These Guys Battled BlackPOS at a Retailer
Summary: Security consultants Tom Arnold and Paul Guthrie of PSC described working a retail breach in early 2013 that involved a BlackPOS variant, which used an inter-process communications hook to capture only card track data from the POS process rather than scraping general memory. They said the malware had worm-like behavior, elected an infected machine as an exfiltration point, encrypted stolen data with RSA-512 and again at the aggregation server, and that the only outbound protocol allowed at that client was DNS, which they never resolved as the egress path before the engagement ended.
What you should know: The attackers double-encrypted card data so intrusion detection and data loss prevention saw nothing, and the defenders never determined how the data left the network - a gap that leaves the exfiltration channel unknown even after the intrusion is found.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026