP of the victim via a publicly accessible service at http://ekiga.net/ip (which is not related to the malware). Tor is dropped as “tor.exe” to the user-s Temp and runs with a default listing on “localhost:9050″.”

The Chewbacca Trojan logs all keystrokes by the user to “system.log” under the user’s local Temp folder and then sends the data back to the botnet controllers via Tor anonymity network. Chewbacca also enumerates all running processes and reads their process memory, another characteristic is that the C&C server is a LAMP platform (Linux, Apache, MySQL and PHP).

Chewbacca Report
The RSA is supporting law enforcement for the investigation on ChewBacca botnet, its experts have localized the C&C servers and are alerting the retailers on the risks related to the dangerous malware. As explained in the post, the retailers need to change their approach to security.
“Retailers have a few choices against these attackers. They can increase staffing levels and develop leading-edge capabilities to detect and stop attackers (comprehensive monitoring and incident response), or they can encrypt or tokenize data at the point of capture and ensure that it is not in plaintext view on their networks, thereby shifting the risk and burden of protection to the card issuers and their payment processors.” states RSA.

Pierluigi Paganini

(Security Affairs –  Tor-based malware, ChewBacca)



you might also like

leave a comment