Fast-evolving Prilex POS malware can block contactless payments

The reasons businesses and consumers for illustration contactless costs transactions – precocious information and velocity – are what make those systems bad for cybercriminals.

If miscreants want to get backmost to stealing information and committing fraud, they request to find a measurement to unit transactions distant from tap-to-pay systems for illustration Apple Pay and Google Pay and get group putting their in installments cards backmost into nan point-of-sale (POS) PIN devices.

According to Kaspersky researchers, that's what nan Brazilian operators down nan Prilex POS malware person done.

Kaspersky discovered 2 caller Prilex variants successful early 2022 and recovered a 3rd successful November that tin target NFC-enabled in installments cards and artifact contactless transactions, forcing payers complete to nan less-secure PIN machines.

"The extremity present is to unit nan unfortunate to usage their beingness paper by inserting it into nan PIN pad reader, truthful nan malware will beryllium capable to seizure nan information coming from nan transaction," nan researchers constitute successful a report published this week.

The malware's caller capabilities build connected those that already make Prelix nan astir precocious POS threat, they add. It has a unsocial cryptographic strategy and tin spot target package successful existent time, unit protocol downgrades, tally GHOST transactions, and tally in installments paper fraud, including connected nan astir blase CHIP and PIN technologies.

Once nan purchaser puts nan in installments paper into nan PIN machine, each those techniques tin spell into action.

Prelix started disconnected successful 2014 targeting ATMs and wrong a mates of twelvemonth brought POS systems into nan mix. Yet contactless payments made stealing information from victims overmuch much difficult and nan take of nan instrumentality accelerated during nan pandemic, erstwhile group became much wary of handling cash.

The tap-to-pay strategy activates nan card's RFID chip, which sends a unsocial ID number and transaction to nan terminal, neither of which tin beryllium utilized again. There is thing for a cybercriminal to steal.

"Contactless in installments cards connection a convenient and unafraid measurement to make payments without nan request to physically insert aliases swipe nan card," nan researchers wrote. "But what happens if a threat tin disable these payments successful nan EFT [electronic money transfer] moving successful nan machine and unit you to insert nan paper successful nan PINpad reader?"

Doing a deeper dive into nan past of nan 3 Prilex variants found, nan researchers said nan malware includes a rule-based record that determines whether to seizure in installments paper accusation that besides includes an action to artifact NFC-based transactions.

• Payment terminal malware steals $3.3m worthy of in installments paper numbers – truthful far
• UK arrests 5 for trading 'dodgy' constituent of waste software
• GPT-4 could popular up successful Bing, arsenic Google races to build chatbot hunt products
• The wages of misdeed aren't that awesome if you're a developer choosing nan acheronian side

When Prilex detects and blocks a contactless transaction, nan EFT package will person nan PIN strategy show an correction connection that sounds "Contactless error, insert your card."

It besides tin select in installments cards by conception and create different rules for each segment.

"For example, these rules tin artifact NFC and seizure paper information only if nan paper is simply a Black/Infinite, Corporate aliases different tier pinch a precocious transaction limit, which is overmuch much charismatic than modular in installments cards pinch a debased balance/limit," nan researchers wrote.

All this is simply a triumph for miscreants targeting POS systems while trying to find their measurement successful this progressively contactless world.

"While nan group is looking for a measurement to perpetrate fraud pinch unsocial in installments paper numbers, this clever instrumentality allows it to proceed operating," they wrote. ®