Watch an overview of the Backoff malware that exhibits highly evasive characteristics. Engin Kirda, Ph.D., Co-Founder and Chief Architect at Lastline, gives a background on Backoff and an introduction into the concept of evasive malware. Backoff PoS Malware is interesting because: ° Over 1000 business have been affected according to the Secret Service ° Used in numerous high profile breaches in the past year ° Targets point-of-sale systems ° Exhibits highly evasive behaviors intended to bypass detection Detect Advanced and Evasive Malware in Your Network: http://landing.lastline.com/request-lastline-trial

1. Backoff My Point-of-Sale Data!
Profiling the Backoff PoS Malware Affecting Retailers
Engin Kirda
Ph.D., Co-Founder & Chief Architect, Lastline
www.lastline.com

2. What is Backoff?
• Malware used in numerous breaches in the last year
• Secret Service currently estimates 1,000+ U.S. businesses affected
• Targeted to PoS systems
• Evades analysis
Copyright ©2014 Lastline, Inc. All rights reserved. 2

3. Recent and Notable Retail/Payments Breaches
• The last year has seen a dramatic escalation in the number of
breached PoS systems
• Many of these PoS payloads, like Backoff, evaded installed
defenses and alarms
Copyright ©2014 Lastline, Inc. All rights reserved. 3

4. What is Backoff?
[1 Slide Summary from Kyle]
• Product screenshot?
• Mention evasive behaviors exhibited
Copyright ©2014 Lastline, Inc. All rights reserved. 4

5. What is Backoff?
• Timing evasion (an anti-VM technique)
• Utilizes code obfuscation
• Also uses rare and poorly emulated instructions to defeat simple
emulators
• Attempts to encrypt parts of the command and control traffic
Copyright ©2014 Lastline, Inc. All rights reserved. 5

6. How are the attackers deploying it?
• Scan for Internet facing Remote Desktop applications
• Brute force login credentials
• Often successfully find administrative credentials
• Use admin credentials to deploy Backoff to remote PoS systems
Copyright ©2014 Lastline, Inc. All rights reserved. 6

7. Understanding Evasive Malware
Malware authors are not stupid
• they got the news that sandboxes are all the rage now
• since the code is executed, malware authors have options
Evasion defined
• Develop code that exhibits no malicious behavior in a traditional
sandbox, but still infects the intended target
• Can be achieved in a variety of ways…
Copyright ©2014 Lastline, Inc. All rights reserved. 7

8. 8
The Evasive Malware Problem
Current solutions fail to protect organizations from sophisticated, targeted attacks.
Copyright ©2014 Lastline, Inc. All rights reserved.

9. Lastline Labs AV Vendor Review
Antivirus systems take months to catch up to highly evasive threats.
Copyright ©2014 Lastline, Inc. All rights reserved. 9

10. 3 Ways to Build a Sandbox
Not all sandbox solutions can detect highly evasive malware.
Copyright ©2014 Lastline, Inc. All rights reserved. 10

11. Virtualized Sandboxing vs. Full System Emulation
Even APT Solutions with virtualized sandboxing fail to detect highly evasive malware.
Copyright ©2014 Lastline, Inc. All rights reserved. 11

12. Securing Your Organization
• At PoS: Accept EMV payments to limit exposure in case of a breach
• At PoS: E2E encryption of transaction (POI never has cleartext)
• Detect and protect against malware and C&C
• Full system emulation approach with Lastline
Copyright ©2014 Lastline, Inc. All rights reserved. 12

13. Detect Evasive Malware in Your Network
Start your 30-day Lastline trial: http://landing.lastline.com/request-lastline-trial
“I would highly recommend
Lastline to any company that
is entrusted with customer
data. Retailers, restaurants,
or any organization that is
interested in elevating their
handling and protection of
data could benefit from
working with Lastline.”
Tom Lindblom
CTO, CKE Restaurants
Copyright ©2014 Lastline, Inc. All rights reserved. 13

14. Thank You!
For more information visit www.lastline.com
or contact us at info@lastline.com.