Analyst Calls Russian Teen Author of Target Malware 107
Nerval's Lobster writes "A digital-activity data analytics firm called IntelCrawler, Inc. claims to have identified the author of the BlackPOS malware used in attacks against Target and Neiman Marcus, and spotted similar attacks that are still in progress against six other retailers. Andrey Komarov, CEO of the Los Angeles-based IntelCrawler, told Reuters Jan. 17 that his company had spotted the six ongoing attacks while analyzing Web traffic in search of the specific entry points and origin of the malware infection behind the Target data breach, which allowed hackers to steak magnetic card-strip data on 40 million debit- and credit cards and demographic data on 70 million additional customers. According to Komarov, BlackPOS was developed by a 17-year-old Russian who goes by the username Ree4 and lives in St. Petersburg. Ree4 probably did not participate in the attack on Target, but did sell the malware to the actual attackers, according to Komarov, who refused to identify the source of his information other than to say he had been monitoring forums on which he said Ree4 sells malware. In a series of chat clips Komarov said are exchanges between buyer and seller, Ree4 tells a potential customer that the price for the software is US$2,000 and that the malware grabs credit-card numbers from system memory as they're scanned, dumps them into a file called time.txt that is sent back to the controller. Ree4 also said the app works only on standalone point-of-sale terminals with a separate monitor that also runs Windows, but not on Verifone systems, which can be attached to PCs but secure credit-card data before it can be scraped by BlackPOS."
IN 17 years? (Score:5, Informative)
How in the world does a 17 year old get intimate detailed knowledge of the internal workings of POS systems??
Was I the only child who grew up in a home devoid of POS terminals to tinker with or something?
Re:IN 17 years? (Score:4, Informative)
What makes you think he has " intimate detailed knowledge of the internal workings of POS systems"? Sorry, that was a trick question. He doesn't care how POS systems work, or how sophisticated they may be. He only cares what credit card mag stripe data looks like. His malware scrapes the RAM of the process looking for the tell-tale patterns of mag stripe data, and grabs it. See http://www.us-cert.gov/ncas/alerts/TA14-002A [us-cert.gov] , which says "There are several types of POS malware in use, many of which use a memory scraping technique to locate specific card data. Dexter, for example, parses memory dumps of specific POS software related processes looking for Track 1 and Track 2 data. "
The track data just has to be in the RAM of the process, and this software finds it and logs it.