securityaffairs.co Open in urlscan Pro
2001:8d8:100f:f000::289  Public Scan

Form analysis
1 forms found in the DOM

Name: searchform — GET http://securityaffairs.co/wordpress/

<form role="search" method="get" name="searchform" id="searchform" action="http://securityaffairs.co/wordpress/">
  <div>
    <input type="text" value="" name="s" id="s" autocomplete="off" title="Search..." class="blur">
    <button type="submit">
      <i class="fa fa-search"></i>
    </button>
  </div>
  <div id="autocomplete"></div>
</form>

Text Content

 * Home
 * Cyber Crime
 * Cyber warfare
 * APT
 * Data Breach
 * Deep Web
 * Digital ID
 * Hacking
 * Hacktivism
 * Intelligence
 * Internet of Things
 * Laws and regulations
 * Malware
 * Mobile
 * Reports
 * Security
 * Social Networks
 * Terrorism
 * ICS-SCADA
 * EXTENDED COOKIE POLICY
 * Contact me


MUST READ

Headlines
 * Analyzing IP Addresses to Prevent Fraud for Enterprises
 * American Airlines disclosed a data breach
 * IT giants warn of ongoing Chromeloader malware campaigns
 * Revolut security breach: data of +50,000 users exposed
 * Alleged Grand Theft Auto 6 (GTA6) gameplay videos and source code leaked
   online
 * TeamTNT is back and targets servers to run Bitcoin encryption solvers



 * Home
 * Cyber Crime
 * Cyber warfare
 * APT
 * Data Breach
 * Deep Web
 * Digital ID
 * Hacking
 * Hacktivism
 * Intelligence
 * Internet of Things
 * Laws and regulations
 * Malware
 * Mobile
 * Reports
 * Security
 * Social Networks
 * Terrorism
 * ICS-SCADA
 * EXTENDED COOKIE POLICY
 * Contact me


JACKPOS MALWARE PRESENTED AS A JAVA UPDATE SCHEDULER

February 12, 2014  By Pierluigi Paganini


Powered by pixfutureⓘ


JACKPOS WAS DETECTED BY SECURITY EXPERTS AT INTELCRAWLER FIRM SEVERAL DAYS AGO
AND IT SEEMED BASED ON CODE FROM “ALINA”. ATTACKS ON POS ARE ON THE RISE.

A new strain of Point-of-Sale malware named “JackPOS” was discovered by
IntelCrawler, a cyber intelligence firm from Los Angeles, confirming the growing
trend of Point-of-Sales malware after the Target data breach. JackPOS was
detected several days ago and it seemed based on code from “Alina”.

> Powered by pixfutureⓘ
> 
> “The bad actors are using similar tactics and methods by gathering and memory
> parsing of the of credit card data once inside the merchant’s system” reported
> the official post published by the company.

 



 



The cybercriminals distributed via Drive-by attack several variants of malware
masked as Java (TM) Platform SE binary which then replaced the legit Java Update
Scheduler file having its embedded strings in the file description.

> “Some of detected samples use APC Injection from User Space using the API
> function QueueUserAPC to “svchost.exe”. The malware samples are pretty fresh
> and were created close to the beginning of February. The build path which was
> detected follows to
> “C:\Users\ziedpirate.ziedpirate-PC\Desktop\sop\sop\Release”













The cybercriminals have written the loaders with AutoIt coding language because
it is a very flexible scripting language used since 1999 in Windows
environments. The language was used to perform simple operations like text file
editing, but allows also the creation of more complex scripts that perform mass
downloads with complex GUIs. AutoIt is an easy-to-learn language that allows for
quick development,due this reason it was chosen by numerous malware author.

Malware authors used it to implement detection avoidance techniques, in
particular, they have written the loader code to unpack additional binary
malicious code and execute further instructions received from the C&C server.
 IntelCrawler experts confirmed the existence of different attack vectors,
crooks have used some sophisticated scanning, loading, and propagating
techniques to get into merchants’ system thru external perimeters and then move
to card processing areas, which were possibly not separated in compliance with
PCI polices. 

Which is the extent of the infection?

IntelCrawler  analysts have found compromised machines in numerous countries,
including  Brazil, Canada, France, India, Spain, Korea, Argentina and the US. In
same cases the machines were infected more than 17 days ago. The IntelCrawler’s
threat intelligence team released a global map of Point-of-Sales
infections based on data collected during the investigation on
different malware.



[adorate banner=”9″]

Pierluigi Paganini

(Security Affairs –  JackPOS, malware)

[adorate banner=”12″]

Credits: – Xylitol (http://www.xylibox.com) – MalwareMustDie!
(http://malwaremustdie.org/) About IntelCrawler IntelCrawler.com is a multi-tier
intelligence aggregator, which gathers information and cyber prints from a
starting big data pool of over 3, 000, 000, 000 IPv4 and over 200, 000, 000
domain names, which are scanned for analytics and dissemination to drill down to
a desired result. This finite pool of cyber prints is then narrowed further by
comparing it to various databases and forum intelligence gathered from the
underground and networked security company contacts. The final result could be
the location of a particular keyboard or a computer housing the threat.

Share this...

Facebook
Twitter
Linkedin


SHARE THIS:

 * Email
 * Twitter
 * Print
 * LinkedIn
 * Facebook
 * More
 * 

 * Tumblr
 * Pocket
 * 
 * 


credit cardCybercrimedata breachDatabase
BreachedfraudHackingIntelCrawlerJackPOSJavaNeiman MarcusPOSshopping
seasonTargetunderground


--------------------------------------------------------------------------------

SHARE ON

 * 
 * 
 * 
 * 
 * 
 * 
 * 


PIERLUIGI PAGANINI

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and
Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he
is also a Security Evangelist, Security Analyst and Freelance Writer.
Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security
expert with over 20 years experience in the field, he is Certified Ethical
Hacker at EC Council in London. The passion for writing and a strong belief that
security is founded on sharing and awareness led Pierluigi to find the security
blog "Security Affairs" recently named a Top National Security Resource for US.
Pierluigi is a member of the "The Hacker News" team and he is a writer for some
major publications in the field such as Cyber War Zone, ICTTF, Infosec Island,
Infosec Institute, The Hacker News Magazine and for many other Security
magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency
and Bitcoin”.




--------------------------------------------------------------------------------

PREVIOUS ARTICLE

Honey Encryption deceives attackers with fake data

NEXT ARTICLE

Largest Ever 400Gbps Distributed Denial of Service NTP Amplification attack hit
Cloudfare

--------------------------------------------------------------------------------





YOU MIGHT ALSO LIKE


ANALYZING IP ADDRESSES TO PREVENT FRAUD FOR ENTERPRISES

September 20, 2022  By Pierluigi Paganini

AMERICAN AIRLINES DISCLOSED A DATA BREACH

September 20, 2022  By Pierluigi Paganini






 * SPONSORED CONTENT
   
   
 * 


 * PIXFUTURE

 * 


 * DIGGING THE DEEP WEB: EXPLORING THE DARK SIDE OF THE WEB


 * CENTER FOR CYBER SECURITY AND INTERNATIONAL RELATIONS STUDIES


 * SUBSCRIBE SECURITY AFFAIRS NEWSLETTER


 * SECURITYAFFAIRS AWARDED AS BEST EUROPEAN CYBERSECURITY TECH BLOG AT EUROPEAN
   CYBERSECURITY BLOGGER AWARDS




More Story

HONEY ENCRYPTION DECEIVES ATTACKERS WITH FAKE DATA

Honey Encryption is the name of a new approach to encryption, elaborated by the
independent researcher Ari Juels, based on misleading...
Copyright 2021 Security Affairs by Pierluigi Paganini All Right Reserved.
Back to top
 * Home
 * Cyber Crime
 * Cyber warfare
 * APT
 * Data Breach
 * Deep Web
 * Digital ID
 * Hacking
 * Hacktivism
 * Intelligence
 * Internet of Things
 * Laws and regulations
 * Malware
 * Mobile
 * Reports
 * Security
 * Social Networks
 * Terrorism
 * ICS-SCADA
 * EXTENDED COOKIE POLICY
 * Contact me

We use cookies on our website to give you the most relevant experience by
remembering your preferences and repeat visits. By clicking “Accept All”, you
consent to the use of ALL the cookies. However, you may visit "Cookie Settings"
to provide a controlled consent.
Cookie SettingsAccept All
Manage consent
Close

PRIVACY OVERVIEW

This website uses cookies to improve your experience while you navigate through
the website. Out of these cookies, the cookies that are categorized as necessary
are stored on your browser as they are essential for the working of basic
functionalities...
Necessary
Necessary
Always Enabled
Necessary cookies are absolutely essential for the website to function properly.
This category only includes cookies that ensures basic functionalities and
security features of the website. These cookies do not store any personal
information.
Non-necessary
Non-necessary
Any cookies that may not be particularly necessary for the website to function
and is used specifically to collect user personal data via analytics, ads, other
embedded contents are termed as non-necessary cookies. It is mandatory to
procure user consent prior to running these cookies on your website.
SAVE & ACCEPT