|By Business Wire||
|September 3, 2014 11:01 AM EDT||
Tripwire, Inc., a leading global provider of advanced threat, security and compliance solutions, today announced that Tripwire vulnerability management solutions detect all known variants of Backoff malware.
The Department of Homeland Security (DHS) updated a cybersecurity alert on Friday, August 22, 2014, warning that over one thousand major enterprise networks and small and medium businesses in the U.S. have been compromised with malware designed to infect point-of-sale (POS) systems.
The malware package, dubbed “Backoff,” is responsible for recent breaches at several major retailers including Target, Supervalu supermarkets and UPS stores. Backoff is being used in targeted attacks directed at retailers and is designed to steal credit card data from POS systems. Backoff attempts to exploit remote desktop applications on systems and is also capable of monitoring and logging keystrokes as well as exfiltrating data to a remote server. Seven leading POS vendors have confirmed that they have multiple clients affected with several variants of Backoff malware.
“Reusable exploits used to hack point-of-sale systems are wreaking havoc among retailers,” said Dwayne Melancon, chief technology officer at Tripwire. “The proliferation of Backoff malware emphasizes the need to understand what is on your network, whether you can trust it, and whether it has any known vulnerabilities. Many businesses tend to have a ‘deploy and forget’ mentality for much of their infrastructure, making it easy for attackers to gain access to their systems.”
Tripwire vulnerability management solutions include timely vulnerability intelligence delivered by the company's Vulnerability and Exposure Research Team (VERT). This dedicated team of world-class security and vulnerability researchers focuses unwavering attention on the changing threat environment. Tripwire's VERT identifies emerging vulnerabilities and creates unique detection signatures that are constantly updated in Tripwire vulnerability and risk management solutions, delivering unprecedented vulnerability discovery coverage that contains all known variants of Backoff malware and most remote desktop applications, including:
- Microsoft Remote Desktop Protocol
- VNC/RFB including Apple Remote Desktop
- DameWare Mini Remote Control
- Symantec pcAnywhere
“Continuously monitoring what is on your network, identifying and patching known vulnerabilities, and using baselines to determine when your systems have been tampered with are crucial security controls that minimize the impact of malware,” continued Melancon. “Unfortunately, most organizations have under-invested in these foundational capabilities and are regretting it now. That has to change.”
Tripwire® SecureScan provides free internal vulnerability scanning for up to 100 IP addresses and includes comprehensive detection rules that discover Backoff in a wide variety of conditions. Tripwire SecureScan contains the same robust vulnerability checks included in Tripwire® IP360™, a vulnerability management solution used by the largest, most sensitive networks in the world.
Free chapter: Hacking Point of Sale by Slava Gomzin
Tripwire is a leading provider of advanced threat, security and compliance solutions that enable enterprises, service providers and government agencies to confidently detect, prevent and respond to cybersecurity threats. Tripwire solutions are based on high-fidelity asset visibility and deep endpoint intelligence combined with business-context and enable security automation through enterprise integration. Tripwire’s portfolio of enterprise-class security solutions includes configuration and policy management, file integrity monitoring, vulnerability management and log intelligence. Learn more at www.tripwire.com, get security news, trends and insights at http://www.tripwire.com/state-of-security/ or follow us on Twitter @TripwireInc.
Explosive growth in connected devices. Enormous amounts of data for collection and analysis. Critical use of data for split-second decision making and actionable information. All three are factors in making the Internet of Things a reality. Yet, any one factor would have an IT organization pondering its infrastructure strategy. How should your organization enhance its IT framework to enable an In...
Oct. 25, 2014 05:00 PM EDT Reads: 1,720
The major cloud platforms defy a simple, side-by-side analysis. Each of the major IaaS public-cloud platforms offers their own unique strengths and functionality. Options for on-site private cloud are diverse as well, and must be designed and deployed while taking existing legacy architecture and infrastructure into account. Then the reality is that most enterprises are embarking on a hybrid cloud...
Oct. 25, 2014 11:45 AM EDT Reads: 1,841
StackIQ offers a comprehensive software suite that automates the deployment, provisioning, and management of Big Infrastructure. With StackIQ’s software, you can spin up fully configured big data clusters, quickly and consistently — from bare-metal up to the applications layer — and manage them efficiently. Our software’s modular architecture allows customers to integrate nearly any application wi...
Oct. 25, 2014 10:00 AM EDT Reads: 1,776
In her General Session at 15th Cloud Expo, Anne Plese, Senior Consultant, Cloud Product Marketing, at Verizon Enterprise, will focus on finding the right mix of renting vs. buying Oracle capacity to scale to meet business demands, and offer validated Oracle database TCO models for Oracle development and testing environments. Anne Plese is a marketing and technology enthusiast/realist with over 19...
Oct. 25, 2014 10:00 AM EDT Reads: 1,711
As Platform as a Service (PaaS) matures as a category, developers should have the ability to use the programming language of their choice to build applications and have access to a wide array of services. Bluemix is IBM's open cloud development platform that enables users to easily build cloud-based, creative mobile and web applications without having to spend large amounts of time and resources o...
Oct. 25, 2014 08:00 AM EDT Reads: 1,783
The Internet of Things will greatly expand the opportunities for data collection and new business models driven off of that data. In her session at Internet of @ThingsExpo, Esmeralda Swartz, CMO of MetraTech, will discuss how for this to be effective you not only need to have infrastructure and operational models capable of utilizing this new phenomenon, but increasingly service providers will nee...
Oct. 24, 2014 09:30 PM EDT Reads: 1,420
When you set off to build an app that will change the world, designing your system architecture to be reliable and scalable is important but the stark reality is that, for your MVP, you probably had a “need for speed” (of development). You didn’t know what all the axes were to scale your application, where your stress points would be, and what weird and wonderful ways your customers would use it d...
Oct. 24, 2014 09:00 PM EDT Reads: 1,257
Compute virtualization has been transformational, yet security policy implementation and enforcement has lagged behind in agility and automation. There are a number of key considerations when implementing policy in private and hybrid clouds. In his session at 15th Cloud Expo, Holland Barry, VP of Technology at Catbird, will discuss the impact of this new paradigm and what organizations can do to...
Oct. 24, 2014 07:00 PM EDT Reads: 1,546
Samsung VP Jacopo Lenzi, who headed the company's recent SmartThings acquisition under the auspices of Samsung's Open Innovaction Center (OIC), answered a few questions we had about the deal. This interview was in conjunction with our interview with SmartThings CEO Alex Hawkinson. IoT Journal: SmartThings was developed in an open, standards-agnostic platform, and will now be part of Samsung's Ope...
Oct. 23, 2014 11:45 PM EDT Reads: 2,692
SYS-CON Events announced today that Red Hat, the world's leading provider of open source solutions, will exhibit at Internet of @ThingsExpo, which will take place on November 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA. Red Hat is the world's leading provider of open source software solutions, using a community-powered approach to reliable and high-performing cloud, Linux, ...
Oct. 23, 2014 11:30 PM EDT Reads: 1,738