The document discusses protecting points of sale (POS) systems from threats. It describes how payment data is processed through various systems and can be vulnerable during these transitions. It also discusses challenges like memory scraping attacks and proposes solutions like secure memory handling, anomaly detection, and runtime application self-protection. The document cautions that non-technical measures like policies and user education are also important parts of a comprehensive security strategy.

1. $-RXUQH7R
3URWHFW3RLQWV
2I6DOH
Nir Valtman, CISSP
: ZZZYDOWPDQRUJ
#9DOWPD1LU

2. Introduction
3KRWRE%LOO)UDVHU

3. ,¶PDQDUFKLWHFW

4. Zombies!!!

5. Defacement

6. OPEN SOURCE
AntiDef
Secure TDD
Memory Scraper

7. Why Points Of Sale
Targeted?

8. Deployment

9. IS NOT V
Point Of Sale Payment Application

10. Store Payment Processor’s
RAM
DB
POS Payment
Processing
Host
PA Server
Data Center
PA Client
RAM
DB

11. :KHUH$UH0UHGLWDUGV
5HVW 7UDQVLW 0HPRU
Store Payment Processor’s
RAM
DB
POS Payment
Processing
Host
PA Server
Data Center
PA Client
RAM
DB

12. :KHUH$UH0UHGLWDUGV
5HVW 7UDQVLW 0HPRU
Mobile App Presentation Server Application Payment Server Payment Processor’s Data Center

14. Token Server
UHGLW
DUGV
Mobile App Presentation Server Application Payment Server Payment Processor’s Data Center

15. Retail
Environment
Assumptions
100% PCI Compliant

16. Retail
Environment
Assumptions

17. Retail
Environment
Assumptions

18. Retail
Environment
Assumptions
Not
vulnerable

19. Retail
Environment
Assumptions

20. Retail
Environment
Assumptions
Cashier ≠ hacker

21. Retail
Environment
Assumptions
Big Brother

22. RATs

23. Remote
Administration
Tools

24. Routing

26. Threats

27. 5($' :5,7(

28. ,$0%2%
0(722

29. 3DPHQW6WDJHV $XWKRUL]DWLRQ
Transmit Track1/2
PA
Route Track1/2 Transmit Track1/2
Gateway Issuer
Processor
Acquirer
POI
'LIILFXOW
([SORLWDWLRQ

30. 3DPHQW6WDJHV $XWKRUL]DWLRQ

31. 3DPHQW6WDJHV 6HWWOHPHQW
Store Send PANs Transmit Settlement
Gateway Issuer
'LIILFXOW
([SORLWDWLRQ
Processor Acquirer
PA Server
Credit Merchant’s Account

32. 3DPHQW6WDJHV 6HWWOHPHQW

33. 0HPRU6FUDSLQJ
'HPR

34. Online VS Offline

35. Bypassed Solutions

36. SecureString Class
Demo

37. 1H[W 1H[W 11HH[[WW*1HHQ[WHUDWLRQ )LUHZDOO

38. ANTI

39. :KLWHOLVW
0' 6+$

40. Correct Solutions

41. Cyber
Intelligence

42. ,KDYHDFFHVVWR326WHUPLQDOVLQWKH86
ZKDWLVWKHEHVWPDOZDUH,VKRXOGXVH

43. RXQHHGWRLQIHFWWKHILUPZDUHRIWKHWHUPLQDO
%GRLQJWKDWRXFDQJHWIXOOWUDFN
EXWWKH3,1ZLOOEHKDVKHG

44. 6HOOLQJPDOLFLRXVILUPZDUHIRU9HULIRQH¶V 326WHUPLQDOV
/HDNVGXPSV3,1VWKURXJK*356
3ULFH2QO

45. %XVLQHVV'HYHORSPHQW2IIHU
2ZQHURIDIDNH326VHOOVKLVWHUPLQDO
3ULFHIURPUHYHQXHVKDULQJ

46. 5),KDQJHWHUPLQDOFRQILJXUDWLRQWRUHTXLUH3,1IRUDOOFDUGV
DXVH*HWRQOGDWDEXWZDQWV3,1V
3URSRVHG6ROXWLRQ
7KHUPDO,PDJHU

47. Sandbox

48. Network-based
Anomaly Detection

49. Operating System
Anomaly Detection

50. Runtime Obfuscation

51. Not only products required

52. 3HUIRUPDQFH 6HFXULW

53. Assembly
Signing

54. Assembly Obfuscation

55. PROCESS ISOLATION

56. ? ?
?
?
?
What Next
?
?
? ?
?
?
?
?
? ?

57. :KDW:RXOGRX6WHDO
%,3%,3

58. 0HPRU
6FUDSLQJ

59. 0HPRU
6FUDSLQJ
Cashier = hacker

60. 0HPRU
6FUDSLQJ

61. Summary

62. 0HPRU
6FUDSLQJ
6HFXULWE2EVFXULW

63. 0HPRU
6FUDSLQJ
6LPSOH([SORLWDWLRQ

64. 0HPRU
6FUDSLQJ
+DUGWR3URWHFW

65. 0HPRU
6FUDSLQJ
RX¶UH,QVXUHG

66. Nir Valtman
: ZZZYDOWPDQRUJ
#9DOWPD1LU