A 17-year-old wrote the malware behind that massive Target hack
In December, Target warned customers it had been hacked. During the holiday shopping season, the big box store said, someone had gained access to its customer credit card information. It was a public relations disaster and a stark reminder that even the largest businesses can have security failures.
Then, in January, we learned the hack was far worse than initially reported, affecting up to 110 million people. Just for perspective, that’s over three times the population of Canada and just less than three times the population of California.
According to Los Angeles-based security firm IntelCrawler, it all started with a 17-year-old Russian hacker with ties to St. Petersburg, who is well known in the underground programming community.
IntelCrawler published a statement last week saying the teenage hacker created the malware known as “BlackPOS” last March, and sold it off to an unknown group or groups who carried out the attack on Target, as well as a similar attack on upscale department store Neiman Marcus.
IntelCrawler initially identified the hacker by the wrong name, but updated its report and identified the correct 17-year-old by name and linked to his VKontakte profile (we’re not identifying him by name, as he’s a minor). The security team noted the teen was not the only culpable party: “He is still visible for us, but the real bad actors responsible for the past attacks on retailers such as Target and Neiman Marcus were just his customers,” IntelCrawler President Dan Clements commented in the statement.
Some of the suspected customers who bought and used the malware: Russian mobsters, according to CNN.
In an email to the Daily Dot, IntelCrawler CEO Andrew Komarov warned that more BlackPOS attacks on other department stores are likely imminent, adding that he’d already reached out to Visa, Mastercard, and several U.S. banks. Here are the warning signs he gave them:
– Point-of-Sale terminal showed error or was temporarily disconnected from the host computer
– Active use of network connections through FTP (File Transfer Protocol) during business hours
– Your antivirus software was deleted or stopped, it shows use the error during updates;
– Suspicious files with names «mmon.exe», «well.exe», «mbot.exe» and other;
– New binary files in task scheduler, as bad actors use it for interval RAM scanning
In addition to looking out for these attack signals, Komarov recommended following the steps laid out by a report by iSight Partners detailing the attack. iSight worked with the U.S. Secret Service and released a report urging retailers to call U.S. Secret Service Field Office/Electronic Crimes Task Force.
Now that more information about the malware is known, hopefully retailers can get in front of these attacks before another security snafu. Still, cash is looking mighty appealing right now.