Malware
malware:tiny_pos
Point-of-sale malware family from which the newly uncovered card-scraping malware variant was derived.
Point-of-sale malware family from which the newly uncovered card-scraping malware variant was derived.
“it’s a derivative of Tiny POS”
“there’s a Tiny POS piece of malware”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | USES | Memory scraping | Explicit | 15 |
| outgoing | USES | XOR | Explicit | 15 |
| outgoing | AFFECTS | Point-of-sale registers | Explicit | 15 |
| outgoing | AFFECTS | Back-of-house systems | Explicit | 15 |
| outgoing | AFFECTS | SQL servers | Explicit | 15 |
| outgoing | USES | Data exfiltration | Explicit | 15 |
| incoming | INVOLVES | Retail credit-card breach | Explicit | 15 |
Retail credit-card breach INVOLVES Tiny POS
The newly uncovered card-scraping malware was described as a derivative of the Tiny POS malware family.
Explicit Confidence 96% · Matt Bromiley EP 15 Details
“it’s an unknown variant but it’s a derivative of Tiny POS”
Tiny POS USES Memory scraping
The card-scraping malware scraped payment-card data from memory.
Explicit Confidence 99% · Courtney Dayter EP 15 Details
“The way that they were scraping cards were – they were scraping from memory.”
The malware’s output files were encrypted using XOR.
Explicit Confidence 99% · Jack Rhysider EP 15 Details
“The output files were encrypted using XOR”
Tiny POS AFFECTS Point-of-sale registers
The malware ran on point-of-sale registers and captured card data processed there.
Explicit Confidence 99% · Jack Rhysider EP 15 Details
“Malware that exists on twelve hundred computers that are cash registers”
“the malware was grabbing every credit card that was swiped on that register”
Tiny POS AFFECTS Back-of-house systems
The malware also ran on back-of-house systems and scraped data there.
Explicit Confidence 99% · Matt Bromiley EP 15 Details
“The other twenty percent was the back of house systems as well”
“Those systems were also – also had data that was being scraped in them, too.”
Tiny POS AFFECTS SQL servers
The malware captured historical unencrypted track data loaded into SQL-server memory.
Explicit Confidence 98% · Matt Bromiley EP 15 Details
“The back of house systems were running SQL servers.”
“The SQL servers had historical unencrypted tracked data that was being loaded into memory and the malware was picking that up.”
Tiny POS USES Data exfiltration
The malware pushed scraped data over the network to central repository or clearing-house systems.
Explicit Confidence 98% · Matt Bromiley EP 15 Details
“it pushes that data over the wire to the central repository system”
“Malware was directly writing over the wire right to these systems”