October 30, 2014 By Douglas Bonderud 2 min read

The numbers don’t look good: Despite being discovered, named and at least partially remediated late last year, the Backoff malware continues to infect point-of-sale (POS) systems across the country.

According to a report from Help Net Security on a new study from security firm Damballa, there was a 57 percent increase in Backoff infections from August to September 2014 and a 27 percent increase through the month of September. This works out to an average of 37 infected devices a day and doesn’t bode well for retail companies trying to avoid the POS malware scourge. Is there any way to stay protected?

Backoff Malware Worse Than It Looks

Since Dambella’s data only comes from systems where POS traffic is monitored, it gets worse: Companies that choose not to monitor their POS networks — many of which are stand-alone and include easy access for patches and updates — are at even greater risk. How big is this risk? In the latest quarter, close to 1,000 businesses were victimized by the Backoff malware, and high-profile corporations such as Home Depot, Kmart, Jimmy John’s, Goodwill and P. F. Chang’s have also come under attack. In short, any business that uses POS devices is a target.

So why has this malware problem reemerged after it was supposedly solved after the Target breach? Simply put, companies continue to rely on security controls that don’t detect this kind of malware — and won’t catch new versions that have been slightly modified from the original. It’s comparable to an oft-quoted definition of madness: doing the same thing over and over again expecting different results.

An Ounce of Prevention

Brian Foster, chief technology officer of Damballa, said data collected by his company “show that prevention controls cannot stop malware infections,” according to PC Magazine. However, this continues to be the most popular response to Backoff: build higher walls and put more pressure on security teams to find POS malware infections.

Instead, Foster and other experts recommend developing better security intelligence. It starts with businesses acting as if they are always under threat or in a state of continuous breach. Rather than ramping up IT security when news of another Backoff, Shellshock or Heartbleed hits the news — by which time systems are already infected — companies should assume a breach has happened and evaluate their systems accordingly.

The result is a proactive approach to finding and eliminating threats. Additionally, retail businesses need a better way to identify “true positives,” or security events on their systems that are genuine attacks. With a combination of automatic detection using evidence correlation, positive event confirmation and “risk ranking,” Damballa found companies reduced their number of daily infections by up to 40 percent.

Beyond intelligent security countermeasures, however, it is also time to take a hard look at the POS device ecosystem. Many of these devices come from third-party vendors, none of which are security companies or design their devices to withstand malware-based attacks. Instead, they are created to provide maximum functionality at a reasonable price and are often given unfettered access to corporate networks because they don’t act like “typical” computers. Pushing back against Backoff and other malware means getting POS traffic off the perimeter and into the secure heart of company networks, where it can be monitored for suspicious activity.

Backoff isn’t backing off, and it won’t so long as companies keep trying to build bigger walls around their POS systems. When this malware can go under, around or right through traditional security architecture, building walls is a waste. Opt for a moat instead, then monitor what sinks and swims.

More from

Change Healthcare discloses $22M ransomware payment

3 min read - UnitedHealth Group CEO Andrew Witty found himself answering questions in front of Congress on May 1 regarding the Change Healthcare ransomware attack that occurred in February. During the hearing, he admitted that his organization paid the attacker's ransomware request. It has been reported that the hacker organization BlackCat, also known as ALPHV, received a payment of $22 million via Bitcoin.Even though they made the ransomware payment, Witty shared that Change Healthcare did not get its data back. This is a…

Phishing kit trends and the top 10 spoofed brands of 2023

4 min read -  The 2024 IBM X-Force Threat Intelligence Index reported that phishing was one of the top initial access vectors observed last year, accounting for 30% of incidents. To carry out their phishing campaigns, attackers often use phishing kits: a collection of tools, resources and scripts that are designed and assembled to ease deployment. Each phishing kit deployment corresponds to a single phishing attack, and a kit could be redeployed many times during a phishing campaign. IBM X-Force has analyzed thousands of…

How I got started: AI security researcher

4 min read - For the enterprise, there’s no escape from deploying AI in some form. Careers focused on AI are proliferating, but one you may not be familiar with is AI security researcher. These AI specialists are cybersecurity professionals who focus on the unique vulnerabilities and threats that arise from the use of AI and machine learning (ML) systems. Their responsibilities vary, but key roles include identifying and analyzing potential security flaws in AI models and developing and testing methods malicious actors could…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today