In late November, Pro POS malware emerged on underground markets just in time for malicious actors to pick up the easy-to-use code and defraud merchants over the busy holiday season. Initial reports put this POS malware in the big leagues, complete with everything from Tor support to rootkit functions, antivirus avoidance and a polymorphic engine.
According to Threatpost, however, researchers have now discovered that this malicious code isn’t all it pretends to be. While it’s effective at skimming credit data, it’s nowhere near professional grade.
Behind the Curtain of POS Malware
After Pro POS began making the rounds, two researchers from security firm Talos — Ben Baker and Earl Carter — got their hands on version 1.1.5b of the new malware and pulled back the curtain on its supposedly sophisticated code. Some of the claims made about Pro POS were true — mostly. For example, the malware does support Tor2Web but doesn’t support Tor itself, and while the sample contained a rootkit, it appears the kit wasn’t even used when the malware deployed.
Other features, such as the scary-sounding polymorphic engine, were nowhere to be found. The researchers did tell Threatpost that Pro POS was packaged to maximize ease of use and access and was “designed in a modular fashion so it’s easily extendable to add new modules, increasing the functionality of the malware.”
Despite the seeming simplicity of this POS malware, Infosecurity Magazine noted that it poses a real risk for companies that haven’t made the switch to chip-and-PIN cards since this modified form of the Alina malware is designed to both lift card details and determine if the information can be used overseas.
Retailers that haven’t yet invested in the infrastructure necessary to process chip-and-PIN technology could find themselves on the hook for thousands in fraudulent transactions, especially as brick-and-mortar stores swamped with card-carrying shoppers look for ways to maximize efficiency and minimize wait times — the perfect environment for this kind of POS fraud.
Sophisticated Siblings
While Pro POS malware doesn’t exactly make the grade when it comes to stealth, security or subtlety, HackRead noted that a few new members of the malware family are poised to make a significant impact in the next few months. First is ghostware, which was designed to infect a device, carry out specific actions and then remove itself without leaving behind any evidence. In a POS environment, this kind of threat is worrisome: Companies could be left with big bills and angry customers but no leads on what happened or where data was sent.
Next on the list is two-faced malware, which is designed to fool sandbox processes by masquerading as an innocent program when under scrutiny and then carry out its true purpose once the heat is off. Much like Pro POS, these efforts aren’t terribly sophisticated — yet — but expect efforts to ramp up as defenders get better at detecting malicious behavior in virtual environments.
Bottom line? Pro POS doesn’t match the description on the box. For malware-makers and buyers, however, this isn’t a bad thing: Companies that are afraid of big, bad code crashing their systems often make mistakes, opening the door for the less sophisticated, underlying version of this POS malware. But malicious code won’t stay minimally complex for long; the exaggeration and hyperbole of today quickly becomes the new normal.