Vulnerabilities / Threats

5/10/2018
06:35 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Author of TreasureHunter PoS Malware Releases Its Source Code

Leak gives threat actors a way to build newer, nastier versions of the point-of-sale malware, Flashpoint says.

In a development that could spell trouble for point-of-sale (PoS) operators, the author of TreasureHunter, a point-of-sale malware family that has been circulating in the wild since at least 2014, has released source code for the malware.

Along with it, the threat actor has also released code for TreasureHunter's graphical user interface builder and the malware's administrator panel, security vendor Flashpoint said in an advisory this week.

The code release, in a leading Russian underground forum, has given security researchers fresh insight into the malware, which they have had to reverse engineer up to this point in order to analyze.  

Vitali Kremez, director of research at Flashpoint, says the code has provided some unique insight into the coders' mindset and operational style. Flashpoint, in collaboration with security researchers from Cisco Talos, has already been able to use the leaked code to improve protections around the malware and to be able to quickly disrupt potential copycat versions of it.

At the same time, the open availability of TreasureHunter code in a popular underground forum lowers the bar for other threat actors to build new and potentially more sophisticated versions of the PoS malware, Kremez says.

"Based on our intelligence, this malware was linked to quite a few breaches [perpetrated by] Russian-speaking criminal groups targeting small-sized and medium-sized retailers," Kremez says. But the full source code was up to now reserved for BearsInc, a notorious Russian-speaking group that specializes in selling stolen card data via low-tier and midtier hacking and carding communities.

Flashpoint says its researchers have already observed Russian-speaking threat actors discussing ways to improve and weaponize TreasureHunter in new ways. How exactly malware authors will use the code to improve TreasureHunter remains unclear. "Likely, cybercriminals would work on improving [the malware's] communication protocol" and adding more functionality to it, Kremez says.

The leaked code shows that the original author planned to tweak various features of the malware, including its anti-debugging capabilities and communication logic. The code also contains a long list of "to-do" items and suggestions for improving the overall functionality of TreasureHunter.

What is not clear at the moment is why exactly the Russian-speaking author of the malware decided to leak its source code publicly. "We hypothesize it is likely they did this in [an] attempt to distance themselves from being unique malware code owners," says Kremez. Often, threat actors resort to the tactic to frustrate efforts by law enforcement investigators and security researchers to attribute attacks and malware to specific threat actors and groups.

For instance, in September 2016, the three authors of Mirai — one of whom was a former Rutgers University student — decided to publicly release its source code after infecting hundreds of thousands of Internet of Things devices worldwide with the malware. Prosecutors described the leak as an attempt by the trio to cover their tracks and to build plausible deniability of their direct connection to the malware.

Threat actors later took advantage of the leaked Mirai code to build multiple versions of the malware, including one that was responsible for disrupting services at DNS provider Dyn and numerous other major Internet companies.

A similar leak of the Zeus banking Trojan code back in 2011 resulted in multiple more-dangerous versions of the malware becoming available soon after. "PoS malware leaks have had similar effects, most notably with the 2015 leak of the Alina malware, which led to the creation of the ProPoS and Katrina variants," Kremez wrote in the Flashpoint blog post announcing the code leak this week.

Related Content:

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
What We Talk About When We Talk About Risk
Jack Jones, Chairman, FAIR Institute,  7/11/2018
Major International Airport System Access Sold for $10 on Dark Web
Kelly Sheridan, Staff Editor, Dark Reading,  7/11/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-14373
PUBLISHED: 2018-07-17
An issue was discovered in LibTIFF 4.0.9. In TIFFFindField in tif_dirinfo.c, the structure tif is being dereferenced without first checking that the structure is not empty and has the requested fields (tif_foundfield). In the call sequences following from the affected library functions (TIFFVGetFiel...
CVE-2018-14374
PUBLISHED: 2018-07-17
An issue was discovered in LibTIFF 4.0.9. A buffer overflow can occur via an empty fmt argument to unixErrorHandler in tif_unix.c, and it can be exploited (at a minimum) via the following high-level library API functions: TIFFClientOpen, TIFFFdOpen, TIFFRawStripSize, TIFFCheckTile, TIFFComputeStrip,...
CVE-2018-14375
PUBLISHED: 2018-07-17
An issue was discovered in LibTIFF 4.0.9. A buffer overflow vulnerability can occur via an invalid or empty tif argument to TIFFRGBAImageOK in tif_getimage.c, and it can be exploited (at a minimum) via the following high-level library API functions: TIFFReadRGBAImage, TIFFRGBAImageOK, and TIFFRGBAIm...
CVE-2018-14378
PUBLISHED: 2018-07-17
An issue was discovered in LibTIFF 4.0.9. A buffer overflow can occur via an invalid or empty tif argument to TIFFWriteBufferSetup in tif_write.c, and it can be exploited (at a minimum) via the following high-level library API function: TIFFWriteTile.
CVE-2018-14363
PUBLISHED: 2018-07-17
An issue was discovered in NeoMutt before 2018-07-16. newsrc.c does not properly restrict '/' characters that may have unsafe interaction with cache pathnames.