More POS malware detected in the wild

UDPOS malware is flawed

The researchers said it is still unclear whether the malware is currently being used in campaigns in the wild, but the co-ordinated use of LogMeIn-themed filenames and command and control (C2) server addresses in Switzerland, coupled with evidence of an earlier Intel-themed variant, suggest that it may well be.

The researchers noted that they have been in contact with LogMeIn throughout the investigation to help determine whether its services or products may have been abused as part of the malware deployment process, but no evidence of this was found.

“It appears that the use of LogMeIn-themed filenames and C2 domain by the actors behind the malware is a simple lure and ‘camouflage’ technique,” they said, adding that LogMeIn has not been affected or infected in any way.

LogMeIn has also issued a statement saying that all legitimate updates for LogMeIn products, including patches, will always be delivered securely in-product. Users will never be contacted by LogMeIn with a request to update software that also includes either an attachment or a link to a new version or update, the company said.

The good news is that UDPOS is not as advanced as the LockPOS malware discovered in June 2017, and does not work correctly, the researchers said. UDPOS is designed to look for specific antivirus and virtual machine software to shut down to evade detection, but works for only one type at the moment.

“It is unclear at present whether this is a reflection of the malware still being in a relatively early stage of development/testing or a straightforward error on the part of the developers,” the researchers said in a blog post.

Under normal circumstances a good firewall would detect and prevent the DNS exfiltration, according to the researchers. “Also, thoughtful patching and administration practices would stop the unusual service pack being installed,” they said.

The transmission of stolen payment card data will result in unusual patterns of activity on the machines, which means businesses can detect this kind of attack by identifying and reacting to unusual DNS traffic patterns.

Despite the fact that the malware has faulty evasion code and leaves unnecessary trails by using data files written to disk instead of working predominantly in memory, the researchers said UDPOS is “genuinely unusual”, although not unique, in its use of DNS-based communication, and can be “quite effective” they warn.

“Nearly all companies have firewalls and other protections in place to monitor and filter TCP- and UDP-based communications, however DNS is still often treated differently, providing a golden opportunity to leak data,” the researchers said, meaning that detection rates for the malware are still very low.

“Visibility is always an issue when it comes to non-traditional malware. Samples which do not target standard endpoints or servers can quite easily be missed because of the lack of focus on protecting these sorts of systems,” the researchers said.