The Case of the Mistaken Malware

Forensic Files SeriesThe Case of the Mistaken Malware

Business backgroundSmall retailer operates one main store, multiple satellite stores, and two corporate offices.

All sites connected to the same card processing environment.

Business background

During a routine anti-virus log review, in-house IT staff member finds Sirefef rootkit at satellite store.

What is a rootkit?A rootkit is a type of malicious software activated each time a system boots up.

They are difficult to detect because they reside at the system’s kernel level, and are activated before a system’s operating system has completely booted up.

How hackers got inCompromised the credentials for the remote access application, LogMeIn.

Installed Sirefef, a sophisticated rootkit that can spread spam or capture sensitive information such as passwords or credit card data.

Forensic investigator findingsInvestigator finds the Sirefef rootkit did not actually steal customer credit cards.

Further investigation revealed a memory scraper called Alina (installed by the same hacker), designed specifically to capture payment information from POS terminals.

What is a memory scraper?A memory scraper is designed to capture, or ‘scrape’ sensitive information from system memory (RAM) and return it back to the attacker.

The Alina memory scraper can morph into newer versions to avoid detection, or automatically reinstall in different locations if deleted.

What the business did wrong

Retailer didn’t employ two-factor authentication to secure remote access into their main store, satellites, and corporate offices.

What’s 2-factor authentication?

Two factor authentication is an extra layer of security that requires not only a password and username but also something only the user should know/have (e.g., a fingerprint).

Although they regularly reviewed anti-virus logs, IT staff did not regularly update anti-virus program and system security patches.

In addition, the credit card processing environment was not segmented away from routine Internet traffic.

SecurityMetricsWe Protect Business

ServicesPCI, HIPAA, & data security solutions for businesses of all sizes

QualificationsGlobal provider of ASV, QSA, PFI, PA QSA, P2PE services

ExperienceAssisted over 1 million organizations with compliance needs

The Case of the Mistaken Malware

Technology

Malware Armoring: The case against incident related binary ... · Malware Armoring: The case against incident related binary analysis Author Name: Steve Hendrikse Date: February 2011

SPLUNK SECURITY USE CASE DETECTING UNKNOWN … · WHITE PAPER SPLUNK SECURITY USE CASE DETECTING UNKNOWN MALWARE AND RANSOMWARE Detecting unknown malware and ransomware…

Mistaken Identity pt 2

CASE Qf The Kokopenace A Case Mistaken Identity · Mistaken Identity by Julian N. Falconer, This article is offered as an expres sion of concern about the direction of our nation's

A Case Study in Malware Research Ethics Education When ... · A Case Study in Malware Research Ethics Education When teaching bad is good . ... Cyber-security Research Ethics Dialog

Mistaken Love by MzKISSEShere

Instrumenting Point-of-Sale Malware - DEF CON® …...nstrumenting Point-of-Sale Malware: A Case Study in Communicating Malware Analysis More Effectively, Wesley McGrew, DEFCON, DEF

A Case of Mistaken Identity - SE-EPPC · 2009. 1. 23. · Mistaken Identity Native and Exotic “Boston Ferns” and “Sword Ferns” (Nephrolepis spp.) Ken Langeland University

123. Islam a Case of Mistaken Identity

The Mistaken J - yaiy.org

Arab Nationalism: Mistaken Identity

Character-distinguishing features in fictional dialogue: the case … · 2020. 12. 11. · ilarities than Delta does. For instance, joyful Natasha in this case is never mistaken for

Misbehavior or mistaken behavior

A Case of Mistaken YOUTH Decatur Church of Christ Identity … · 2019. 8. 13. · A Case of Mistaken Identity Mark 3: 20-35 February 4, 2018 Decatur Church of Christ LifeGroups is

Mistaken IdentityPART3

Property Directed Test Case Generation · 2016. 11. 1. · Malware Case Study. PDTG useful for malware analysis •Force execution of suspected malicious code - For example, generate

Modeling the Propagation of Trojan Malware in Online ...the malware from their systems, as in the case of a large-scale attack on Facebook caused by a malware named Magnet [9]. All

Malware Armoring: The case against incident related binary analysis

Parasitology (Laboratory) - NEMATODES - Mistaken Stuff

Intezer- leading telco case study - Genetic Malware Analysis · Intezer introduces a Genetic Malware Analysis approach, oﬀering enterprises unparalleled and accelerated incident