December 3, 2014 By Shane Schick 2 min read

Shoppers have undoubtedly had enough security scares after data breaches at Target and other retailers, but experts now say point-of-sale (POS) malware is becoming a hot commodity among cybercriminals.

A blog post from security firm CBTS reported that the POS malware, dubbed LusyPOS, is large in size and can potentially track credit card information and steal data from consumers as they attempt to make purchases. This is similar in nature to what happened at Target earlier this year, when personal data from thousands of customers was compromised.

According to PCWorld, LusyPOS can be purchased for as little as $2,000 and is available on black market websites that trade in credit card data and VirusTotal, a security research portal. The story suggested that whoever created the malware may have been studying Chewbacca and Dexter, which are similar forms of malicious software that have taken aim at POS terminals.

Of course, most retailers use some form of encryption to protect their customers, but these forms of POS malware use a small window of opportunity when the data is stored in a terminal’s random access memory. That lets cybercriminals scrape credit card numbers and other details, such as what happened in the Home Depot breach, which affected an estimated 56 million customers. An article on Tom’s Guide said LusyPOS is even more difficult to detect because it leverages Tor, a series of tunnels intended to make its users anonymous, when it communicates with a remote server.

Experts suggested to Help Net Security that this is a good example of how industry standards can help. For instance, retailers were asked several years ago to implement the payment card information (PCI) standards to avoid certain areas of risk. PCI audits could identify some of the potential holes (such as fishy-looking domain names or the use of Tor to connect to command-and-control systems) to avoid the worst.

Unfortunately, these threats are continuing to evolve and become more sophisticated as the holiday season gains steam. Dark Reading recently published an in-depth look at FrameworkPOS, DarkPOS and other forms of targeted attacks that could bedevil researchers. Just a few days ago, VPN Creative profiled another new entrant, GetMyPass, that could be very difficult for traditional antivirus software to detect. SC Magazine, meanwhile, reported on POS malware that is still in the beta testing phase.

The bottom line for retailers is that staying on top of cybercriminals may soon become as much of a priority as tracking their sales. As for consumers, the phrase “buyer, beware” has never seemed more appropriate.

More from

DOD establishes Office of the Assistant Secretary of Defense for Cyber Policy

2 min read - The federal government recently took a new step toward prioritizing cybersecurity and demonstrating its commitment to reducing risk. On March 20, 2024, the Pentagon formally established the new Office of the Assistant Secretary of Defense for Cyber Policy to supervise cyber policy for the Department of Defense. The next day, President Joe Biden announced Michael Sulmeyer as his nominee for the role.“In standing up this office, the Department is giving cyber the focus and attention that Congress intended,” said Acting…

Unpacking the NIST cybersecurity framework 2.0

4 min read - The NIST cybersecurity framework (CSF) helps organizations improve risk management using common language that focuses on business drivers to enhance cybersecurity.NIST CSF 1.0 was released in February 2014, and version 1.1 in April 2018. In February 2024, NIST released its newest CSF iteration: 2.0. The journey to CSF 2.0 began with a request for information (RFI) in February 2022. Over the next two years, NIST engaged the cybersecurity community through analysis, workshops, comments and draft revision to refine existing standards…

What should Security Operations teams take away from the IBM X-Force 2024 Threat Intelligence Index?

3 min read - The IBM X-Force 2024 Threat Intelligence Index has been released. The headlines are in and among them are the fact that a global identity crisis is emerging. X-Force noted a 71% increase year-to-year in attacks using valid credentials.In this blog post, I’ll explore three cybersecurity recommendations from the Threat Intelligence Index, and define a checklist your Security Operations Center (SOC) should consider as you help your organization manage identity risk.The report identified six action items:Remove identity silosReduce the risk of…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today