Anatomy of ... POS Malware
Talkat AppSec California 2015 · on Tuesday, 2015-01-27· at 16:15· Annenberg Community Beach House: Track 2, 415 Pacific Coast Hwy·
summary
Demonstrates that RAM scraping malware actually elevates privileges (uses seDebugPrivilege), opens the POS process and dumps committed pages with ReadProcessMemory and VirtualQueryEx, then extracts track data with regex and verifies PANs via the Luhn algorithm. Claims and a working PoC are shown: a homemade ram scraper reads PAN, expiry, service code and CVV (sometimes duplicated in memory). Notes common infection paths—exposed RDP/default creds, USB drop—and mitigation: end‑to‑end encryption, chip/PIN, and zeroing sensitive buffers.
AI-written summary · about
chapters (14)
- 0:00Start
- 2:05Introduction
- 4:522014 Verizon Data Beach Report
- 5:042014 Verizon Data Bali Report
- 5:502014 Verizon Data Breach Report
- 6:22Credit Cards
- 10:01POS Components
- 13:35Magnetic Stripe: Track 1
- 17:21Major Transition Types
- 19:43Data Encryption
- 20:59Attack Scenario
- 23:43RAM Scraper Attack Working
- 34:26Verify Card Number
- 47:55Mitigation
related talks
56mAnatomy of memory scraping credit card stealing POS malware
59mA Journey to Protect Points-of-Sale
54mThe Underground Ecosystem of Credit Card Frauds
23mPoint of Sale System Architecture and Security
42mAnatomy of a Crime: Secure DevOps or Darknet Early Breach Detection
38mMission mPOSsible
55mHiding PIN's Artifacts to Defeat Evasive Malware
50mBreaking Payment Points of Interaction (POI)