PUNCHBUGGY Knocks Out POS Systems of 100 Companies and Steals Data

Some North American companies found out what a zero-day vulnerability means first hand beginning in March. Security company FireEye is reporting that more than 100 companies were victims of hackers operating large scale attacks “at a rapid pace, displaying a level of operational awareness and ability to adapt their operations on the fly.”

The vulnerability, which was partially patched in April targets point-of-sale (POS) payment card systems. Multi-stage attacks were launched using spear-phishing tactics, which are a type of phishing that tailors messages to targets who have specific knowledge or credentials that the attacker seeks. In this case, the attackers used individually tailored messages, which demonstrates the sophistication and maturity of the person or group conducting these attacks. Inside the spear-phishing email messages are attachments that are embedded with macros that will download and execute a malicious downloader that is being referred to as PUNCHBUGGY. The downloader may obtain additional code from an HTTPS connection and ultimately use an elevation of privilege exploit and a memory-scraping tool that the researchers are calling PUNCHTRACK. The data being stolen is both Track 1 and Track 2 data.

It is recommended that systems administrators apply the latest Windows updates that address this vulnerability (CVE-2016-0167). As a precautionary measure, macros should be disabled in Microsoft Office by default and users should be instructed not to enable them, except on a case-by-case basis and when it is without any doubt a legitimate need.

Many companies have been slow to fully implement the chip-and-PIN technology for payment cards for various reasons and attackers are taking advantage of that now. They know that the magnetic strip card systems are still vulnerable to malware. Therefore, ensure you always have a process in place to apply critical and security patches as soon as they are available.