Posts

How to Protect Retail POS Systems from Ransomware, Advanced Cyberattacks

/0 Comments/in /by

Of all the IT resources retailers maintain, it’s hard to claim that any system is more important than their point-of-sale (POS) systems.

POS systems bring in revenue, as well as tie into other IT infrastructures, such as finance, customer analytics or inventory within the supply chain.

Retail, as a whole, is the industry most subject to cyberattacks, according to a recent Computer Weekly article. And as my colleague earlier outlined in “Retail POS Fraud: The Rising Challenge,” the POS systems are key attack targets. The credit card data and, in some cases, electronic protected health information (ePHI) retailers (think about your local pharmacy) hold are gold to attackers.

POS systems have evolved over time. Many retailers are now using mobile and tablet-based POS systems, often with cloud-based, back-end systems. Given their lower price points when compared to more traditional POS options, these newer systems help many small- to medium-sized businesses take advantage of the availability and efficiency of POS without requiring heavy hardware or infrastructure investments.

Ransomware Targeted Retail POS Systems

But this means more protected information than ever is traveling between the POS front- and back-end systems. The attack surface for retailers using these systems is broader than ever. POS malware, which is disguised and silently injected on to target systems, has been the cause of a number of publicized retail data breaches over the past year.

Retailers are increasingly targeted by ransomware, which has the effect of stopping retail operations — and revenue generation — in its tracks. In addition to the immediate impact on revenue and profit (payouts to ransomware authors are not cheap and often unsuccessful), a ransomware attack can have a long-term impact on customers’ perception of retailers as safe businesses to shop. That alone can be fatal to small- and medium-sized retailers. A breach can also have PCI compliance implications.

Cerber ransomware delivers this message demanding payment for data.

Like other forms of cyberattacks, ransomware code can be heavily disguised and not detected by many anti-malware products and services.

Using RTDMI to Protect Retail POS Systems

For retailers that have stepped up their game with newer POS systems, more advanced security controls, such as technology that integrates sandbox security and real-time memory inspection, are required.

For example, the SonicWall Capture Advanced Threat Protection (ATP) sandbox service is particularly adept at rooting out malware that might otherwise escape detection. Our patent-pending Real-Time Deep Memory InspectionTM (RTDMI) engine forces malware to reveal itself in in a secure, multi-sandbox environment. Using machine learning, RTDMI can identify malicious code in under 100 nanoseconds.

Through static inspection and dynamic analysis, RTDMI also can uncover malware hidden inside Microsoft Office files and PDFs. SonicWall Capture Labs has verified that the RTDMI engine can stop new forms of malware that attempt to exploit Meltdown and Spectre vulnerabilities.

Our new white paper, “Why Retail Networks Need Real-Time Deep Memory Inspection,” explains how RTDMI works and what it detects. The paper walks through two examples of how RTDMI was able to discover malware before it was able to infect target systems, including the case of Cerber ransomware shown above.

RTDMI is available as part of Capture ATP at no additional cost to SonicWall customers. Retail IT and security professionals, take the time to review the white paper and learn more about how Capture ATP and RTDMI can improve the security of the POS systems and infrastructure you count on.

Get the White Paper: Why Retail Networks Need RTDMITM

Retail is a prime target for new multi-vector malware that is increasingly difficult to detect. SonicWall Real-Time Deep Memory InspectionTM (RTDMI) adds depth of protection against emerging malware, at no additional cost to Capture Advanced Threat Protection (ATP) users. Get this exclusive white paper to explore This white paper examines how RTDMI works and what it detects.

Read the White Paper

Critical Business Threats: Ransomware and Employee Online Shopping

/0 Comments/in /by

According to a recent PWC survey, 54 percent of respondents buy products online every month. And millions of employees shopped online yesterday with their work devices on business networks. The critical business threat: Will any of your business computers or networks get infected with malware when employees make personal online purchases?

We believe so, and our SonicWall Global Response Intelligent Defense (GRID) network research backs this up.

Good News: Chip Cards Are Working

Research gathered through the SonicWall GRID Network indicates that the new chip-and-sign credit cards and point of sale (POS) systems are more effective than legacy technologies in detecting and blocking breaches. After big data breaches at retailers like Target and Home Depot, many retailers upgraded to chip-based POS systems.

Whenever new malware is discovered, we create a software signature set that is automatically propagated to all of our customers’ firewalls, to help keep their systems safe from attack. In 2014, before the new chip cards and POS systems, our team released 14 new POS-related malware signature sets.

In 2015, this number decreased to nine new POS malware signature sets. And in 2016 to-date, after the broad adoption of chip-based cards and readers, we have only had to release a single new signature.

Bad News: SPAM Is Now a Huge Business Threat

As POS systems have become harder to hack, the bad guys are looking for more efficient ways to steal online. Falling back on the tried and true email-based phishing attacks, personal shopping phishing emails are now a real threat to your business systems and networks.

Our email security research team observes that SPAM email usually increases in volume significantly during Cyber Week, starting the week before Black Friday, then drops off after Cyber Monday. Our numbers show a dramatic 2x increase in SPAM this year from 2015. In the run-up to Thanksgiving and Black Friday we saw 110 percent growth, increasing to 143 percent growth through Cyber Monday.

One of our SPAM honeypots collected the following data for Cyber Week:

  • Average number of SPAM messages 2015: 33,725 a day
  • Average number of SPAM messages 2016: 82,888 a day

More Bad News: Ransomware Targets Businesses

Increasingly we are finding that if malware makes it into your business network, it will be ransomware. First released in 1989, ransomware can infect your system and lock out users from accessing devices or files. When the victim pays a ransom (usually electronic money or bitcoins) the device can be unlocked by the hackers. Needless to say, ransomware can put your business-critical data and systems at risk.

Network Security Must-Haves

Online shopping will only continue to grow, especially over holidays, so it’s important to be proactive to keep your business systems protected. Along with monitoring employee access and updating policies, here are some must-haves.

  • Ensure your firewall is next-generation with content filtering on, including encryption scanning and packet filters; your goal is to monitor and inspect all incoming data and stop ransomware
  • Consider a cloud-based protection service like our Capture Advanced Threat Protection Service; a good one will speed up your response time, leverage the power of multiple engines to stop zero-day attacks, and automate remediation
  • Manage network bandwidth to limit or stop streaming; streaming is one of the easiest ways to let malware in
  • We strongly recommend EV SSL certificates for every external business website
  • Vet your SSL certificates and sources, to ensure they are publicly rooted and aren’t bringing in malware from the dark web
  • Audit your SSL certificates regularly to ensure they are up to date
  • It goes without saying but back up your data regularly; if ransomware does infect your network you will need to quickly access business-critical data

Online Shopping Safety for Consumers

  • If you don’t have one yet, upgrade to a chip-based credit card
  • Always look for an EV SSL certified logo on sites you shop
  • Use mobile devices (tablets or phones) and shop with store apps from businesses you know and trust; these apps are vetted and tested
  • Avoid shopping on sites with a Windows-based laptop; Windows is the most targeted operating system (OS) for hackers
  • Remain on the site until you complete a transaction; don’t follow redirects
  • Stay current with the latest OS software updates on your devices so you have the latest security patches; always update from the trusted site of the software provider, not a third-party site or a pop up
  • Update your apps regularly, especially ones that you provide sensitive data to: credit card numbers, banking and health information
  • Create complex, hard-to-crack passwords and keep them in a secure place
  • Change your passwords often and keep them hidden ­– not on sticky notes on your computer

Ten Tips for Protecting POS Systems from Memory Scraping Malware

/0 Comments/in /by

In the recently published 2015 SonicWall Security Threat Report, one of the observations on the evolution of attacks on POS systems is the rise in popularity of malware that uses memory scraping to steal sensitive data. No matter how many layers of encryption are applied to sensitive payment data and how carefully this encryption is deployed, at some point the primary account number and other sensitive information must exist in an unencrypted form in order to be useful. The moment that payment data is decrypted for processing, it ends up in the memory of the POS machine, creating a perfect window of opportunity for an attacker to snag this data. Advanced malware can use multiple techniques to access and scan contents of this temporary storage and look for patterns that resemble raw payment data. This data can then be used, for example, to clone cards for fraudulent purchases. This is exactly what happened in some of the high profile retail breaches of 2013 and 2014.

The ultimate goal of RAM scraping malware is exfiltration of the unencrypted data stolen from memory of the infected machine. Therefore, this malware will be very well hidden and it will attempt to remain as invisible as possible in order to access as much data as possible. Mitigating the risks of being hit with such malware falls into two categories: Pre-infection best practices to avoid infection and post-infection best practices to detect and control the attack.

Pre-infection best practices

Protecting yourself from new advanced attacks must always be done on top of executing on the basics which serve to reduce the risk of getting critical systems such as POS systems infected by any malware.

  1. Keep the OS and applications on POS systems fully patched. Most patches are security related, so ignoring them only opens up a larger window of opportunity for attackers.
  2. Firewall off the POS network from the rest of the network with strong (i.e. bare minimum access) access policies as well as with Intrusion Prevention and Anti-Malware.
  3. Use strong, non-default and not shared, passwords.
  4. Deploy and enforce endpoint anti-virus as a last measure of defense.
  5. Encrypt traffic VPN tunnels.
  6. Enable protection against MAC spoofing within the POS network and for critical systems with which the POS terminals communicate.
  7. Lock down remote access to pin-point level of access. Do not allow full L3 tunnels into sensitive networks and use remote access tools that allow verification of remote host integrity before granting access.

Post-infection best practices

A good to approach in evaluating your network security stance is to assume that you will be infected at some point in the future and design processes to allow you to detect and control the infection. In the context of memory scraping malware, the ultimate observable behavior will be communication with non-trusted hosts on the internet. It may not be immediate and it may not be in bulk, as the attacker may want to put time between the act of infection and the act of data theft. However, sooner or later, the attacker will need to get the stolen data from the POS systems into his or her possession. This may happen naively via direct communication, or via more sophisticated methods such as using another compromised system outside the POS network, but with a connection to the POS network, as a gateway. That system may reside in a network that is less strictly observed than the POS network on which may not raise alarms at communication with random servers on the internet.

There are several key technologies that can help you detect or neutralize this data exfiltration:

  • Don’t allow direct communication with the internet from the POS network. This will lock down allowable communications and will block and detect naïve approaches at data exfiltration. For processing purposes, payment data can be sent via an encrypted tunnel to another trusted server(s) on the network (outside the POS network) and then via another encrypted tunnel to the processing server. Communication between these systems should be whitelisted by the firewall via ACLs, with all other traffic (besides perhaps management and updates) blacklisted.
  • Deploy Geo-IP and Botnet filtering detection on all networks. Lock down communication from sensitive systems only to locales that they need to communicate with (if your processor is in the US, why would your POS data need to have access to and from Europe, Asia, LATAM, etc.?)
  • Configure DLP and SSL Decryption to detect Credit Card type data leaving the network in plaintext or inside of SSL tunnels to internet hosts that are unknown. In other words, only allow such data to flow to CC processing servers known to you. Communication of such data to any other system on the internet should be intercepted, logged and investigated. Deny any SSL communication from sensitive networks that does not lend itself to inspection by not accepting your NGFW SSL inspection certificate.

Firewalls occupy an extremely valuable piece of real estate on any network since all Internet bound traffic must go through them. When properly deployed, next-generation firewalls play an important role in reducing the risk of advanced malware infection and data theft in POS networks. To find out more about the capabilities of state of the art NGFWs from SonicWall, read the eBook “Types of Cyber-Attacks and How to Prevent Them.” Follow me on Twitter: @threadstate.

download ebook