August 28, 2014 By Douglas Bonderud 3 min read

According to an Aug. 22 release from the Department of Homeland Security and the U.S. Secret Service, the Backoff hacker tool is alive and well in point-of-sale (POS) systems across the country. The tool first gained notoriety when it was used to breach retail giant Target and was of particular interest to security experts because it couldn’t be detected by existing antivirus programs. The tool hasn’t disappeared, however, and government agencies are now urging retailers to check their cash register systems. As of Friday, Homeland Security announced that more than 1,000 American businesses had been compromised.

Backoff, Hacker!

According to a recent New York Times blog post, the Backoff hacker process begins with hackers scanning corporate systems for remote access points, such as those used by third-party vendors or workers who telecommute. Once an access point is identified, a high-speed computer is used to run through millions of password and login combinations until access is granted. Next, hackers work their way through corporate networks to POS systems, where they install Backoff and start shunting credit card data to remote servers.

The worst part? Unless retail companies go looking for this tool, there is no indication that anything is amiss. This means customers could have their credit card information posted for sale on the black market without having any idea they are at risk. In Target’s case, hackers set up shop for weeks before someone caught wind of what was going on. While other companies such as UPS and SuperValu have come forward to say they’ve also been infected, many potential victims are staying quiet.

Solving the Problem

How do companies cope when technology turns against them? POS machines are just one example. As noted by a recent eWEEK article, it is now possible to reprogram USB devices to act as other peripherals. This means, for example, that a USB storage drive could be re-engineered to act like a keyboard and gain administrative-level access privileges once attached. Just like the Backoff tool, finding evidence of device tampering is difficult.

So beyond just scanning for this malware, what can retailers do to protect their POS networks? Avivah Litan of Gartner Research makes the case for improved card technology.

“The weakness is the magnetic stripe,” she said. “I can buy a mag stripe reader on eBay and easily read all the data from your credit card.”

The simplest option to secure card data is using a chip-based system, but despite an October 2015 deadline, most companies will likely miss the mark due to the large cost ($500 to $1,000 per terminal) needed to upgrade. Beyond locking down cards, however, the Secret Service has other recommendations. Retailers should segregate cash registers from corporate networks, require two-factor authentication for all users accessing the payment system and lock out users after a predetermined number of unsuccessful attempts.

Critical Disclosure

However, there’s more to this story than meets the eye. According to the IBM X-Force Threat Intelligence Quarterly, there has been a sharp decline in vulnerability disclosures through 2014. In 2013, 1,602 vendors reported vulnerabilities; in 2014, the threat number was cut almost in half to 926. And while the number of disclosures by large enterprise software vendors remained consistent, the trend is worth noting. Are there are really fewer vulnerabilities, or are companies simply choosing to not report them?

Part of the problem may be the seeming inevitability of attacks. The X-Force report examined the timeline of one-day attacks such as Heartbleed and found that less than a day after the April 7 CVE-2014-0160 security advisory was issued, a proof-of-concept began to circulate. Organizations such as the Canadian Revenue Agency and security firm Mandiant were breached on April 8, and while companies such as Mumsnet patched their systems by April 9, it was already too late. Essentially, it comes down to a race. Do hackers or security professionals get to the finish line first?

Bleeding Hearts

The Heartbleed debacle showcases how one-day exploits can be just as damaging — if not more so — than their zero-day counterparts. Hackers wasted no time bleeding as many hearts as possible; while a patch for Heartbleed was developed within days of its release, the peak number of attacks occurred on April 15. More than 300,000 attacks took place in one day, which comes out to an average of 3.47 attacks per second.

The bottom line? The Backoff hacker malware continues to be a problem for retailers, long after the initial exploit was discovered. Countering this and similar threats means keeping up with breach intelligence, implementing effective detection tools and creating a clear, process-driven disclosure plan.

More from

Change Healthcare discloses $22M ransomware payment

3 min read - UnitedHealth Group CEO Andrew Witty found himself answering questions in front of Congress on May 1 regarding the Change Healthcare ransomware attack that occurred in February. During the hearing, he admitted that his organization paid the attacker's ransomware request. It has been reported that the hacker organization BlackCat, also known as ALPHV, received a payment of $22 million via Bitcoin.Even though they made the ransomware payment, Witty shared that Change Healthcare did not get its data back. This is a…

Phishing kit trends and the top 10 spoofed brands of 2023

4 min read -  The 2024 IBM X-Force Threat Intelligence Index reported that phishing was one of the top initial access vectors observed last year, accounting for 30% of incidents. To carry out their phishing campaigns, attackers often use phishing kits: a collection of tools, resources and scripts that are designed and assembled to ease deployment. Each phishing kit deployment corresponds to a single phishing attack, and a kit could be redeployed many times during a phishing campaign. IBM X-Force has analyzed thousands of…

How I got started: AI security researcher

4 min read - For the enterprise, there’s no escape from deploying AI in some form. Careers focused on AI are proliferating, but one you may not be familiar with is AI security researcher. These AI specialists are cybersecurity professionals who focus on the unique vulnerabilities and threats that arise from the use of AI and machine learning (ML) systems. Their responsibilities vary, but key roles include identifying and analyzing potential security flaws in AI models and developing and testing methods malicious actors could…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today