Well-developed backdoor can harvest information from restaurants, bars and hotels, researchers say

A point-of-sale-system widely used in the hospitality industry is vulnerable to a backdoor, ESET reports.

Restaurants, bars and hotels are taking a big hit from the coronavirus pandemic, but they still can be inviting targets for cybercriminals.

A point-of-sale-system widely used in the hospitality industry to process credit card payments and other transactions — ORACLE MICROS Restaurant Enterprise Series (RES) 3700 — is vulnerable to a backdoor that allows attackers to see some of the information in the system’s databases, according to researchers at Slovakia-based cybersecurity company ESET.

The researchers stress that highly sensitive pieces of information — such as credit card numbers and expiration dates – do not appear to be vulnerable to the malware, which they’re calling ModPipe. The malicious software, for now, harvests only “data stored in the clear,” ESET says, including cardholder names. But ModPipe potentially could be the conduit for more harmful malware, given that it is modular — meaning that it’s designed for attackers to swap features in and out.

“What makes the backdoor distinctive are its downloadable modules and their capabilities. One of them – named GetMicInfo – contains an algorithm designed to gather database passwords by decrypting them from Windows registry values,” ESET says. “This shows that the backdoor’s authors have deep knowledge of the targeted software and opted for this sophisticated method instead of collecting the data via a simpler yet ‘louder’ approach, such as keylogging.”

A lot of things are unclear about ModPipe, ESET says. It’s not known how the malware was distributed, or what the actual “business model” for it is, given that it can’t harvest the most valuable data from the Oracle system. The majority of the victims found by ESET were in the United States.

Even if the attackers aren’t harvesting credit card numbers yet, the findings serve as a reminder that point-of-sale systems offer several layers of information to crooks and spies, including data about people’s habits, tastes and whereabouts.

ModPipe has a dropper and a loader for getting the malware onto the systems, ESET says, as well as a main module for handling key tasks and a networking module for communicating with command-and-control servers. The downloadable modules offer the ability to “steal database passwords and configuration information, scan specific IP addresses or acquire a list of the running processes and their loaded modules,” the researchers say.

Even amid a shaky economy for restaurants, bars, hotels and similar businesses, the hospitality industry remains a broad target for crooks, given the wide discrepancies in security from organization to organization, and the amount of money still flowing through the industry.

Recent U.S. incidents include claims from cybercriminals that they pilfered 3 million card numbers from a barbecue chain, as well as a major hotel chain reporting that data on millions of guests had been stolen.

Oracle did not respond to requests for comment Thursday.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure