According to an Aug. 22 release from the Department of Homeland Security and the U.S. Secret Service, the Backoff hacker tool is alive and well in point-of-sale (POS) systems across the country. The tool first gained notoriety when it was used to breach retail giant Target and was of particular interest to security experts because it couldn’t be detected by existing antivirus programs. The tool hasn’t disappeared, however, and government agencies are now urging retailers to check their cash register systems. As of Friday, Homeland Security announced that more than 1,000 American businesses had been compromised.

Backoff, Hacker!

According to a recent New York Times blog post, the Backoff hacker process begins with hackers scanning corporate systems for remote access points, such as those used by third-party vendors or workers who telecommute. Once an access point is identified, a high-speed computer is used to run through millions of password and login combinations until access is granted. Next, hackers work their way through corporate networks to POS systems, where they install Backoff and start shunting credit card data to remote servers.

The worst part? Unless retail companies go looking for this tool, there is no indication that anything is amiss. This means customers could have their credit card information posted for sale on the black market without having any idea they are at risk. In Target’s case, hackers set up shop for weeks before someone caught wind of what was going on. While other companies such as UPS and SuperValu have come forward to say they’ve also been infected, many potential victims are staying quiet.

Solving the Problem

How do companies cope when technology turns against them? POS machines are just one example. As noted by a recent eWEEK article, it is now possible to reprogram USB devices to act as other peripherals. This means, for example, that a USB storage drive could be re-engineered to act like a keyboard and gain administrative-level access privileges once attached. Just like the Backoff tool, finding evidence of device tampering is difficult.

So beyond just scanning for this malware, what can retailers do to protect their POS networks? Avivah Litan of Gartner Research makes the case for improved card technology.

“The weakness is the magnetic stripe,” she said. “I can buy a mag stripe reader on eBay and easily read all the data from your credit card.”

The simplest option to secure card data is using a chip-based system, but despite an October 2015 deadline, most companies will likely miss the mark due to the large cost ($500 to $1,000 per terminal) needed to upgrade. Beyond locking down cards, however, the Secret Service has other recommendations. Retailers should segregate cash registers from corporate networks, require two-factor authentication for all users accessing the payment system and lock out users after a predetermined number of unsuccessful attempts.

Critical Disclosure

However, there’s more to this story than meets the eye. According to the IBM X-Force Threat Intelligence Quarterly, there has been a sharp decline in vulnerability disclosures through 2014. In 2013, 1,602 vendors reported vulnerabilities; in 2014, the threat number was cut almost in half to 926. And while the number of disclosures by large enterprise software vendors remained consistent, the trend is worth noting. Are there are really fewer vulnerabilities, or are companies simply choosing to not report them?

Part of the problem may be the seeming inevitability of attacks. The X-Force report examined the timeline of one-day attacks such as Heartbleed and found that less than a day after the April 7 CVE-2014-0160 security advisory was issued, a proof-of-concept began to circulate. Organizations such as the Canadian Revenue Agency and security firm Mandiant were breached on April 8, and while companies such as Mumsnet patched their systems by April 9, it was already too late. Essentially, it comes down to a race. Do hackers or security professionals get to the finish line first?

Bleeding Hearts

The Heartbleed debacle showcases how one-day exploits can be just as damaging — if not more so — than their zero-day counterparts. Hackers wasted no time bleeding as many hearts as possible; while a patch for Heartbleed was developed within days of its release, the peak number of attacks occurred on April 15. More than 300,000 attacks took place in one day, which comes out to an average of 3.47 attacks per second.

The bottom line? The Backoff hacker malware continues to be a problem for retailers, long after the initial exploit was discovered. Countering this and similar threats means keeping up with breach intelligence, implementing effective detection tools and creating a clear, process-driven disclosure plan.

More from

Vulnerability resolution enhanced by integrations

2 min read - Why speed is of the essence in today's cybersecurity landscape? How are you quickly achieving vulnerability resolution?Identifying vulnerabilities should be part of the daily process within an organization. It's an important piece of maintaining an organization’s security posture. However, the complicated nature of modern technologies — and the pace of change — often make vulnerability management a challenging task.In the past, many organizations had to support manual integration work to get different security systems to ‘talk’ to each other. As…

How I got started: SIEM engineer

2 min read - As careers in cybersecurity become increasingly more specialized, Security Information and Event Management (SIEM) engineers are playing a more prominent role. These professionals are like forensic specialists but are also on the front lines protecting sensitive information from the relentless onslaught of cyber threats. SIEM engineers meticulously monitor, analyze and manage security events and incidents within an organization. They leverage SIEM tools to aggregate and correlate data, enabling them to detect anomalies, identify potential threats and respond swiftly to security…

Tequila OS 2.0: The first forensic Linux distribution in Latin America

3 min read - Incident response teams are stretched thin, and the threats are only intensifying. But new tools are helping bridge the gap for cybersecurity pros in Latin America.IBM Security X-Force Threat Intelligence Index 2023 found that 12% of the security incidents X-force responded to were in Latin America. In comparison, 31% were in the Asia-Pacific, followed by Europe with 28%, North America with 25% and the Middle East with 4%. In the Latin American region, Brazil had 67% of incidents that X-Force…

Cost of a data breach 2023: Geographical breakdowns

4 min read - Data breaches can occur anywhere in the world, but they are historically more common in specific countries. Typically, countries with high internet usage and digital services are more prone to data breaches. To that end, IBM’s Cost of a Data Breach Report 2023 looked at 553 organizations of various sizes across 16 countries and geographic regions, and 17 industries. In the report, the top five costs of a data breach by country or region (measured in USD millions) for 2023…