Browse Definitions:
Definition

Backoff

Contributor(s): Matthew Haughn

Backoff is point-of-sale malware that uses memory scraping  to steal credit card data from Windows-based retail machines on which it is installed.

Backoff is used by criminals to gather valuable track2 data from credit cards. Track 2 data is information contained in the card's magnetic stripe and accessed by credit card checkers and point-of-sale (POS) magnetic stripe readers. The information in track 2 includes the primary account number and encrypted personal identification number (PIN). That data is lucrative for cybercriminals because it can be used used to create cloned credit cards.

The malware is installed via hacked remote desktop-type applications that are often used to configure POS systems. Attackers gain entrance to these accounts by brute force attacks. Once installed, Backoff is hard to detect. The malware uses RAM scraping to find track 2 data as it is introduced to the system, while it has not yet been encrypted. The data is then sent to remote computers to be sold on underground websites.

Backoff capabilities include:

  • Scraping memory for track 2 data.
  • Logging keystrokes.
  • Command & control (C&C) communication.
  • Injecting malicious stub into explorer.exe.

United States Secret Service estimated that Backoff had affected over 1000 businesses. A variant of Backoff was used in a massive Target breach in late 2013, which compromised the data of 70 million individuals.

This was last updated in January 2015

Continue Reading About Backoff

Join the conversation

1 comment

Send me notifications when other members comment.

By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy

Please create a username to comment.

http://www.burgerspot.cz/2013/10/pan-hamburger-v-restauraci-square-unhost/
Cancel

-ADS BY GOOGLE

File Extensions and File Formats

Powered by:

SearchCompliance

  • pure risk (absolute risk)

    Pure risk, also called absolute risk, is a category of threat that is beyond human control and has only one possible outcome if ...

  • risk assessment

    Risk assessment is the identification of hazards that could negatively impact an organization's ability to conduct business.

  • audit program (audit plan)

    An audit program, also called an audit plan, is an action plan that documents what procedures an auditor will follow to validate ...

SearchSecurity

  • computer worm

    A computer worm is a type of malicious software program whose primary function is to infect other computers while remaining ...

  • black hat

    Black hat refers to a hacker who breaks into a computer system or network with malicious intent.

  • copyright

    Copyright is a legal term describing ownership of control of the rights to the use and distribution of certain works of creative ...

SearchHealthIT

SearchDisasterRecovery

  • business continuity and disaster recovery (BCDR)

    Business continuity and disaster recovery (BCDR) are closely related practices that describe an organization's preparation for ...

  • business continuity plan (BCP)

    A business continuity plan (BCP) is a document that consists of the critical information an organization needs to continue ...

  • call tree

    A call tree -- sometimes referred to as a phone tree -- is a telecommunications chain for notifying specific individuals of an ...

SearchStorage

SearchSolidStateStorage

  • RRAM or ReRAM (resistive RAM)

    RRAM or ReRAM (resistive random access memory) is a form of nonvolatile storage that operates by changing the resistance of a ...

  • JEDEC

    JEDEC is a global industry group that develops open standards for microelectronics.

  • M.2 SSD

    An M.2 SSD is a solid-state drive (SSD) that conforms to a computer industry specification written for internally mounted storage...

SearchCloudStorage

  • Google Cloud Storage

    Google Cloud Storage is an enterprise public cloud storage platform that can house large unstructured data sets.

  • RESTful API

    A RESTful application program interface breaks down a transaction to create a series of small modules, each of which addresses an...

  • cloud storage infrastructure

    Cloud storage infrastructure is the hardware and software framework that supports the computing requirements of a private or ...

Close