October 30, 2014 By Douglas Bonderud 2 min read

The numbers don’t look good: Despite being discovered, named and at least partially remediated late last year, the Backoff malware continues to infect point-of-sale (POS) systems across the country.

According to a report from Help Net Security on a new study from security firm Damballa, there was a 57 percent increase in Backoff infections from August to September 2014 and a 27 percent increase through the month of September. This works out to an average of 37 infected devices a day and doesn’t bode well for retail companies trying to avoid the POS malware scourge. Is there any way to stay protected?

Backoff Malware Worse Than It Looks

Since Dambella’s data only comes from systems where POS traffic is monitored, it gets worse: Companies that choose not to monitor their POS networks — many of which are stand-alone and include easy access for patches and updates — are at even greater risk. How big is this risk? In the latest quarter, close to 1,000 businesses were victimized by the Backoff malware, and high-profile corporations such as Home Depot, Kmart, Jimmy John’s, Goodwill and P. F. Chang’s have also come under attack. In short, any business that uses POS devices is a target.

So why has this malware problem reemerged after it was supposedly solved after the Target breach? Simply put, companies continue to rely on security controls that don’t detect this kind of malware — and won’t catch new versions that have been slightly modified from the original. It’s comparable to an oft-quoted definition of madness: doing the same thing over and over again expecting different results.

An Ounce of Prevention

Brian Foster, chief technology officer of Damballa, said data collected by his company “show that prevention controls cannot stop malware infections,” according to PC Magazine. However, this continues to be the most popular response to Backoff: build higher walls and put more pressure on security teams to find POS malware infections.

Instead, Foster and other experts recommend developing better security intelligence. It starts with businesses acting as if they are always under threat or in a state of continuous breach. Rather than ramping up IT security when news of another Backoff, Shellshock or Heartbleed hits the news — by which time systems are already infected — companies should assume a breach has happened and evaluate their systems accordingly.

The result is a proactive approach to finding and eliminating threats. Additionally, retail businesses need a better way to identify “true positives,” or security events on their systems that are genuine attacks. With a combination of automatic detection using evidence correlation, positive event confirmation and “risk ranking,” Damballa found companies reduced their number of daily infections by up to 40 percent.

Beyond intelligent security countermeasures, however, it is also time to take a hard look at the POS device ecosystem. Many of these devices come from third-party vendors, none of which are security companies or design their devices to withstand malware-based attacks. Instead, they are created to provide maximum functionality at a reasonable price and are often given unfettered access to corporate networks because they don’t act like “typical” computers. Pushing back against Backoff and other malware means getting POS traffic off the perimeter and into the secure heart of company networks, where it can be monitored for suspicious activity.

Backoff isn’t backing off, and it won’t so long as companies keep trying to build bigger walls around their POS systems. When this malware can go under, around or right through traditional security architecture, building walls is a waste. Opt for a moat instead, then monitor what sinks and swims.

More from

How will the Merck settlement affect the insurance industry?

3 min read - A major shift in how cyber insurance works started with an attack on the pharmaceutical giant Merck. Or did it start somewhere else?In June 2017, the NotPetya incident hit some 40,000 Merck computers, destroying data and forcing a months-long recovery process. The attack affected thousands of multinational companies, including Mondelēz and Maersk. In total, the malware caused roughly $10 billion in damage.NotPetya malware exploited two Windows vulnerabilities: EternalBlue, a digital skeleton key leaked from the NSA, and Mimikatz, an exploit…

3 Strategies to overcome data security challenges in 2024

3 min read - There are over 17 billion internet-connected devices in the world — and experts expect that number will surge to almost 30 billion by 2030.This rapidly growing digital ecosystem makes it increasingly challenging to protect people’s privacy. Attackers only need to be right once to seize databases of personally identifiable information (PII), including payment card information, addresses, phone numbers and Social Security numbers.In addition to the ever-present cybersecurity threats, data security teams must consider the growing list of data compliance laws…

ICS CERT predictions for 2024: What you need to know

4 min read - As we work through the first quarter of 2024, various sectors are continuously adapting to increasingly complex cybersecurity threats. Sectors like healthcare, finance, energy and transportation are all regularly widening their digital infrastructure, resulting in larger attack surfaces and greater risk exposure.Kaspersky just released their ICS CERT Predictions for this year, outlining the key cybersecurity challenges industrial enterprises will face in the year ahead. The forecasts emphasize the persistent nature of ransomware threats, the increasing prevalence of cosmopolitical hacktivism, insights…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today