The numbers don’t look good: Despite being discovered, named and at least partially remediated late last year, the Backoff malware continues to infect point-of-sale (POS) systems across the country.

According to a report from Help Net Security on a new study from security firm Damballa, there was a 57 percent increase in Backoff infections from August to September 2014 and a 27 percent increase through the month of September. This works out to an average of 37 infected devices a day and doesn’t bode well for retail companies trying to avoid the POS malware scourge. Is there any way to stay protected?

Backoff Malware Worse Than It Looks

Since Dambella’s data only comes from systems where POS traffic is monitored, it gets worse: Companies that choose not to monitor their POS networks — many of which are stand-alone and include easy access for patches and updates — are at even greater risk. How big is this risk? In the latest quarter, close to 1,000 businesses were victimized by the Backoff malware, and high-profile corporations such as Home Depot, Kmart, Jimmy John’s, Goodwill and P. F. Chang’s have also come under attack. In short, any business that uses POS devices is a target.

So why has this malware problem reemerged after it was supposedly solved after the Target breach? Simply put, companies continue to rely on security controls that don’t detect this kind of malware — and won’t catch new versions that have been slightly modified from the original. It’s comparable to an oft-quoted definition of madness: doing the same thing over and over again expecting different results.

An Ounce of Prevention

Brian Foster, chief technology officer of Damballa, said data collected by his company “show that prevention controls cannot stop malware infections,” according to PC Magazine. However, this continues to be the most popular response to Backoff: build higher walls and put more pressure on security teams to find POS malware infections.

Instead, Foster and other experts recommend developing better security intelligence. It starts with businesses acting as if they are always under threat or in a state of continuous breach. Rather than ramping up IT security when news of another Backoff, Shellshock or Heartbleed hits the news — by which time systems are already infected — companies should assume a breach has happened and evaluate their systems accordingly.

The result is a proactive approach to finding and eliminating threats. Additionally, retail businesses need a better way to identify “true positives,” or security events on their systems that are genuine attacks. With a combination of automatic detection using evidence correlation, positive event confirmation and “risk ranking,” Damballa found companies reduced their number of daily infections by up to 40 percent.

Beyond intelligent security countermeasures, however, it is also time to take a hard look at the POS device ecosystem. Many of these devices come from third-party vendors, none of which are security companies or design their devices to withstand malware-based attacks. Instead, they are created to provide maximum functionality at a reasonable price and are often given unfettered access to corporate networks because they don’t act like “typical” computers. Pushing back against Backoff and other malware means getting POS traffic off the perimeter and into the secure heart of company networks, where it can be monitored for suspicious activity.

Backoff isn’t backing off, and it won’t so long as companies keep trying to build bigger walls around their POS systems. When this malware can go under, around or right through traditional security architecture, building walls is a waste. Opt for a moat instead, then monitor what sinks and swims.

More from

$10.3 Billion in Cyber Crime Losses Shatters Previous Totals

4 min read - The introduction of the most recent FBI Internet Crime Report says, “At the FBI, we know ‘cyber risk is business risk’ and ‘cybersecurity is national security.’” And the numbers in the report back up this statement. The FBI report details more than 800,000 cyber crime-related complaints filed in 2022. Meanwhile, total losses were over $10 billion, shattering 2021's total of $6.9 billion, according to the bureau’s Internet Crime Complaint Center (IC3).  Top Five Cyber Crime TypesIn the past five years, the…

4 min read

How to Boost Cybersecurity Through Better Communication

4 min read - Security would be easy without users. That statement is as absurd as it is true. It’s also true that business wouldn’t be possible without users. It’s time to look at the big picture when it comes to cybersecurity. In addition to dealing with every new risk, vulnerability and attack vector that comes along, cybersecurity pros need to understand their own fellow employees - how they think, how they learn and what they really want. The human element — the individual and social factors that…

4 min read

Detecting Insider Threats: Leverage User Behavior Analytics

3 min read - Employees often play an unwitting role in many security incidents, from accidental data breaches to intentional malicious attacks. Unfortunately, most organizations don’t have the right protocols and processes to identify potential risks posed by their workforce. Based on a survey conducted by SANS Institute, 35% of respondents said they lack visibility into insider threats, while 30% said the inability to audit user access is a security blind spot in their organizations. In addition, the 2023 X-Force Threat Intelligence Index reported that…

3 min read

Poor Communication During a Data Breach Can Cost You — Here’s How to Avoid It

5 min read - No one needs to tell you that data breaches are costly. That data has been quantified and the numbers are staggering. In fact, the IBM Security Cost of a Data Breach estimates that the average cost of a data breach in 2022 was $4.35 million, with 83% of organizations experiencing one or more security incidents. But what’s talked about less often (and we think should be talked about more) is how communication — both good and bad — factors into…

5 min read