Saturday, May 18, 2024

POS Malware Breach at Sonic Affected Millions of Credit & Debit Cards

Sonic American’s Drive-In, a Pos malware affecting fast-food chain in U.S that operates around 3500 locations across the country.

This breach affecting an unknown number of store payment systems and stolen Credit & Debit cards details are fired to underground online shops over a week for sales.

Oklahoma City-based Sonic hits the breach at the initial level, multiple financial institutions noticed fraudulent transactions on cards that had all previously been used at Sonic.The card breach publicly reported on September 26.

Also Read Biggest Hack Ever – Each and Every Single Yahoo Account Was Hacked in 2013 Data Breach

Illicit shop in online, known as Joker’s Stash, reportedly had been selling the cards under the batch name FireTigerrr since on September 26.

Christi Woodworth, vice president of public relations at Sonic, said the investigation is still in its early stages, and the company not sure which of its stores may be impacted.

Accounts were stolen from sonic of a batch of cards that Joker’s Stash is calling as “Firetigerrr”, and they are indexed by city, state and ZIP code which allows buyers to purchase cards geographical.

Dumps of card data stolen from the magnetic stripe of the compromised card and subsequently used for cloning the data onto blank plastic cards.Prices for the cards advertised in the Firetigerr.

Above shown capture from Jokers’ Stash showing cards for sale

Most of the cards range in price from $25 to $50, and the price is influenced by type of card issued (Amex, Visa, MasterCard, etc); the card’s level (classic, standard, signature, platinum, etc.); whether the card is debit or credit; and the issuing bank.

Card Breaches On Point of Sale(POS Malware):

Pos Malware is operated by actors ranging from fraudsters to Organized Crime Groups.Most POS malware codes are RAM scrapers that make their way into the target endpoint, focus on reading unencrypted card data in the random access memory (RAM) zone and steal data amassed through the days and weeks of the breach.

One of the most recent POS malware is MajikPOS. Attackers begin by penetrating the target organization’s systems to reach POS endpoints. Usually connected to the endpoint using remote access, either one that’s already installed or one they activate, such as virtual network connection (VNC) or remote desktop protocol (RDP) access.

The connection can be made by stealing or guessing the password.After gaining access, the attackers install the POS malware on the endpoint. From there, the malware executes and continually sends out the stolen data to the attacker’s server.

The United States is the last of the G20 nations to make the shift to more secure chip-based cards, chip-based cards are more expensive and difficult for cybercriminals to counterfeit.

But many financial institutions still not replacing traditional magnetic stripe cards with chip-based cards. According to Visa, 58 percent of the more than 421 million Visa cards issued by U.S. financial institutions were chip-based as of March 2017.


Latest articles

Norway Recommends Replacing SSLVPN/WebVPN to Stop Cyber Attacks

A very important message from the Norwegian National Cyber Security Centre (NCSC) says that...

New Linux Backdoor Attacking Linux Users Via Installation Packages

Linux is widely used in numerous servers, cloud infrastructure, and Internet of Things devices,...

ViperSoftX Malware Uses Deep Learning Model To Execute Commands

ViperSoftX malware, known for stealing cryptocurrency information, now leverages Tesseract, an open-source OCR engine,...

Santander Data Breach: Hackers Accessed Company Database

Santander has confirmed that there was a major data breach that affected its workers...

U.S. Govt Announces Rewards up to $5 Million for North Korean IT Workers

The U.S. government has offered a prize of up to $5 million for information...

Russian APT Hackers Attacking Critical Infrastructure

Russia leverages a mix of state-backed Advanced Persistent Threat (APT) groups and financially motivated...

Millions Of IoT Devices Vulnerable To Attacks Leads To Full Takeover

Researchers discovered four significant vulnerabilities in the ThroughTek Kalay Platform, which powers 100 million...

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles