securityaffairs.co
Open in
urlscan Pro
2001:8d8:100f:f000::289
Public Scan
URL:
http://securityaffairs.co/wordpress/22121/malware/jackpos-pos-malware.html
Submission: On November 06 via api from US — Scanned from DE
Submission: On November 06 via api from US — Scanned from DE
Form analysis 1 forms found in the DOM
Name: searchform — GET http://securityaffairs.co/wordpress/
<form role="search" method="get" name="searchform" id="searchform" action="http://securityaffairs.co/wordpress/">
<div>
<input type="text" value="" name="s" id="s" autocomplete="off" title="Search..." class="blur">
<button type="submit">
<i class="fa fa-search"></i>
</button>
</div>
<div id="autocomplete"></div>
</form>Text Content
* Home * Cyber Crime * Cyber warfare * APT * Data Breach * Deep Web * Digital ID * Hacking * Hacktivism * Intelligence * Internet of Things * Laws and regulations * Malware * Mobile * Reports * Security * Social Networks * Terrorism * ICS-SCADA * EXTENDED COOKIE POLICY * Contact me MUST READ Headlines * 29 malicious PyPI packages spotted delivering the W4SP Stealer * Zero-day are exploited on a massive scale in increasingly shorter timeframes * RomCom RAT campaigns abuses popular brands like KeePass and SolarWinds NPM * The 10th edition of the ENISA Threat Landscape (ETL) report is out! * Cisco addressed several high-severity flaws in its products * LockBit ransomware gang claims the hack of Continental automotive group * Home * Cyber Crime * Cyber warfare * APT * Data Breach * Deep Web * Digital ID * Hacking * Hacktivism * Intelligence * Internet of Things * Laws and regulations * Malware * Mobile * Reports * Security * Social Networks * Terrorism * ICS-SCADA * EXTENDED COOKIE POLICY * Contact me JACKPOS MALWARE PRESENTED AS A JAVA UPDATE SCHEDULER February 12, 2014 By Pierluigi Paganini Powered by pixfutureⓘ JACKPOS WAS DETECTED BY SECURITY EXPERTS AT INTELCRAWLER FIRM SEVERAL DAYS AGO AND IT SEEMED BASED ON CODE FROM “ALINA”. ATTACKS ON POS ARE ON THE RISE. A new strain of Point-of-Sale malware named “JackPOS” was discovered by IntelCrawler, a cyber intelligence firm from Los Angeles, confirming the growing trend of Point-of-Sales malware after the Target data breach. JackPOS was detected several days ago and it seemed based on code from “Alina”. > Powered by pixfutureⓘ > > “The bad actors are using similar tactics and methods by gathering and memory > parsing of the of credit card data once inside the merchant’s system” reported > the official post published by the company. The cybercriminals distributed via Drive-by attack several variants of malware masked as Java (TM) Platform SE binary which then replaced the legit Java Update Scheduler file having its embedded strings in the file description. > “Some of detected samples use APC Injection from User Space using the API > function QueueUserAPC to “svchost.exe”. The malware samples are pretty fresh > and were created close to the beginning of February. The build path which was > detected follows to > “C:\Users\ziedpirate.ziedpirate-PC\Desktop\sop\sop\Release” The cybercriminals have written the loaders with AutoIt coding language because it is a very flexible scripting language used since 1999 in Windows environments. The language was used to perform simple operations like text file editing, but allows also the creation of more complex scripts that perform mass downloads with complex GUIs. AutoIt is an easy-to-learn language that allows for quick development,due this reason it was chosen by numerous malware author. Malware authors used it to implement detection avoidance techniques, in particular, they have written the loader code to unpack additional binary malicious code and execute further instructions received from the C&C server. IntelCrawler experts confirmed the existence of different attack vectors, crooks have used some sophisticated scanning, loading, and propagating techniques to get into merchants’ system thru external perimeters and then move to card processing areas, which were possibly not separated in compliance with PCI polices. Which is the extent of the infection? IntelCrawler analysts have found compromised machines in numerous countries, including Brazil, Canada, France, India, Spain, Korea, Argentina and the US. In same cases the machines were infected more than 17 days ago. The IntelCrawler’s threat intelligence team released a global map of Point-of-Sales infections based on data collected during the investigation on different malware. [adorate banner=”9″] Pierluigi Paganini (Security Affairs – JackPOS, malware) [adorate banner=”12″] Credits: – Xylitol (http://www.xylibox.com) – MalwareMustDie! (http://malwaremustdie.org/) About IntelCrawler IntelCrawler.com is a multi-tier intelligence aggregator, which gathers information and cyber prints from a starting big data pool of over 3, 000, 000, 000 IPv4 and over 200, 000, 000 domain names, which are scanned for analytics and dissemination to drill down to a desired result. This finite pool of cyber prints is then narrowed further by comparing it to various databases and forum intelligence gathered from the underground and networked security company contacts. The final result could be the location of a particular keyboard or a computer housing the threat. Share this... Facebook Twitter Linkedin SHARE THIS: * Email * Twitter * Print * LinkedIn * Facebook * More * * Tumblr * Pocket * * credit cardCybercrimedata breachDatabase BreachedfraudHackingIntelCrawlerJackPOSJavaNeiman MarcusPOSshopping seasonTargetunderground -------------------------------------------------------------------------------- SHARE ON * * * * * * * PIERLUIGI PAGANINI Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”. -------------------------------------------------------------------------------- PREVIOUS ARTICLE Honey Encryption deceives attackers with fake data NEXT ARTICLE Largest Ever 400Gbps Distributed Denial of Service NTP Amplification attack hit Cloudfare -------------------------------------------------------------------------------- YOU MIGHT ALSO LIKE 29 MALICIOUS PYPI PACKAGES SPOTTED DELIVERING THE W4SP STEALER November 5, 2022 By Pierluigi Paganini ZERO-DAY ARE EXPLOITED ON A MASSIVE SCALE IN INCREASINGLY SHORTER TIMEFRAMES November 5, 2022 By Pierluigi Paganini * SPONSORED CONTENT * * PIXFUTURE * * DIGGING THE DEEP WEB: EXPLORING THE DARK SIDE OF THE WEB * CENTER FOR CYBER SECURITY AND INTERNATIONAL RELATIONS STUDIES * SUBSCRIBE SECURITY AFFAIRS NEWSLETTER * SECURITYAFFAIRS AWARDED AS BEST EUROPEAN CYBERSECURITY TECH BLOG AT EUROPEAN CYBERSECURITY BLOGGER AWARDS More Story HONEY ENCRYPTION DECEIVES ATTACKERS WITH FAKE DATA Honey Encryption is the name of a new approach to encryption, elaborated by the independent researcher Ari Juels, based on misleading... Copyright 2021 Security Affairs by Pierluigi Paganini All Right Reserved. Back to top * Home * Cyber Crime * Cyber warfare * APT * Data Breach * Deep Web * Digital ID * Hacking * Hacktivism * Intelligence * Internet of Things * Laws and regulations * Malware * Mobile * Reports * Security * Social Networks * Terrorism * ICS-SCADA * EXTENDED COOKIE POLICY * Contact me We use cookies on our website to give you the most relevant experience by remembering your preferences and repeat visits. By clicking “Accept All”, you consent to the use of ALL the cookies. However, you may visit "Cookie Settings" to provide a controlled consent. Cookie SettingsAccept All Manage consent Close PRIVACY OVERVIEW This website uses cookies to improve your experience while you navigate through the website. Out of these cookies, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities... Necessary Necessary Always Enabled Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information. Non-necessary Non-necessary Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website. SAVE & ACCEPT