Pierluigi Paganini
February 01, 2014
The recent data breaches at US retailers Target, Neiman Marcus and Michaels have raised the alert level of malware-based attacks against POS systems. More than one hundred million Americans is victims of scams that mainly used a malware known as BlackPOS or its variant, to infect POS system and capture data transaction during users’ purchases.
The author of BlackPOS was rapidly identified, but the malicious agent is very popular in the underground communities, the malicious code also represents a stimulus for other malware developers to design applications that offer similar functionality, including the capability to steal tracks from debit/credit cards used by victims.
a Tor-based banking trojan which
appeared very attractive for cybercriminals that search for a financial malware. Recently security researchers at RSA have detected a new variant of ChewBacca, which implements also a stealing credit card capability, a feature that makes it attractive for attacks against POS systems. The trend to use Tor networks is becoming very effective, bootmaster can hide their control infrastructures, making hard their eradication to law enforcement and security firms. In time I’m writing it is still unknown how the ChewBacca infection is propagated.
“ChewBacca features two distinct data-stealing mechanisms: a generic keylogger and a memory scanner designed to specifically target systems that process credit cards, such as Point-of-Sale (POS) systems. The memory scanner dumps a copy of a process’s memory and searches it using simple regular expressions for card magnetic stripe data. If a card number is found, it is extracted and logged by the server.” reports RSA in the blog post.
Chewbacca code was compiled with Free Pascal 2.7.1., once executed windows based system, it drops as spoolsv.exe in the startup folder and also drops a copy of Tor 0.2.3.25.
“After execution, the function “P$CHEWBACCA$_$TMYAPPLICATION_$__$$_INSTALL” is called, which drops itself as “spoolsv.exe” into the “Startup folder” (e.g. C:\Documents and Settings\All Users\Start Menu\Programs\Startup\) and requests the public IP of the victim via a publicly accessible service at http://ekiga.net/ip (which is not related to the malware). Tor is dropped as “tor.exe” to the user-s Temp and runs with a default listing on “localhost:9050″.”
The Chewbacca Trojan logs all keystrokes by the user to “system.log” under the user’s local Temp folder and then sends the data back to the botnet controllers via Tor anonymity network. Chewbacca also enumerates all running processes and reads their process memory, another characteristic is that the C&C server is a LAMP platform (Linux, Apache, MySQL and PHP).
“Retailers have a few choices against these attackers. They can increase staffing levels and develop leading-edge capabilities to detect and stop attackers (comprehensive monitoring and incident response), or they can encrypt or tokenize data at the point of capture and ensure that it is not in plaintext view on their networks, thereby shifting the risk and burden of protection to the card issuers and their payment processors.” states RSA.
(Security Affairs – Tor-based malware, ChewBacca)
