December 21, 2015 By Douglas Bonderud 2 min read

In late November, Pro POS malware emerged on underground markets just in time for malicious actors to pick up the easy-to-use code and defraud merchants over the busy holiday season. Initial reports put this POS malware in the big leagues, complete with everything from Tor support to rootkit functions, antivirus avoidance and a polymorphic engine.

According to Threatpost, however, researchers have now discovered that this malicious code isn’t all it pretends to be. While it’s effective at skimming credit data, it’s nowhere near professional grade.

Behind the Curtain of POS Malware

After Pro POS began making the rounds, two researchers from security firm Talos — Ben Baker and Earl Carter — got their hands on version 1.1.5b of the new malware and pulled back the curtain on its supposedly sophisticated code. Some of the claims made about Pro POS were true — mostly. For example, the malware does support Tor2Web but doesn’t support Tor itself, and while the sample contained a rootkit, it appears the kit wasn’t even used when the malware deployed.

Other features, such as the scary-sounding polymorphic engine, were nowhere to be found. The researchers did tell Threatpost that Pro POS was packaged to maximize ease of use and access and was “designed in a modular fashion so it’s easily extendable to add new modules, increasing the functionality of the malware.”

Despite the seeming simplicity of this POS malware, Infosecurity Magazine noted that it poses a real risk for companies that haven’t made the switch to chip-and-PIN cards since this modified form of the Alina malware is designed to both lift card details and determine if the information can be used overseas.

Retailers that haven’t yet invested in the infrastructure necessary to process chip-and-PIN technology could find themselves on the hook for thousands in fraudulent transactions, especially as brick-and-mortar stores swamped with card-carrying shoppers look for ways to maximize efficiency and minimize wait times — the perfect environment for this kind of POS fraud.

Sophisticated Siblings

While Pro POS malware doesn’t exactly make the grade when it comes to stealth, security or subtlety, HackRead noted that a few new members of the malware family are poised to make a significant impact in the next few months. First is ghostware, which was designed to infect a device, carry out specific actions and then remove itself without leaving behind any evidence. In a POS environment, this kind of threat is worrisome: Companies could be left with big bills and angry customers but no leads on what happened or where data was sent.

Next on the list is two-faced malware, which is designed to fool sandbox processes by masquerading as an innocent program when under scrutiny and then carry out its true purpose once the heat is off. Much like Pro POS, these efforts aren’t terribly sophisticated — yet — but expect efforts to ramp up as defenders get better at detecting malicious behavior in virtual environments.

Bottom line? Pro POS doesn’t match the description on the box. For malware-makers and buyers, however, this isn’t a bad thing: Companies that are afraid of big, bad code crashing their systems often make mistakes, opening the door for the less sophisticated, underlying version of this POS malware. But malicious code won’t stay minimally complex for long; the exaggeration and hyperbole of today quickly becomes the new normal.

More from

How will the Merck settlement affect the insurance industry?

3 min read - A major shift in how cyber insurance works started with an attack on the pharmaceutical giant Merck. Or did it start somewhere else?In June 2017, the NotPetya incident hit some 40,000 Merck computers, destroying data and forcing a months-long recovery process. The attack affected thousands of multinational companies, including Mondelēz and Maersk. In total, the malware caused roughly $10 billion in damage.NotPetya malware exploited two Windows vulnerabilities: EternalBlue, a digital skeleton key leaked from the NSA, and Mimikatz, an exploit…

3 Strategies to overcome data security challenges in 2024

3 min read - There are over 17 billion internet-connected devices in the world — and experts expect that number will surge to almost 30 billion by 2030.This rapidly growing digital ecosystem makes it increasingly challenging to protect people’s privacy. Attackers only need to be right once to seize databases of personally identifiable information (PII), including payment card information, addresses, phone numbers and Social Security numbers.In addition to the ever-present cybersecurity threats, data security teams must consider the growing list of data compliance laws…

ICS CERT predictions for 2024: What you need to know

4 min read - As we work through the first quarter of 2024, various sectors are continuously adapting to increasingly complex cybersecurity threats. Sectors like healthcare, finance, energy and transportation are all regularly widening their digital infrastructure, resulting in larger attack surfaces and greater risk exposure.Kaspersky just released their ICS CERT Predictions for this year, outlining the key cybersecurity challenges industrial enterprises will face in the year ahead. The forecasts emphasize the persistent nature of ransomware threats, the increasing prevalence of cosmopolitical hacktivism, insights…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today