Dexter (malware)

[1]Dexter is a computer virus or point of sale malware which infects computers running Microsoft Windows and was discovered by IT security firm Seculert, in December 2012. It infects PoS systems worldwide and steals sensitive information such as Credit Card and Debit Card information.[2][3]

Function

When Dexter infects a machine it injects itself into iexplore.exe, the executable file that runs Internet Explorer. It also changes Windows registry entries to allow the malware to run on startup of the machine.[4] The malware parses memory dumps by using a Windows function called ReadProcessMemory.[5] Dexter uploads the contents of the memory it parses from PoS machines to a server located in The Republic of Seychelles.[5] The information Dexter can collect includes credit and debit card information, user names and host names, operating system data, a list of running processes, and encryption keys so the data it collects can be decrypted.

Impact

Businesses infected by Dexter include retail stores, hotels, restaurants, banks,[6] and private parking providers. By December 2012, around the time it was first discovered, the malware was found in 40 different countries, with most compromised machines being located in the United States, United Kingdom, and Canada (where POS systems are ubiquitous) but was also found in Asia (including China, Southeast Asia and India).[7][8]

A variant of Dexter, thought to have been modified to avoid antimalware detection by an unknown group in the UK, was linked to estimated losses in the tens of millions for banks in South Africa.[9] South Africa's banks noticed "unusual levels of suspected fraud" after customers used credit cards at various fast-food restaurants. An updated antimalware signature was provided for all outlets suspected of using infected PoS machines. It is unknown how many credit cards were compromised in these attacks, but many were monitored for fraud after the incident.[10]

StarDust

In December 2013, researchers discovered StarDust, a major revision of Dexter, which compromised 20,000 cards in active campaign hitting US merchants.[11] It was one of the first known botnets to target point-of-sale (PoS) terminals used by stores and restaurants to process customers' credit and debit card payments.[11] Unlike the original version of Dexter, StarDust can also extract information from internal network traffic instead of information contained to one PoS device.[12]

See also

References
  1. "Dexter Malware Infects Point-of-Sale Systems". 2021-12-05. Archived from the original on 2021-12-05. Retrieved 2022-12-10.
  2. "Dexter malware infects point-of-sale systems worldwide, researchers say - CSO Online - Security and Risk". CSO Online. 2012-12-11. Retrieved 2012-12-17.
  3. "Dexter POS Malware Threat" (PDF). squirrelsystems.
  4. "Win32/Dexter". Microsoft.com. 2017-09-15. Retrieved 2022-04-15.{{cite web}}: CS1 maint: url-status (link)
  5. Goodin, Dan (2012-12-11). ""Dexter" malware steals credit card data from point-of-sale terminals". Ars Technica. Retrieved 2022-04-15.
  6. "Dexter point-of-sale malware strikes U.S. and abroad". iTnews. Retrieved 2022-04-15.
  7. "Dexter Malware Infects Point-of-Sale Systems". eSecurityPlanet. 2012-12-11. Retrieved 2022-04-15.
  8. "Dexter, Project Hook POS Malware Campaigns Persist". threatpost.com.
  9. "South African banks suffer massive Dexter malware attack". Payments Cards & Mobile. 2013-10-15. Retrieved 2022-05-16.
  10. "SA banks in massive data breach". TechCentral. 2013-10-15. Retrieved 2022-05-16.
  11. Dan Goodin (December 4, 2013). "Credit card fraud comes of age with advances in point-of-sale botnets". Ars Technica. Retrieved November 8, 2014.
  12. "Point-of-sale malware infections on the rise, researchers warn - PC World Australia". www.pcworld.idg.com.au. Retrieved 2022-04-15.
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.