Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How RAM Scrapers Work: The Tool Behind the Latest Credit Card Hacks

wired.com

Post reply on HN
Print view View original

21–30 of 30 posts

Re: How RAM Scrapers Work: The Tool Behind the Latest Credit Card Hacks

#21

Post by bsder »

jimrandomh wrote: post #19

The fundamental problem is that credit cards are built around a model where credit card numbers are theoretically supposed to be secret, but every random retailer has to have them to process transactions. If credit cards were electronic devices, like in Europe, rather than fancy pieces of paper with a number written on them, then fraud would drop, and retailers would be freed of a massive burden. But American banks a…

This is coming. Chip-and-pin are slated to start rolling out in the US in 2015.

Re: How RAM Scrapers Work: The Tool Behind the Latest Credit Card Hacks

#22

Post by PuercoPop »

jimrandomh wrote: post #19

The fundamental problem is that credit cards are built around a model where credit card numbers are theoretically supposed to be secret, but every random retailer has to have them to process transactions. If credit cards were electronic devices, like in Europe, rather than fancy pieces of paper with a number written on them, then fraud would drop, and retailers would be freed of a massive burden. But American banks a…

YES! Paul Chiusano wrote in detail about the fundamental broken model of 'secure transaction' http://pchiusano.blogspot.com/2014/01/an-actually-secure-pay...

Re: How RAM Scrapers Work: The Tool Behind the Latest Credit Card Hacks

#23

Post by coldcode »

I love the quote about Target. SIX MONTHS BEFORE THE BREACH, THE COMPANY HAD INSTALLED A $1.6 MILLION MALWARE DETECTION SYSTEM THAT WORKED AS DESIGNED AND ISSUED MULTIPLE ALERTS THAT GOT PASSED TO TARGET’S SECURITY STAFF, WHO SUMMARILY IGNORED THEM.

Re: How RAM Scrapers Work: The Tool Behind the Latest Credit Card Hacks

#24

Post by brewdad »

bsder wrote: post #21
jimrandomh wrote: post #19

The fundamental problem is that credit cards are built around a model where credit card numbers are theoretically supposed to be secret, but every random retailer has to have them to process transactions. If credit cards were electronic devices, like in Europe, rather than fancy pieces of paper with a number written on them, then fraud would drop, and retailers would be freed of a massive burden. But American banks a…

This is coming. Chip-and-pin are slated to start rolling out in the US in 2015.

Chip-and-Signature. Chip-and_Pin is not yet on the horizon for the US.

Re: How RAM Scrapers Work: The Tool Behind the Latest Credit Card Hacks

#25

Post by ultramancool »

tkmcc wrote: post #12
ultramancool wrote: post #9

Earlier quoted context omitted.

Okay, so, how do they harvest live data? Scan constantly? That would have a risk of missing something or of slowing down the system. I suspect that is just an oversimplification, of course, unless they post the malware in question I can't really say for sure.

That's exactly what they do. They'll call ReadProcessMemory() on every process and then use a regex + Luhn algorithm to check for credit card data. I'm sure some of the more advanced and targeted ones do use hooking, and some filter the processes to scrape by name, but a lot of malware authors are surprisingly amateur. further reading: http://www.trendmicro.com/cloud-content/us/pdfs/security-int...

Wow, that's sort of surprising to me. Perhaps just due to having some RE background, though maybe it's not stupid or amateur. It may actually be a better strategy if you want to minimize time in the store (no separate trip to steal the POS software first) and effort (no reverse engineering necessary).

Re: How RAM Scrapers Work: The Tool Behind the Latest Credit Card Hacks

#26

Post by lacker »

"Six months before the breach, the company had installed a $1.6 million malware detection system that worked exactly as planned when the intruders began stealing their loot. It even issued multiple alerts for Target’s security staff. But the security staff simply ignored them."

That sounds bad, but I wonder if this system was issuing huge numbers of alerts all the time, leaving the security staff no real option but to ignore the alerts. I'd be curious to see the false positive rate. It seems like for an off-the-shelf security system that you buy, false positives must be a huge problem, because it hasn't been tuned to your data.

Re: How RAM Scrapers Work: The Tool Behind the Latest Credit Card Hacks

#27

Post by kapnobatairza »

brewdad wrote: post #24
bsder wrote: post #21

Earlier quoted context omitted.

This is coming. Chip-and-pin are slated to start rolling out in the US in 2015.

Chip-and-Signature. Chip-and_Pin is not yet on the horizon for the US.

Not on the horizon for whom? I'm running a startup that already has combination magstripe/Chip and PIN payment dongles for smartphones ready to sell to the US market.

The problem is there aren't many chipped cards at all.

Re: How RAM Scrapers Work: The Tool Behind the Latest Credit Card Hacks

#28

Post by Sami_Lehtinen »

It seems that many people are really confused about this stuff. Because if PA-DSS standards are followed, the PC doesn't ever get any actualy credit card data. Yes, it's possible to backdoor / modify / infect / re-firmware or what ever the actua POS terminal, but it has nothing to do with the POS PC. POS terminals are independent systems with their own ram, keyboard, networking, processors, firmware, operating system, and software. I just made credit card transaction, here's all data what the PC get's from the credit card terminal. B2A8AAA4-6585-4D97-8AF7-C2DE0A617E3B for 40€ is successful. So? Feel free to abuse that information, if you find way to do so. So when ever writing stuff like this, it would be very smart to mention if the attack is targeting the PC or the actual POS terminal.

Re: How RAM Scrapers Work: The Tool Behind the Latest Credit Card Hacks

#29

Post by Sami_Lehtinen »

ackalker wrote: post #2

From what I gather from the article, the systems which RAM scrapers attack were running on general purpose computers, with very similar vulnerabilities. Why isn't sensitive software like this built and audited with the same concern for reliability and security as avionics, medical equipment, SCADA, etc.? Certainly the cost in financial losses caused by these attacks makes this a pertinent question.

Well, but these are: https://news.ycombinator.com/item?id=8409305 Yet, of course it doesn't mean that modifications would be impossible. Smart guys can breach it, it's nothing different from mod chipping a playstation or other custom embedded hardware. There are multiple protection layers, but those are just slowing the process down. Smart guys with skills, labs, test hardware and proper budget, can always work around those.

Re: How RAM Scrapers Work: The Tool Behind the Latest Credit Card Hacks

#30

Post by Sami_Lehtinen »

panarky wrote: post #11

This article [1] argues that RAM scrapers are only able to work because the point-of-sale systems are running Windows XP. Newer versions of Windows make this exploit far more difficult [2]. [1] http://www.dailytech.com/Appalling+Negligence+DecadeOld+Wind... [2] http://en.wikipedia.org/wiki/Address_space_layout_randomizat...

Most of POS terminals aren't using Windows, but embedded custom operating system, firmware & software. https://news.ycombinator.com/item?id=8409305
Post reply on HN