Home Depot Inc. confirmed Monday that its payment systems were breached at nearly 2,200 U.S. and Canadian stores in a cyberattack that may have stretched back to April. 
 
 The company said it is working aggressively to root out the malware that infected its data systems and protect its customer data, but stopped short of addressing when or whether... ||||| We recently spotted a brand new BlackPOS (point-of-sale) malware detected by Trend Micro as TSPY_MEMLOG.A. In 2012, the source code of BlackPOS was leaked, enabling other cybercriminals and attackers to enhance its code. What’s interesting about TSPY_MEMLOG.A is it disguises itself as an installed service of known AV vendor software to avoid being detected and consequently, deleted in the infected PoS systems. This routine is different from previous PoS malware such as TSPY_POCARDL.U and TSPY_POCARDL.AB (BlackPOS) that employed the targeted company’s own installed service. 
 
 The malware can be run with options: -[start|stop|install|uninstall]. The –install option installs the malware with service name =<AV_Company> Framework Management Instrumentation, and the –uninstall option deletes the said service. The RAM scraping routine begins as a thread when the installed service starts. It may only start its main routine if it has successfully been registered as a service. 
 
 Apart from masquerading itself as an AV software service, another new tactic of TSPY_MEMLOG.A is its updated process iteration function. It uses CreateToolhelp32Snapshot API call to list and iterate all running processes. BlackPOS variants typically use the EnumProcesses API call to list and iterate over the processes. 
 
 It drops and opens a component t.bat after it has read and matched the track data. This track data is where the information necessary to carry out card transactions is located; on the card this is stored either on the magnetic stripe or embedded chip. 
 
 The data will eventually get written out to a file called McTrayErrorLogging.dll. This is similar to what happened in the PoS malware attack involving the retail store, Target last December 2013. 
 
 Figure 1. CreateToolhelp32Snapshot to enumerate processes 
 
 Based on our analysis, this PoS malware uses a new custom search routine to check the RAM for Track data. These custom search routines have replaced the regex search in newer PoS malware. It samples 0x20000h bytes [the 0x and h implies hex bytes] in each pass, and continues scanning till it has scanned the entire memory region of the process being inspected. 
 
 Figure 2. Screenshot of reading process memory 
 
 Figure 3. Logging of data 
 
 It has an exclusion list that functions to ignore certain processes where track data is not found. It gathers track data by scanning the memory of the all running processes except for the following: 
 
 smss.exe 
 
 csrss.exe 
 
 wininit.exe 
 
 services.exe 
 
 lsass.exe 
 
 svchost.exe 
 
 winlogon.exe 
 
 sched.exe 
 
 spoolsv.exe 
 
 System 
 
 conhost.exe 
 
 ctfmon.exe 
 
 wmiprvse.exe 
 
 mdm.exe 
 
 taskmgr.exe 
 
 explorer.exe 
 
 RegSrvc.exe 
 
 firefox.exe 
 
 chrome.exe 
 
 This skipping of scanning specific processes is similar to VSkimmer (detected as BKDR_HESETOX.CC). 
 
 In TSPY_MEMLOG.A, the grabbed credit card Track data from memory is saved into a file McTrayErrorLogging.dll and sent to a shared location within the same network. We’ve seen this routine with another BlackPOS/Kaptoxa detected as TSPY_POCARDL.AB. However, the only difference is that TSPY_MEMLOG.A uses a batch file for moving the gathered data within the shared network while TSPY_POCARDL.AB executes the net command via cmd.exe. It is highly possible that the server is compromised since the malware uses a specific username for logging into the domain. 
 
 Data Exfiltration Mechanism 
 
 The malware drops the component t.bat which is responsible for transferring the data from McTrayErrorLogging.dll to a specific location in the network, t:\temp\dotnet\NDP45-KB2737084-x86.exe. It uses the following command to transfer the gathered data: 
 
 Figure 4. Screenshot of command used to transfer data 
 
 The “net use” command was used to connect from one machine to another machine’s drive. It uses a specific username to login to the domain above (IP address). It will open device t: on 10.44.2.153 drive D. 
 
 In one the biggest data breach we’ve seen in 2013, the cybercriminals behind it, offloaded the gathered data to a compromised server first while a different malware running on the compromised server uploaded it to the FTP. We surmise that this new BlackPOS malware uses the same exfiltration tactic. 
 
 Countermeasures 
 
 PoS malware can possibly arrive on the affected network via the following means: 
 
 Targeting specific servers by point of entry and lateral movement 
 
 Hacking network communication 
 
 Infect machine before deployment 
 
 As such, we recommend enterprises and large organizations implement a multi-layered security solution to ensure that their network is protected against vulnerabilities existing in systems and applications as this may be used to infiltrate the network. In addition, check also when a system component has been modified or changed as criminals are using known in-house software applications to hide their tracks. IT administrators can use the information on malware routines and indicators of compromise (IoCs) here to determine if their network has been compromised already by this new BlackPOS malware. For more information on PoS malware, read our white paper, Point-of-Sale System Breaches: Threats to the Retail and Hospitality Industries. 
 
 Trend Micro protects enterprises from threats like PoS malware by detecting the malicious file. 
 
 The related hash to this threat is b57c5b49dab6bbd9f4c464d396414685. 
 
 With additional analysis from Numaan Huq 
 
 Update as of 9:44 AM, September 8, 2014 
 
 During the course of our investigation, we spotted the following anti-American messages embedded in the binary: 
 
 Figure 5. Screenshot of the messages embedded in the binary 
 
 (Click image above to enlarge) 
 
 Note that these are not used anywhere in the code and we surmise that these may be like a signature used by the group developing this malware. 
 
 Update as of 2:27 PM, September 11, 2014 
 
 Even though BlackPOS ver2 has an entirely different code compared to the BlackPOS which compromised Target, it duplicates the data exfiltration technique used by the Target BlackPOS. It is an improved clone of the original, which is why we decided to call this BlackPOS ver2. 
 
 It is also being reported in the press that some security vendors called this malware as “FrameworkPOS.” This is a play of the service name <AV_Company> Framework Management Instrumentation with which the malware installs itself. ||||| By Michael Kanell 
 
 The Atlanta Journal-Constitution 
 
 The Home Depot has confirmed that its payment systems were breached by data thieves, potentially victimizing many customers throughout the United States and Canada. 
 
 However, the company promised Monday that no one will have to pay for “fraudulent” charges. 
 
 Officials of the Atlanta-based giant would not estimate how many customer accounts might have been subject to the data attack. And while the investigation reaches back as far as April, the company did not say how long cyber-criminals had access to Home Depot systems. 
 
 A cyber-security expert reported earlier Monday that the Home Depot data breach had been carried out with the same “malware” used previous by cyber-thieves to pilfer consumer data from Target. 
 
 At least some of Home Depot’s store registers were infected with a variation of something called BlackPOS or Kaptoxa, software designed to steal data from credit and debit cards when they are swiped through register systems running Microsoft Windows, according to Brian Krebs, who writes about data security. 
 
 That similarity of software “adds another indicator that those responsible for the as-yet unconfirmed breach at Home Depot also were involved in the December 2013 attack on Target that exposed 40 million customer debit and credit card accounts,” Krebs wrote on his web site. 
 
 BlackPOS was found on the Target systems at Target last year. 
 
 Krebs wrote Monday that the new information came from sources close to the investigation of the Home Depot data breach. ||||| The apparent credit and debit card breach uncovered last week at Home Depot was aided in part by a new variant of the malicious software program that stole card account data from cash registers at Target last December, according to sources close to the investigation. 
 
 On Tuesday, KrebsOnSecurity broke the news that Home Depot was working with law enforcement to investigate “unusual activity” after multiple banks said they’d traced a pattern of card fraud back to debit and credit cards that had all been used at Home Depot locations since May of this year. 
 
 A source close to the investigation told this author that an analysis revealed at least some of Home Depot’s store registers had been infected with a new variant of “BlackPOS” (a.k.a. “Kaptoxa”), a malware strain designed to siphon data from cards when they are swiped at infected point-of-sale systems running Microsoft Windows. 
 
 The information on the malware adds another indicator that those responsible for the as-yet unconfirmed breach at Home Depot also were involved in the December 2013 attack on Target that exposed 40 million customer debit and credit card accounts. BlackPOS also was found on point-of-sale systems at Target last year. What’s more, cards apparently stolen from Home Depot shoppers first turned up for sale on Rescator[dot]cc, the same underground cybercrime shop that sold millions of cards stolen in the Target attack. 
 
 Clues buried within this newer version of BlackPOS support the theory put forth by multiple banks that the Home Depot breach may involve compromised store transactions going back at least several months. In addition, the cybercrime shop Rescator over the past few days pushed out nine more large batches of stolen cards onto his shop, all under the same “American Sanctions” label assigned to the first two batches of cards that originally tipped off banks to a pattern of card fraud that traced back to Home Depot. Likewise, the cards lifted from Target were sold in several dozen batches released over a period of three months on Rescator’s shop. 
 
 POWERFUL ENEMIES 
 
 The tip from a source about BlackPOS infections found at Home Depot comes amid reports from several security firms about the discovery of a new version of BlackPOS. On Aug. 29, Trend Micro published a blog post stating that it had identified a brand new variant of BlackPOS in the wild that was targeting retail accounts. Trend said the updated version, which it first spotted on Aug. 22, sports a few notable new features, including an enhanced capability to capture card data from the physical memory of infected point-of-sale devices. Trend said the new version also has a feature that disguises the malware as a component of the antivirus product running on the system. 
 
 Trend notes that the new BlackPOS variant uses a similar method to offload stolen card data as the version used in the attack on Target. 
 
 “In one the biggest data breach[es] we’ve seen in 2013, the cybercriminals behind it offloaded the gathered data to a compromised server first while a different malware running on the compromised server uploaded it to the FTP,” wrote Trend’s Rhena Inocencio. “We surmise that this new BlackPOS malware uses the same exfiltration tactic.” 
 
 An Internet search on the unique malware “hash” signature noted in Trend’s malware writeup indicates that the new BlackPOS verison was created on June 22, 2014, and that as late as Aug. 15, 2014 only one of more than two-dozen anti-malware tools (McAfee) detected it as malicious. 
 
 ANTI-AMERICAN MALWARE 
 
 Other clues in the new BlackPOS malware variant further suggest a link between the cybercrooks behind the apparent breach at Home Depot and the hackers who hit Target. The new BlackPOS variant includes several interesting text strings. Among those are five links to Web sites featuring content about America’s role in foreign conflicts, particularly in Libya and Ukraine. 
 
 Three of the links point to news, editorial articles and cartoons that accuse the United States of fomenting war and unrest in the name of Democracy in Ukraine, Syria, Egypt and Libya. One of the images shows four Molotov cocktails with the flags of those four nations on the bottles, next to a box of matches festooned with the American flag and match ready to strike. Another link leads to an image of the current armed conflict in Ukraine between Ukrainian forces and pro-Russian separatists. 
 
 This is interesting given what we know about Rescator, the individual principally responsible for running the store that is selling all of these stolen credit and debit cards. In the wake of the Target breach, I traced a long list of clues from Rescator’s various online identities back to a young programmer in Odessa, Ukraine. In his many personas, Rescator identified himself as a member of the Lampeduza cybercrime forum, and indeed this site is where he alerts customers about new batches of stolen cards. 
 
 As I discovered in my profile of Rescator, he and his crew seemed somewhat taken with the late despotic Libyan leader Muammar Gaddafi, although they prefer the phonetic spelling of his name. The Web site kaddafi[dot]hk was among four main carding shops run by Rescator’s crew (it has since been retired and merged with Rescator[dot]cc). The domain kaddafi[dot]me was set up to serve as an instant message Jabber server for cybercrooks, advertising its lack of logging and record keeping as a reason crooks should trust kaddafi[dot]me to handle their private online communications. 
 
 When I reached out to Rescator last December to obtain comment about my findings on his apparent role in the Target break-in, I received an instant message reply from the Jabber address “kaddafi@kaddafi[dot]me” (in that conversation, the person chatting with me from that address offered to pay me $10,000 if I did not run that story; I declined). But I also discovered that the kaddafi[dot]me domain was a blog of sorts that hosted some harsh and frankly chilling anti-American propaganda. 
 
 The entire three-part manifesto posted on the kaddafi[dot]me home page is no longer available, but a professionally translated snippet of this tirade reads: 
 
 “The movement of our Republic, the ideology of Lampeduza – is the opposition to Western countries, primarily targeting the restoration of the balance of forces in the world. After the collapse of the USSR, we have lost this fragile equilibrium face of the planet. We – the Senate and the top people of the Republic are not just fighting for survival and our place under the sun, we are driven by the idea! The idea, which is ​​living in all of us – to return all that was stolen and taken from our friendly countries grain by grain! We are fighting for a good cause! Hot blood is flowing in us, in citizens, who want to change situation in the world. We do not bend to other people’s opinions and desires, and give an adequate response to the Western globalism. It is essential to be a fighter for justice! Perhaps we would be living completely differently now, if there had not been the plan of Allen Dulles, and if America had not invested billions in the collapse of the USSR. We were deprived of a common homeland, but not deprived of unity, have found our borders, and are even closer to each other. We saw the obvious principles of capitalism, where man to a man is a wolf [[see here for more context on this metaphor]]. Together, we can do a lot to bring back all the things that we have been deprived of because of America! We will be heard! Citizens of Lampeduza – “free painters” ready to create and live the idea for the good of the Motherland — let’s first bend them over, and then insert deeper!!! 
 
 Tags: American Sanctions, BlackPOS, Home Depot breach, home depot databreach, Kaptoxa, Muammar Gaddafi, point-of-sale malware, rescator, Rhena Onocencio, target data breach, trend micro
– Home Depot admitted today that hackers really did breach the company's payment systems in US and Canadian stores and may have been breaking in since April, the Wall Street Journal reports. The Atlanta-based home-improvement chain said it investigated the hack with banks, law enforcement, and tech security companies like Symantec. The company promised that no customers would end up paying "fraudulent" charges, but it didn't say how many accounts were hacked or how long the hackers had access to the system, the Atlanta-Journal Constitution reports. Krebs on Security, which broke both the hack and the probe results, reports that the same hackers who got their hands on 40 million Target customer accounts last year may have struck Home Depot. They used a variation of the same software, BlackPOS (or "Kaptoxa"), which was invented by a Russian teenager two years ago. What's more, Home Depot customer card numbers have already shown up on the black-market cybercrime website Rescator.cc, where millions of cards from the Target hack were sold. Designed to breach point-of-sale systems that use Windows, BlackPOS can disguise itself as part of the system's antivirus software, reports Trend Micro.