According to an Aug. 22 release from the Department of Homeland Security and the U.S. Secret Service, the Backoff hacker tool is alive and well in point-of-sale (POS) systems across the country. The tool first gained notoriety when it was used to breach retail giant Target and was of particular interest to security experts because it couldn’t be detected by existing antivirus programs. The tool hasn’t disappeared, however, and government agencies are now urging retailers to check their cash register systems. As of Friday, Homeland Security announced that more than 1,000 American businesses had been compromised.

Backoff, Hacker!

According to a recent New York Times blog post, the Backoff hacker process begins with hackers scanning corporate systems for remote access points, such as those used by third-party vendors or workers who telecommute. Once an access point is identified, a high-speed computer is used to run through millions of password and login combinations until access is granted. Next, hackers work their way through corporate networks to POS systems, where they install Backoff and start shunting credit card data to remote servers.

The worst part? Unless retail companies go looking for this tool, there is no indication that anything is amiss. This means customers could have their credit card information posted for sale on the black market without having any idea they are at risk. In Target’s case, hackers set up shop for weeks before someone caught wind of what was going on. While other companies such as UPS and SuperValu have come forward to say they’ve also been infected, many potential victims are staying quiet.

Solving the Problem

How do companies cope when technology turns against them? POS machines are just one example. As noted by a recent eWEEK article, it is now possible to reprogram USB devices to act as other peripherals. This means, for example, that a USB storage drive could be re-engineered to act like a keyboard and gain administrative-level access privileges once attached. Just like the Backoff tool, finding evidence of device tampering is difficult.

So beyond just scanning for this malware, what can retailers do to protect their POS networks? Avivah Litan of Gartner Research makes the case for improved card technology.

“The weakness is the magnetic stripe,” she said. “I can buy a mag stripe reader on eBay and easily read all the data from your credit card.”

The simplest option to secure card data is using a chip-based system, but despite an October 2015 deadline, most companies will likely miss the mark due to the large cost ($500 to $1,000 per terminal) needed to upgrade. Beyond locking down cards, however, the Secret Service has other recommendations. Retailers should segregate cash registers from corporate networks, require two-factor authentication for all users accessing the payment system and lock out users after a predetermined number of unsuccessful attempts.

Critical Disclosure

However, there’s more to this story than meets the eye. According to the IBM X-Force Threat Intelligence Quarterly, there has been a sharp decline in vulnerability disclosures through 2014. In 2013, 1,602 vendors reported vulnerabilities; in 2014, the threat number was cut almost in half to 926. And while the number of disclosures by large enterprise software vendors remained consistent, the trend is worth noting. Are there are really fewer vulnerabilities, or are companies simply choosing to not report them?

Part of the problem may be the seeming inevitability of attacks. The X-Force report examined the timeline of one-day attacks such as Heartbleed and found that less than a day after the April 7 CVE-2014-0160 security advisory was issued, a proof-of-concept began to circulate. Organizations such as the Canadian Revenue Agency and security firm Mandiant were breached on April 8, and while companies such as Mumsnet patched their systems by April 9, it was already too late. Essentially, it comes down to a race. Do hackers or security professionals get to the finish line first?

Bleeding Hearts

The Heartbleed debacle showcases how one-day exploits can be just as damaging — if not more so — than their zero-day counterparts. Hackers wasted no time bleeding as many hearts as possible; while a patch for Heartbleed was developed within days of its release, the peak number of attacks occurred on April 15. More than 300,000 attacks took place in one day, which comes out to an average of 3.47 attacks per second.

The bottom line? The Backoff hacker malware continues to be a problem for retailers, long after the initial exploit was discovered. Countering this and similar threats means keeping up with breach intelligence, implementing effective detection tools and creating a clear, process-driven disclosure plan.

More from

New Attack Targets Online Customer Service Channels

An unknown attacker group is targeting customer service agents at gambling and gaming companies with a new malware effort. Known as IceBreaker, the code is capable of stealing passwords and cookies, exfiltrating files, taking screenshots and running custom VBS scripts. While these are fairly standard functions, what sets IceBreaker apart is its infection vector. Malicious actors are leveraging the helpful nature of customer service agents to deliver their payload and drive the infection process. Here’s a look at how IceBreaker…

Operational Technology: The evolving threats that might shift regulatory policy

Listen to this podcast on Apple Podcasts, Spotify or wherever you find your favorite audio content. Attacks on Operational Technology (OT) and Industrial Control Systems (ICS) grabbed the headlines more often in 2022 — a direct result of Russia’s invasion of Ukraine sparking a growing willingness on behalf of criminals to target the ICS of critical infrastructure. Conversations about what could happen if these kinds of systems were compromised were once relegated to “what ifs” and disaster movie scripts. But those days are…

Cybersecurity 101: What is Attack Surface Management?

There were over 4,100 publicly disclosed data breaches in 2022, exposing about 22 billion records. Criminals can use stolen data for identity theft, financial fraud or to launch ransomware attacks. While these threats loom large on the horizon, attack surface management (ASM) seeks to combat them. ASM is a cybersecurity approach that continuously monitors an organization’s IT infrastructure to identify and remediate potential points of attack. Here’s how it can give your organization an edge. Understanding Attack Surface Management Here…

Six Ways to Secure Your Organization on a Smaller Budget

My LinkedIn feed has been filled with connections announcing they have been laid off and are looking for work. While it seems that no industry has been spared from uncertainty, my feed suggests tech has been hit the hardest. Headlines confirm my anecdotal experience. Many companies must now protect their systems from more sophisticated threats with fewer resources — both human and technical. Cobalt’s 2022 The State of Pentesting Report found that 90% of short-staffed teams are struggling to monitor…