Pierluigi Paganini
January 17, 2014
The massive data breach at Target during the 2013 holiday shopping season which the retailer now admits affected 70 million customers used an inexpensive “off the shelf” malware known as BlackPOS. The same malware may have also been involved in the Neiman Marcus attack.
Security researchers from IntelCrawler, a Los-Angeles based cyber intelligence company, announced that the age of BlackPOS malware author is close to 17 years old and the first sample of it was created in March 2013. The first report on this malware was done in the beginning of spring by Andrew Komarov, IntelCrawler CEO, when he was working in another forensics company.
According to own sources of IntelCrawler the first infected Point-of-Sales environments by BlackPOS were in Australia, Canada and the US. The first name of the malware was “DUMP MEMORY GRABBER by Ree[4]”, but the title for C&C had string “BlackPOS”. During that time, “Ree[4]” (“ree4”) has sold more then 40 builds of BlackPOS to cybercriminals from Eastern Europe and other countries.
The same dates the detailed information and reverse engineering report were shared with Visa and several major US banks, after which US LEA released internal notification for financial industry about that. The bad actor was pretty opened for trading this malware for 2 000 USD or by receiving 50% from selling of all intercepted credit cards by his customer through Liberty Reserve.
[email protected]: http://ree4.7ci.ru/dump_grabber.php [email protected]: it is administrative panel [email protected]: password "pass" [email protected]: http://www.sendspace.com/file/zglgvy [email protected]: after infection you will receive "readme.txt", like "ping"
The first C&C server of BlackPOS was installed on “ree4.7ci.ru”, which was the personal host of its author with nickname “ree[4]”. Some other hosts were found on this domain name, as probably it was used as a hosting for all members of the same group: – onlyddos.7ci.ru; – merzavetz.7ci.ru; – reperckov41.7ci.ru. 
[email protected]: http://plasmon[.]rghost[.]ru/44699041/image.png hidden: how does it keep the data ( intercepted credit cards)? [email protected]: from left side it is files, time.txt, then you click on it and you will find dumps in browser in plaintext hidden: are there any differences in terms of infected Point-of-Sale systems? [email protected]: no, but there are some nuances, for examples it doesn't work on Verifone hidden: really? I have Verifones ... [email protected]: it grabs dumps from memory, Verifone can be connected to PC, but it will be "secured", you need standalone Point-of-Sale terminals with monitor and Windows hidden: how much? [email protected]: 2000 USD [email protected]: 1st build
Previously he has created several tools used in hacking community for brute force attacks, such as “Ree4 mail brute”, and also earned some first money with social networks accounts hacking and DDoS attacks trainings, as well as software development including malicious code.
Investigators from IntelCrawler have also made a profiling on bad actor: E-mail 1: [email protected] E-mail 2: [email protected] ICQ: 565033 Skype: s.r.a.ree4
According to operative information from IntelCrawler, the experts have already identified the person behind the nickname “ree[4]”, he is based in St.Petersburg and Nizhniy Novgorod (Russian Federation) and he is a very well-known programmer of malicious code in underground. I prefer to keep reserved the name of the hacker to not obstacle the investigation, but if you want to know it contact directly IntelCrawler.
“He is still visible for us, but the real bad actors responsible for the past attacks on retailers such as Target and Neiman Marcus were just his customers”, comments Dan Clements, IntelCrawler President.
Before both breaches IntelCrawler detected large-scale RDP brute-forcing attacks on Point-of-Sales terminals across the US, Australia and Canada started at the beginning of 2013 year in winter period with weak passwords such as:
"pos":"pos"; "micros":"micros" (MICROS Systems, Inc. - Point-of-Sale Hardware); "edc":"123456" (EDC - Electronic Draft Capture).
February 9th, 2013, 14:30
URL:http://www.rf-cheats.ru/forum/archive/index.php/t-156884.html
IP Address: 71.138.234.81 Location: UNITED STATES, CALIFORNIA, LOS ANGELES Latitude & Longitude: 34.052230, -118.243680 Connection: 26 INTERNATIONAL INC Net Speed: (COMP) Company/T1 IDD & Area Code: 213/310/424/323 ZIP Code: 90001 Weather Station: LOS ANGELES (USCA0638)
IP Address: 75.127.54.179 Location: UNITED STATES, CALIFORNIA, LOS ANGELES Latitude & Longitude: 34.002300, -118.211520 Connection: DESIGN COLLECTION Net Speed: (COMP) Company/T1 IDD & Area Code: 213/323 ZIP Code: 90058 Weather Station: LOS ANGELES (USCA0638) Usage Type: (COM) Commercial
February 21th, 2013, 13:36
IP Address: 63.138.49.238 Location: UNITED STATES, NEW YORK, FAIRPORT Latitude & Longitude: 43.088572, -77.432766 Connection: PAETEC COMMUNICATIONS INC. Domain: PAETEC.COM Net Speed: (DSL) Broadband/Cable IDD & Area Code: 585 ZIP Code: 14450 Weather Station: FAIRPORT (USNY0477)
May 21th, 2013, 18-26 URL: http://d3scene.ru/besplatnye-razdachi-i-pooschreniya/49081-razdacha-dedikov.html
IP Address: 168.215.163.98 Location:UNITED STATES, COLORADO, LONE TREE Latitude & Longitude: 39.546295, -104.896772 Connection: TW TELECOM HOLDINGS INC. Domain: TWTELECOM.NET Net Speed: (COMP) Company/T1 IDD & Area Code: 303 ZIP Code: 80124 Weather Station: PARKER (USCO0306)
According to New York Times Neiman Marcus acknowledged that the time stamp on the first intrusion was in mid-July, which may have good correlation with found compromised Point-of-Sales.
July 19th, 2013
URL: http://freegaming.ucoz.net/news/razdacha_dedikov/2013-07-19-3
“EDC” – Electronic Draft Capture, also known as “EDC” or “Point Of Sale” (POS) allows you to capture and authorize a credit card.
IP Address: 64.119.39.123 Location: UNITED STATES, ARIZONA, TUCSON Latitude & Longitude: 32.044150, -110.734770 Connection: PRIVATE CUSTOMER Net Speed: (COMP) Company/T1 IDD & Area Code: 520 ZIP Code: 85747 Weather Station: TUCSON (USAZ0247)
September 22nd, 2013, 15:52 URL: http://ccc.gs/topic/2405-razdacha-dedikov/
IP Address: 38.82.206.34 Location: UNITED STATES, CALIFORNIA, VALENCIA Latitude & Longitude: 34.406069, -118.535302 Connection: TCAST COMMUNICATIONS INC Domain: COGENTCO.COM Net Speed (DSL): Broadband/Cable IDD & Area Code: 661 ZIP Code: 91355 Weather Station: STEVENSON RANCH (USCA1095)
“Most of the victims are department stores. More BlackPOS infections, as well as new breaches can appear very soon, retailers and security community should be prepared for them”, commented Andrew Komarov, IntelCrawler CEO.
About IntelCrawler
IntelCrawler.com is a multi-tier intelligence aggregator, which gathers information and cyber prints from a starting big data pool of over 3, 000, 000, 000 IPv4 and over 200, 000, 000 domain names, which are scanned for analytics and dissemination to drill down to a desired result. This finite pool of cyber prints is then narrowed further by comparing it to various databases and forum intelligence gathered from the underground and networked security company contacts. The final result could be the location of a particular keyboard or a computer housing the threat.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – malware, PoS)
[adrotate banner=”5″]
[adrotate banner=”13″]
