Malware researchers at Flashpoint revealed that at least since 2016, a PoS malware dubbed DMSniff has flown under the radar.
Malware researchers at Flashpoint revealed that since 2016, a PoS malware dubbed DMSniff has been involved in breaches of small- and medium-sized businesses in the restaurant and entertainment industries.
DMSniff leverages a domain generation algorithm to create command-and-control domains on the fly, a technical choice that make it hard takedown of C2 infrastructure by law enforcement and that is uncommon for PoS malware. DMSniff will loop between multiple top-level domains (TLDs) until it manages to find a command-and-control server (C&C) to connect with. DMSniff uses multiple techniques to protect itself and the C2 communications, including a simple string-encoding routine that hides strings associated with the malware.
“Point-of-sale malware previously only privately sold has been used in breaches of small- and medium-sized businesses in the restaurant and entertainment industries. The malware, known as DMSniff, also uses a domain generation algorithm (DGA) to create lists of command-and-control domains on the fly. ” reads the analysis published by Flashpoint.
DMSniff remained under the radar for at least four years, attackers use to drop the PoS malware on the devices either by using brute-force attacks against SSH connections, or by exploiting vulnerabilities.
In order to steal credit card data from the POS systems, the malware search for interesting process and loops through the memory sections to attempt to find credit card data.
“Each time it finds an interesting process, it will loop through the memory sections to attempt to find a credit card number.” continues the analysis. “Once a number is found, the bot will take the card data and some of the surrounding memory, packages it, and sends it to the C2.”
Further details about the DMSniff, including indicators of compromise (IoCs), are reported in the analysis published by Flashpoint.
“DMSniff is another name in a growing list of evolving threats for the point-of-sale malware world. During our research we found that this malware was primarily utilized to target small to medium sized businesses such as restaurants and theaters.” concludes the experts. “It also contains a domain generation algorithm, something that is rare to see in point-of-sale malware”
Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer.
Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US.
Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines.
Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.