August 28, 2014 By Douglas Bonderud 3 min read

According to an Aug. 22 release from the Department of Homeland Security and the U.S. Secret Service, the Backoff hacker tool is alive and well in point-of-sale (POS) systems across the country. The tool first gained notoriety when it was used to breach retail giant Target and was of particular interest to security experts because it couldn’t be detected by existing antivirus programs. The tool hasn’t disappeared, however, and government agencies are now urging retailers to check their cash register systems. As of Friday, Homeland Security announced that more than 1,000 American businesses had been compromised.

Backoff, Hacker!

According to a recent New York Times blog post, the Backoff hacker process begins with hackers scanning corporate systems for remote access points, such as those used by third-party vendors or workers who telecommute. Once an access point is identified, a high-speed computer is used to run through millions of password and login combinations until access is granted. Next, hackers work their way through corporate networks to POS systems, where they install Backoff and start shunting credit card data to remote servers.

The worst part? Unless retail companies go looking for this tool, there is no indication that anything is amiss. This means customers could have their credit card information posted for sale on the black market without having any idea they are at risk. In Target’s case, hackers set up shop for weeks before someone caught wind of what was going on. While other companies such as UPS and SuperValu have come forward to say they’ve also been infected, many potential victims are staying quiet.

Solving the Problem

How do companies cope when technology turns against them? POS machines are just one example. As noted by a recent eWEEK article, it is now possible to reprogram USB devices to act as other peripherals. This means, for example, that a USB storage drive could be re-engineered to act like a keyboard and gain administrative-level access privileges once attached. Just like the Backoff tool, finding evidence of device tampering is difficult.

So beyond just scanning for this malware, what can retailers do to protect their POS networks? Avivah Litan of Gartner Research makes the case for improved card technology.

“The weakness is the magnetic stripe,” she said. “I can buy a mag stripe reader on eBay and easily read all the data from your credit card.”

The simplest option to secure card data is using a chip-based system, but despite an October 2015 deadline, most companies will likely miss the mark due to the large cost ($500 to $1,000 per terminal) needed to upgrade. Beyond locking down cards, however, the Secret Service has other recommendations. Retailers should segregate cash registers from corporate networks, require two-factor authentication for all users accessing the payment system and lock out users after a predetermined number of unsuccessful attempts.

Critical Disclosure

However, there’s more to this story than meets the eye. According to the IBM X-Force Threat Intelligence Quarterly, there has been a sharp decline in vulnerability disclosures through 2014. In 2013, 1,602 vendors reported vulnerabilities; in 2014, the threat number was cut almost in half to 926. And while the number of disclosures by large enterprise software vendors remained consistent, the trend is worth noting. Are there are really fewer vulnerabilities, or are companies simply choosing to not report them?

Part of the problem may be the seeming inevitability of attacks. The X-Force report examined the timeline of one-day attacks such as Heartbleed and found that less than a day after the April 7 CVE-2014-0160 security advisory was issued, a proof-of-concept began to circulate. Organizations such as the Canadian Revenue Agency and security firm Mandiant were breached on April 8, and while companies such as Mumsnet patched their systems by April 9, it was already too late. Essentially, it comes down to a race. Do hackers or security professionals get to the finish line first?

Bleeding Hearts

The Heartbleed debacle showcases how one-day exploits can be just as damaging — if not more so — than their zero-day counterparts. Hackers wasted no time bleeding as many hearts as possible; while a patch for Heartbleed was developed within days of its release, the peak number of attacks occurred on April 15. More than 300,000 attacks took place in one day, which comes out to an average of 3.47 attacks per second.

The bottom line? The Backoff hacker malware continues to be a problem for retailers, long after the initial exploit was discovered. Countering this and similar threats means keeping up with breach intelligence, implementing effective detection tools and creating a clear, process-driven disclosure plan.

More from

How will the Merck settlement affect the insurance industry?

3 min read - A major shift in how cyber insurance works started with an attack on the pharmaceutical giant Merck. Or did it start somewhere else?In June 2017, the NotPetya incident hit some 40,000 Merck computers, destroying data and forcing a months-long recovery process. The attack affected thousands of multinational companies, including Mondelēz and Maersk. In total, the malware caused roughly $10 billion in damage.NotPetya malware exploited two Windows vulnerabilities: EternalBlue, a digital skeleton key leaked from the NSA, and Mimikatz, an exploit…

3 Strategies to overcome data security challenges in 2024

3 min read - There are over 17 billion internet-connected devices in the world — and experts expect that number will surge to almost 30 billion by 2030.This rapidly growing digital ecosystem makes it increasingly challenging to protect people’s privacy. Attackers only need to be right once to seize databases of personally identifiable information (PII), including payment card information, addresses, phone numbers and Social Security numbers.In addition to the ever-present cybersecurity threats, data security teams must consider the growing list of data compliance laws…

ICS CERT predictions for 2024: What you need to know

4 min read - As we work through the first quarter of 2024, various sectors are continuously adapting to increasingly complex cybersecurity threats. Sectors like healthcare, finance, energy and transportation are all regularly widening their digital infrastructure, resulting in larger attack surfaces and greater risk exposure.Kaspersky just released their ICS CERT Predictions for this year, outlining the key cybersecurity challenges industrial enterprises will face in the year ahead. The forecasts emphasize the persistent nature of ransomware threats, the increasing prevalence of cosmopolitical hacktivism, insights…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today