What we know now for sure is that the Target breach was performed through the attack on point of sale machines using RAM scraping malware. Memory scraping technique is pretty simple. Usually, the RAM scraper selects and scans particular process that belongs to POS or/and payment application. The names of these processes are well known string constants. The card data is filtered out from the memory stream using special technique called regular expressions, or regex. I describe all this in detail in my forthcoming book Hacking Point of Sale. The book also contains code examples of RAM scraper as well as disk and network scanners.
There are different and sometimes confusing messages regarding the specific malware used to steal card data from Target stores. Some of them name KAPTOXA as the malware responsible for the attack and reference iSIGHT Partners report. I haven't seen this report so I can't say KAPTOXA directly related to target breach. First time I heard and wrote about KAPTOXA back in May 2013. Interesting fact: the word "KAPTOXA" consist of letters which look the same in both Latin and Cyrillic alphabets, although some of them stand for sounds. If you read this word as Cyrillic letters, it is Russian slang word meaning “potato”.
However, I would rather trust McAfee blog which states that the actual malware is “BlackPOS” which contains string "Rescator" which links it to Russian hackers. It is unclear at this moment whether there is any link between KAPTOXA and BlackPOS.
There are different and sometimes confusing messages regarding the specific malware used to steal card data from Target stores. Some of them name KAPTOXA as the malware responsible for the attack and reference iSIGHT Partners report. I haven't seen this report so I can't say KAPTOXA directly related to target breach. First time I heard and wrote about KAPTOXA back in May 2013. Interesting fact: the word "KAPTOXA" consist of letters which look the same in both Latin and Cyrillic alphabets, although some of them stand for sounds. If you read this word as Cyrillic letters, it is Russian slang word meaning “potato”.
However, I would rather trust McAfee blog which states that the actual malware is “BlackPOS” which contains string "Rescator" which links it to Russian hackers. It is unclear at this moment whether there is any link between KAPTOXA and BlackPOS.
RSS Feed
