“Dexter” malware steals credit card data from point-of-sale terminals
Enlarge / Administration panel for Dexter, a malicious application that steals credit card data from point-of-sale systems. The malware was recently found on hundreds of computers around the world. — Seculert
Context & Ripple Effects
Card-data theft has been migrating from hardware to software since Sophos documented skimming malware targeting ATMs back in March 2009. Dexter extends that lineage to merchant point-of-sale terminals: Seculert reports finding it on hundreds of machines worldwide, complete with an administration panel for exfiltrating stolen card data.
The disclosure lands five months after Seculert's July 2012 discovery of Madi, the espionage-themed malware aimed at Middle Eastern organizations — evidence the Israeli firm's research team is tracking both state-style spying and criminal cash-out operations. Pickup across Computerworld, darkREADING, Help Net Security and others shows how quickly the security press treated PoS malware as a category worth watching.
First-order effects
- Merchants running infected terminals are exposing customer credit card data at the moment of swipe, with hundreds of compromised machines already identified by Seculert's researchers.
Second-order effects
- Payment processors and issuing banks absorb the downstream fraud losses from harvested cards, while unaffected retailers face pressure to audit their own PoS estates for similar implants.
Third-order effects
- If the pattern holds, skimming shifts decisively from physical ATM hardware to software resident on merchant PoS systems, managed as botnets with command panels rather than one-off infections.
The trend: Credit card skimming is evolving from tampered ATMs into centrally administered malware botnets planted on merchant point-of-sale terminals.