Cyber-thieves are preparing malware and spam campaigns
in a bid to catch out retailers and shoppers during the run-
up to Christmas, experts say.
One gang had updated the sophisticated malware it used to
target tills in stores, security company iSight said.
There had also been an increase in spam and phishing
emails crafted to catch out people seeking bargains.
And some crime groups had made fake copies of popular
shopping apps in a bid to steal payment-card data.
The warnings are being given just prior to Black Friday and
Cyber Monday, which bracket the weekend following the US
Thanksgiving holiday, when many online and offline stores
offer special deals.
Cashing in
The 50 biggest retail brands in the US were now hunting
through their internal corporate networks to see if they had
been infected by the "highly sophisticated" Modpos malware,
said iSight senior director Stephen Ward.
The modular malware could lurk unseen on point-of-sale
equipment, said Mr Ward, and sought to scoop up payment-
card data during the few moments this information was
passed around unencrypted in the memory of computerised
tills.
"It's a Swiss-army knife of sorts that can be used for any
type of nefarious activity," he said.
The Retail Cyber Intelligence Sharing Center, a US
government-backed organisation set up to pass on
information about threats aimed at retailers, has sent out
advice about the "2015 hacking season".
"Downtime is expensive, but especially so at this time of
year," it said.
"Retail staff is motivated and focused on sales, at the risk of
possibly allowing fraudulent transactions or other types of
breaches."
Reacting quickly to threats could be tricky at this time of
year, it said, because systems were often "frozen" to limit
downtime.
Mr Ward said iSight had been tracking the gang behind
Modpos for some time, but it had now been revamped for
the run-up to Christmas.
And traditional anti-virus systems were unlikely to catch the
stealthy malware because of the clever way it was built.
"The guys behind this seem to have an incredible level of
knowledge related to the way that security technology works
and the industry operates," said Mr Ward.
But iSight had passed on information about telltale signs that
would reveal a retailer had been compromised by Modpos.
"We are stealing Christmas from these bad guys," he said.
"Here, we are being the Grinch."
Payments please
Anti-fraud company ThreatMetrix said online retailers were
also coming under sustained assault from many different hi-
tech crime groups.
It said it had seen signs of an increase in fraud campaigns
before the main shopping season got under way and
expected a "major spike" in such activity in the run-up to
Christmas.
In a report, it said attacks against online retailers had
already jumped 25% over earlier in the year and it expected
the trend to continue.
"Generally, the third quarter is a slower time for businesses
as consumers anticipate spending money during the
Christmas and New Year shopping season, but this year it
yielded record numbers in attack attempts," said Vanita
Pandey, strategy director at ThreatMetrix.
The vast majority of the attacks were attempts to defraud
companies by using fake logins or stolen credentials, said
Ms Pandey.
And ThreatMetrix had seen evidence of crime groups using
botnets, networks of hijacked computers, to batter away at
login screens searching for loopholes and bugs.
Michael Owen, head of security at payments processor Sage
Pay, said criminals could also target online stores in other
ways during busy shopping days.
"Criminals know that merchants need their websites to be
live and accessible this weekend," he said, "which makes
them an appealing target for blackmail."
"If a criminal can take down a website and demand funds to
let the merchant get back to trading, they'll want to do it this
weekend."
Paul Ducklin, a senior security advisor at Sophos, said
spammers were gearing up for the Christmas shopping
season too.
He urged people to be vigilant and exercise common sense
when browsing offers sent via email or other messaging
services.
No-one should ever buy anything offered via unsolicited
email, he said.
"If it sounds too good to be true, it is too good to be true," he
said.
"Even if you think that the crooks will take every care with
your payment details and your identity, and even if the goods
you are buying turn out to be the genuine article, why give
these guys your business?
"Instead, ask yourself, 'Do I consider a spam campaign to be
the basis of a business relationship founded on mutual
trust?'"
No comments:
Post a Comment