A Journey to Protect Points-of-Sale
summary
Claims that most POS breaches come from memory scraping and weak local privileges; demonstrates an open‑source memory scraper (GitHub) that finds PANs every few seconds and a DLL injection framework that injects into a payment process when it runs under the same user but fails under a different user. Shows SecureString is bypassable via managed memory marshaling, describes offline exfiltration via USB keys, and recommends concrete mitigations: token server use, process isolation, sandboxing, OS hardening and blocking remote admin tools.
AI-written summary · about
chapters (30)
- 0:00Introduction
- 7:14Architecture
- 8:45Credit Cards
- 10:48ECommerce
- 13:30Retail Environment
- 18:48Threads
- 25:18Memory Scraper
- 28:08Credit Card
- 34:20Demo
- 39:54Cyber Intelligence
- 40:20Screenshot
- 40:45Black Pause
- 41:35Malicious Software
- 42:08Visit of Offer
- 42:40PIN
- 43:14Response
- 43:32Sandboxing
- 44:26Normal Detection
- 45:23Operating System Obfuscation
- 46:23Solutions
- 46:37Security Layers
- 47:02Drivers
- 47:41Family Signing
- 48:09Obfuscation
- 51:16Predicting
- 52:03Memory squaring
- 52:31Cashier is hacker
- 53:13Rubber Ducky
- 53:43Summary
- 55:00Questions
related talks
56mAnatomy of memory scraping credit card stealing POS malware
57mAnatomy of ... POS Malware
50mBreaking Payment Points of Interaction (POI)
40mPiOSoned POS - A Case Study in iOS based Mobile Point-of-Sale gone wrong
24mPicking Up My Tab...
42mAnatomy of a Crime: Secure DevOps or Darknet Early Breach Detection
32mSecurity horror stories in payments
52mFlying Under the Radar - New Security Evasion Techniques