Botnet brute-forces remote access to point-of-sale systems

A new malware threat scans the Internet for POS systems and tries to access them using common usernames and passwords

Thousands of compromised computers are actively trying to break into point-of-sale (POS) systems using brute-force techniques to guess remote administration credentials.

The computers are part of a botnet, dubbed BrutPOS by researchers from security firm FireEye, that has been active since at least February. The botnet scans attacker-specified IP (Internet Protocol) address ranges for systems that accept Remote Desktop Protocol (port 3389) connections.

When an RDP service is identified, the BrutPOS malware attempts to log in with user names and passwords from a predefined list.

"Some of the usernames and passwords indicate that the attackers are looking for specific brands of POS systems such as Micros," the FireEye researchers said Wednesday in a blog post.

Micros Systems is based in Columbia, Maryland, and provides software applications, services and hardware systems, including POS terminals, to the hospitality and retail industries.

If the BrutPOS malware successfully guesses the remote access credentials of an RDP-enabled system it sends the information back to a command-and-control server. Attackers then use the information to determine whether the system is a POS terminal and if it is, to install a malware program that's designed to extract payment card details from the memory of applications running on it.

This kind of memory monitoring program is known as a RAM scraper and has increasingly been used in attacks against POS systems over the past year. A data breach last year at Target that led to the compromise of 40 million payment cards resulted from the retailer's POS terminals being infected RAM scraping malware.

Researchers from cyberthreat intelligence firm IntelCrawler have also monitored the BrutPOS malware, which they believe appeared in the cybercriminal underground in May as a project called @-Brt. According to them, it doesn't only target RDP, but other remote administration protocols like VNC and PCAnywhere as well.

FireEye has identified a total of five BrutPOS command-and-control servers, two of which are still online. The two remaining servers are located in Russia and were set up in late May and early June respectively.

Data collected from these servers suggests that the botnet is made up of 5,622 compromised computers from 119 countries. The researchers identified 60 RDP-enabled systems -- most likely POS terminals -- that have been compromised, 51 of which are based in the U.S.

"The most common username was 'administrator' (36) and the most common passwords were 'pos' (12) and 'Password1' (12)," the FireEye researchers said.

According to IntelCrawler's data, other remote access passwords frequently used on the compromised systems were aloha12345, micros, pos12345, posadmin and javapos.

"While there is insufficient information to determine attribution, there is some information which indicates that the attackers are in Eastern Europe, probably Russia or Ukraine," the FireEye researchers said.

In recent years POS systems have become a significant target for cybercriminals. Security firm Trustwave recently reported that over a third of data breaches the company investigated last year involved intrusions into POS terminals. Weak passwords, especially those for VPNs (virtual private networks), SSH (Secure Shell) and remote desktop connections remained a leading cause of breaches, the company said.

Brute-forced remote access connections and stolen credentials were the primary vectors for POS intrusions in 2013, Verizon said in its own data breach investigations report in April.

Join the CSO newsletter!

Error: Please check your email address.

Tags intrusiontrustwaveIntelCrawlersecurityverizonAccess control and authenticationFireEyemalwarefraud

More about FireEyeSSHTrustwaveVerizonVerizon

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Lucian Constantin

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts