Ajay Kumar: Created a new article

2023-09-25T18:40:30Z

Created a new article

New page

{{Short description|Computer virus}}
{{use mdy dates |date=July 2023}}
<ref>{{Cite web |date=2021-12-05 |title=Dexter Malware Infects Point-of-Sale Systems |url=https://www.esecurityplanet.com/threats/dexter-malware-infects-point-of-sale-systems/ |access-date=2022-12-10 |archive-url=https://web.archive.org/web/20211205172051/https://www.esecurityplanet.com/threats/dexter-malware-infects-point-of-sale-systems/ |archive-date=2021-12-05 }}</ref>'''Dexter''' is a [[computer virus]] or [[Point-of-sale malware|point of sale malware]] which infects computers running Microsoft Windows and was discovered by IT security firm [[Seculert]], in December 2012. It infects [[Point of sale|PoS]] systems worldwide and steals sensitive information such as credit and debit card information.<ref>{{cite web|url=http://www.csoonline.com/article/723630/dexter-malware-infects-point-of-sale-systems-worldwide-researchers-say |title=Dexter malware infects point-of-sale systems worldwide, researchers say - CSO Online - Security and Risk |publisher=CSO Online |date=2012-12-11 |access-date=2012-12-17}}</ref><ref>{{cite web|url=http://www.squirrelsystems.com/wp-content/uploads/2015/04/Security-Field-Advisory-Dexter-POS-Malware_20121227.pdf |title=Dexter POS Malware Threat
|publisher=squirrelsystems}}</ref>

== Function ==
When Dexter infects a machine it injects itself into iexplore.exe, the [[Executable|executable file]] that runs [[Internet Explorer]]. It also changes [[Windows Registry|Windows registry]] entries to allow the malware to run on startup of the machine.<ref>{{Cite web |date=2017-09-15 |title=Win32/Dexter |url=https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=%20win32/dexter |url-status=live |access-date=2022-04-15 |website=Microsoft.com|archive-url=https://web.archive.org/web/20230503174417/https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=%20win32/dexter |archive-date=May 3, 2023 }}</ref> The malware parses [[memory dump]]s by using a Windows function called ReadProcessMemory.<ref name=":0">{{Cite web |last=Goodin |first=Dan |date=2012-12-11 |title="Dexter" malware steals credit card data from point-of-sale terminals |url=https://arstechnica.com/information-technology/2012/12/dexter-malware-steals-credit-card-data-from-point-of-sale-terminals/ |access-date=2022-04-15 |website=Ars Technica |language=en-us}}</ref> Dexter uploads the contents of the memory it parses from PoS machines to a server located in the [[Seychelles]].<ref name=":0" /> The information Dexter can collect includes credit and debit card information, user names and host names, operating system data, a list of running processes, and [[Key (cryptography)|encryption keys]] so the data it collects can be decrypted.

== Impact ==
Businesses infected by Dexter include retail stores, hotels, restaurants, banks,<ref>{{Cite web |title=Dexter point-of-sale malware strikes U.S. and abroad |url=https://www.itnews.com.au/news/dexter-point-of-sale-malware-strikes-us-and-abroad-366662 |access-date=2022-04-15 |website=iTnews}}</ref> and private parking providers. By December 2012, around the time it was first discovered, the malware was found in 40 different countries, with most compromised machines being located in the United States, United Kingdom, and Canada (where POS systems are ubiquitous) but was also found in Asia (including China, Southeast Asia and India).<ref>{{Cite web |date=2012-12-11 |title=Dexter Malware Infects Point-of-Sale Systems |url=https://www.esecurityplanet.com/threats/dexter-malware-infects-point-of-sale-systems/ |access-date=2022-04-15 |website=eSecurityPlanet |language=en-US}}</ref><ref>{{cite web |title=Dexter, Project Hook POS Malware Campaigns Persist |url=https://threatpost.com/dexter-project-hook-pos-malware-campaigns-persist/104655/ |website=threatpost.com |date=6 March 2014 |language=en}}</ref>

A variant of Dexter, thought to have been modified to avoid [[Antimalware|anti-malware]] detection by an unknown group in the UK, was linked to estimated losses in the tens of millions for banks in South Africa.<ref>{{Cite web |date=2013-10-15 |title=South African banks suffer massive Dexter malware attack |url=https://www.paymentscardsandmobile.com/south-african-banks-suffer-massive-dexter-malware-attack/ |access-date=2022-05-16 |website=Payments Cards & Mobile |language=en}}</ref> South Africa's banks noticed "unusual levels of suspected fraud" after customers used credit cards at various fast-food restaurants. An updated anti-malware signature was provided for all outlets suspected of using infected PoS machines. It is unknown how many credit cards were compromised in these attacks, but many were monitored for fraud after the incident.<ref>{{Cite web |date=2013-10-15 |title=SA banks in massive data breach |url=https://techcentral.co.za/sa-banks-in-massive-data-breach/188884/ |access-date=2022-05-16 |website=TechCentral |language=en-US}}</ref>

=== Variants ===

==== StarDust ====
In December 2013, researchers discovered StarDust, a major revision of Dexter, which compromised 20,000 cards in active campaign hitting US merchants.<ref name="MyUser_Ars_Technica_November_8_2014c">{{cite web |url=https://arstechnica.com/security/2013/12/credit-card-fraud-comes-of-age-with-first-known-point-of-sale-botnet/ |title=Credit card fraud comes of age with advances in point-of-sale botnets |newspaper=Ars Technica |date= December 4, 2013 |author=Dan Goodin |access-date=November 8, 2014}}</ref>
It was one of the first known botnets to target [[point-of-sale]] (PoS) terminals used by stores and restaurants to process customers' [[Credit card|credit]] and [[debit card]] payments.<ref name="MyUser_Ars_Technica_November_8_2014c" /> Unlike the original version of Dexter, StarDust can also extract information from internal network traffic instead of information contained to one PoS device.<ref>{{Cite web |title=Point-of-sale malware infections on the rise, researchers warn - PC World Australia |url=https://www.pcworld.idg.com.au/article/533593/point-of-sale_malware_infections_rise_researchers_warn/ |access-date=2022-04-15 |website=www.pcworld.idg.com.au}}</ref>

== See also ==

* [[Cyber electronic warfare]]
* [[Cyber security standards]]
* [[Cyber warfare]]
* [[List of cyber attack threat trends]]
* [[Proactive Cyber Defence]]
* [[Point-of-sale malware]]

== References ==
{{Reflist}}

== External links ==
* {{cite web | url=http://blog.seculert.com/2012/12/dexter-draining-blood-out-of-point-of.html | title=Dexter - Draining blood out of Point of Sales | publisher=blog.seculert.com | date=December 16, 2012 | access-date=December 17, 2012 | archive-url=https://web.archive.org/web/20121214032036/http://blog.seculert.com/2012/12/dexter-draining-blood-out-of-point-of.html | archive-date=December 14, 2012 | url-status=dead }}

{{Hacking in the 2010s}}

[[Category:2012 in computing]]
[[Category:Computer viruses]]
[[Category:Cyberwarfare]]
[[Category:Rootkits]]
[[Category:Cybercrime in India]]

{{malware-stub}}

Dexter (malware) - Revision history

Ajay Kumar: Created a new article