Dexter (malware)

Short description: Computer virus

[1]Dexter is a computer virus or point of sale malware which infects computers running Microsoft Windows and was discovered by IT security firm Seculert, in December 2012. It infects PoS systems worldwide and steals sensitive information such as credit and debit card information.[2][3]

## Contents

* 1 Function
* 2 Impact
* 2.1 Variants
* 2.1.1 StarDust
* 3 See also
* 4 References
* 5 External links

## Function

When Dexter infects a machine it injects itself into iexplore.exe, the executable file that runs Internet Explorer. It also changes Windows registry entries to allow the malware to run on startup of the machine.[4] The malware parses memory dumps by using a Windows function called ReadProcessMemory.[5] Dexter uploads the contents of the memory it parses from PoS machines to a server located in the Seychelles.[5] The information Dexter can collect includes credit and debit card information, user names and host names, operating system data, a list of running processes, and encryption keys so the data it collects can be decrypted.

## Impact

Businesses infected by Dexter include retail stores, hotels, restaurants, banks,[6] and private parking providers. By December 2012, around the time it was first discovered, the malware was found in 40 different countries, with most compromised machines being located in the United States, United Kingdom, and Canada (where POS systems are ubiquitous) but was also found in Asia (including China, Southeast Asia and India).[7][8]

A variant of Dexter, thought to have been modified to avoid anti-malware detection by an unknown group in the UK, was linked to estimated losses in the tens of millions for banks in South Africa.[9] South Africa's banks noticed "unusual levels of suspected fraud" after customers used credit cards at various fast-food restaurants. An updated anti-malware signature was provided for all outlets suspected of using infected PoS machines. It is unknown how many credit cards were compromised in these attacks, but many were monitored for fraud after the incident.[10]

### Variants

#### StarDust

In December 2013, researchers discovered StarDust, a major revision of Dexter, which compromised 20,000 cards in active campaign hitting US merchants.[11] It was one of the first known botnets to target point-of-sale (PoS) terminals used by stores and restaurants to process customers' credit and debit card payments.[11] Unlike the original version of Dexter, StarDust can also extract information from internal network traffic instead of information contained to one PoS device.[12]

## See also

* Cyber electronic warfare
* Cyber security standards
* Cyber warfare
* List of cyber attack threat trends
* Proactive Cyber Defence
* Point-of-sale malware

## References

1. ↑ "Dexter Malware Infects Point-of-Sale Systems". 2021-12-05. https://www.esecurityplanet.com/threats/dexter-malware-infects-point-of-sale-systems/.
2. ↑ "Dexter malware infects point-of-sale systems worldwide, researchers say - CSO Online - Security and Risk". CSO Online. 2012-12-11. http://www.csoonline.com/article/723630/dexter-malware-infects-point-of-sale-systems-worldwide-researchers-say.
3. ↑ "Dexter POS Malware Threat". squirrelsystems. http://www.squirrelsystems.com/wp-content/uploads/2015/04/Security-Field-Advisory-Dexter-POS-Malware_20121227.pdf.
4. ↑ "Win32/Dexter". 2017-09-15. https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name= win32/dexter.
5. ↑ 5.0 5.1 Goodin, Dan (2012-12-11). ""Dexter" malware steals credit card data from point-of-sale terminals" (in en-us). https://arstechnica.com/information-technology/2012/12/dexter-malware-steals-credit-card-data-from-point-of-sale-terminals/.
6. ↑ "Dexter point-of-sale malware strikes U.S. and abroad". https://www.itnews.com.au/news/dexter-point-of-sale-malware-strikes-us-and-abroad-366662.
7. ↑ "Dexter Malware Infects Point-of-Sale Systems" (in en-US). 2012-12-11. https://www.esecurityplanet.com/threats/dexter-malware-infects-point-of-sale-systems/.
8. ↑ "Dexter, Project Hook POS Malware Campaigns Persist" (in en). 6 March 2014. https://threatpost.com/dexter-project-hook-pos-malware-campaigns-persist/104655/.
9. ↑ "South African banks suffer massive Dexter malware attack" (in en). 2013-10-15. https://www.paymentscardsandmobile.com/south-african-banks-suffer-massive-dexter-malware-attack/.
10. ↑ "SA banks in massive data breach" (in en-US). 2013-10-15. https://techcentral.co.za/sa-banks-in-massive-data-breach/188884/.
11. ↑ 11.0 11.1 Dan Goodin (December 4, 2013). "Credit card fraud comes of age with advances in point-of-sale botnets". https://arstechnica.com/security/2013/12/credit-card-fraud-comes-of-age-with-first-known-point-of-sale-botnet/.
12. ↑ "Point-of-sale malware infections on the rise, researchers warn - PC World Australia". https://www.pcworld.idg.com.au/article/533593/point-of-sale_malware_infections_rise_researchers_warn/.

## External links

* "Dexter - Draining blood out of Point of Sales". blog.seculert.com. December 16, 2012. http://blog.seculert.com/2012/12/dexter-draining-blood-out-of-point-of.html.

* v
* t
* e

Hacking in the 2010s

| <- 2000s | Timeline | 2020s ->

|
|

Major incidents|

| 2010|

* Operation Aurora
* Australian cyberattacks
* Operation ShadowNet
* Operation Payback

|

2011|

* DigiNotar
* DNSChanger
* HBGary Federal
* Operation AntiSec
* Operation Tunisia
* PlayStation
* RSA SecurID compromise

2012|

* LinkedIn hack
* Stratfor email leak
* Operation High Roller

2013|

* South Korea cyberattack
* Snapchat hack
* Cyberterrorism Attack of June 25
* 2013 Yahoo! data breach

2014|

* Anthem medical data breach
* Operation Tovar
* iCloud leaks of celebrity photos
* 2014 JPMorgan Chase data breach
* Sony Pictures hack
* Russian hacker password theft
* 2014 Yahoo! data breach

2015|

* Office of Personnel Management data breach
* Hacking Team
* Ashley Madison data breach
* VTech data breach
* Ukrainian Power Grid Cyberattack
* SWIFT banking hack

2016|

* Bangladesh Bank robbery
* Hollywood Presbyterian Medical Center ransomware incident
* Commission on Elections data breach
* Democratic National Committee cyber attacks
* Vietnam Airport Hacks
* DCCC cyber attacks
* Indian Bank data breaches
* Dyn cyberattack
* Russian interference in the 2016 U.S. elections

2017|

* 2017 Macron e-mail leaks
* WannaCry ransomware attack
* Westminster cyberattack
* Petya cyberattack
* 2017 cyberattacks on Ukraine
* Equifax data breach
* Deloitte breach
* Disqus breach

2018|

* Trustico
* Exactis
* Atlanta cyberattack

2019|

* Sri Lanka cyberattack
* Baltimore ransomware attack
* 2019 Bulgarian revenue agency hack
* Capital One data breach
* Zynga Breach

Groups|

| Hacktivism|

* Anonymous
* associated events
* CyberBerkut
* GNAA
* Goatse Security
* Lizard Squad
* LulzRaft
* LulzSec
* New World Hackers
* NullCrew
* OurMine
* PayPal 14
* RedHack
* TeaMp0isoN
* UGNazi

|

Advanced Persistent Threat|

* Bureau 121
* Carbanak (group)
* Charming Kitten
* Cozy Bear
* Elfin Team
* Equation Group
* Fancy Bear
* FreeMilk
* Guccifer 2.0
* Hacking Team
* Helix Kitten
* Iranian Cyber Army
* Lazarus Group (BlueNorOff) (AndAriel)
* NSO Group
* PLA Unit 61398
* PLA Unit 61486
* PLA Unit 78020
* PLATINUM
* Pranknet
* Red Apollo
* Rocket Kitten
* Syrian Electronic Army
* Tailored Access Operations
* The Shadow Brokers
* Yemen Cyber Army

Individuals|

* DkD[||
* George Hotz
* Guccifer
* Jeremy Hammond
* Junaid Hussain
* Kristoffer von Hassel
* Mustafa Al-Bassam
* MLT
* Ryan Ackroyd
* Sabu
* Topiary
* Track2
* The Jester
* weev

Major vulnerabilities
publicly disclosed|

* Evercookie (2010)
* iSeeYou (2013)
* Heartbleed (2014)
* Shellshock (2014)
* POODLE (2014)
* Rootpipe (2014)
* Row hammer (2014)
* JASBUG (2015)
* Stagefright (2015)
* DROWN (2016)
* Badlock (2016)
* Dirty COW (2016)
* Cloudbleed (2017)
* Broadcom Wi-Fi (2017)
* EternalBlue (2017)
* DoublePulsar (2017)
* Silent Bob is Silent (2017)
* KRACK (2017)
* ROCA vulnerability (2017)
* BlueBorne (2017)
* Meltdown (2018)
* Spectre (2018)
* EFAIL (2018)
* Speculative Store Bypass (2018)
* Lazy FP State Restore (2018)
* TLBleed (2018)
* SigSpoof (2018)
* Foreshadow (2018)
* Fallout (2019)
* RIDL (2019)
* ZombieLoad (2019)
* BlueKeep (2019)

Malware|

| 2010|

* Bad Rabbit
* Stuxnet

|

2011|

* Kelihos
* Stars
* Metulji botnet
* Duqu
* Alureon

2012|

* Mahdi
* Carna
* Flame
* FBI
* Shamoon
* Red October
* Dexter

2013|

* DarkSeoul
* CryptoLocker

2014|

* Careto
* DarkHotel
* Duqu 2.0
* Dyreza
* FinFisher
* Brambul
* Destover
* Gameover ZeuS
* Carbanak

2015|

* Dridex
* Rombertik
* TeslaCrypt
* Hidden Tear

2016|

* Hitler
* Petya (NotPetya)
* KeRanger
* Jigsaw
* Pegasus
* Mirai
* X-Agent

2017|

* LogicLocker
* BrickerBot
* WannaCry

2018|

* Kraken

2019|

* ElectricFish
* Grum
* Joanap
* MEMZ
* NetTraveler
* NSA ANT catalog
* R2D2
* Regin
* Tinba
* Titanium
* Vault 7
* X-Tunnel
* ZeroAccess

0.00

(0 votes)

Original source: https://en.wikipedia.org/wiki/Dexter (malware). Read more

|

Retrieved from "https://handwiki.org/wiki/index.php?title=Dexter_(malware)&oldid=236256"
*[v]: View this template
*[t]: Discuss this template
*[e]: Edit this template