New POS Malware Steals Data via DNS Traffic

ronjor · Feb 8, 2018

Jai Vijayan 2/8/2018

UDPoS is disguised to appear like a LogMeIn service pack, Forcepoint says.
Click to expand...

guest · Jul 1, 2020

Windows POS malware uses DNS to smuggle stolen credit cards
July 1, 2020
https://www.bleepingcomputer.com/ne...ware-uses-dns-to-smuggle-stolen-credit-cards/

A Windows Point-of-Sale (POS) malware has been discovered using the DNS protocol to smuggle stolen credit cards to a remote server under attacker's control.
Alina POS malware uses DNS to evade detection
When securing POS systems, it is common to lock them down so that they can only connect to specific protocols that are needed. In many cases, these restrictions include locking down the HTTP protocol so that POS systems can't connect to web servers.

However, the DNS protocol is not commonly blocked as it is required for a variety of Windows services and the general operation of a machine.
Knowing this, the Alina POS malware has added the ability to use encoded DNS requests to communicate with its command and control server.
Click to expand...

"The theft was discovered after one of Black Lotus Labs' machine-learning models flagged unusual queries to a specific domain in April 2020. Rigorous research determined that the Alina POS malware was utilizing Domain Name System (DNS) – the function that converts a website name into an IP address – as the outbound communication channel through which the stolen data was exfiltrated," the report stated.
Click to expand...

drhu22 · Jul 1, 2020

Would secure dns providers like quad9 protect against this?

Log in or Sign up

New POS Malware Steals Data via DNS Traffic

ronjor Global Moderator

guest Guest

drhu22 Registered Member

Log in or Sign up

New POS Malware Steals Data via DNS Traffic

ronjor Global Moderator

guest Guest

drhu22 Registered Member

Useful Searches