Dexter (malware)

Computer virus

Dexter is a computer virus or point of sale (PoS) malware[1] which infects computers running Microsoft Windows and was discovered by IT security firm Seculert, in December 2012. It infects PoS systems worldwide and steals sensitive information such as credit and debit card information.[2][3]

## Function

[edit]

When Dexter infects a machine it injects itself into iexplore.exe, the executable file that runs Internet Explorer. It also changes Windows registry entries to allow the malware to run on startup of the machine.[4] The malware parses memory dumps by using a Windows function called ReadProcessMemory.[5] Dexter uploads the contents of the memory it parses from PoS machines to a server located in the Seychelles.[5] The information Dexter can collect includes credit and debit card information, user names and host names, operating system data, a list of running processes, and encryption keys so the data it collects can be decrypted.

## Impact

[edit]

Businesses infected by Dexter include retail stores, hotels, restaurants, banks,[6] and private parking providers. By December 2012, around the time it was first discovered, the malware was found in 40 different countries, with most compromised machines being located in the United States, United Kingdom, and Canada (where PoS systems are ubiquitous) but was also found in Asia (including China, Southeast Asia and India).[7][8]

A variant of Dexter, thought to have been modified to avoid anti-malware detection by an unknown group in the UK, was linked to estimated losses in the tens of millions for banks in South Africa.[9] South Africa's banks noticed "unusual levels of suspected fraud" after customers used credit cards at various fast-food restaurants. An updated anti-malware signature was provided for all outlets suspected of using infected PoS machines. It is unknown how many credit cards were compromised in these attacks, but many were monitored for fraud after the incident.[10]

### Variants

[edit]

#### StarDust

[edit]

In December 2013, researchers discovered StarDust, a major revision of Dexter, which compromised 20,000 cards in active campaign hitting US merchants.[11] It was one of the first known botnets to target PoS terminals used by stores and restaurants to process customers' credit and debit card payments.[11] Unlike the original version of Dexter, StarDust can also extract information from internal network traffic instead of information contained to one PoS device.[12]

## See also

[edit]

* Cyber security standards
* Cyber warfare
* List of cyber attack threat trends
* Proactive Cyber Defence
* Point-of-sale malware

## References

[edit]

1. ^ "Dexter Malware Infects Point-of-Sale Systems". December 5, 2021. Archived from the original on December 5, 2021. Retrieved December 10, 2022.
2. ^ "Dexter malware infects point-of-sale systems worldwide, researchers say - CSO Online - Security and Risk". CSO Online. December 11, 2012. Archived from the original on January 22, 2013. Retrieved December 17, 2012.
3. ^ "Dexter POS Malware Threat" (PDF). squirrelsystems.
4. ^ "Win32/Dexter". Microsoft.com. September 15, 2017. Archived from the original on May 3, 2023. Retrieved April 15, 2022.
5. ^ a b Goodin, Dan (December 11, 2012). ""Dexter" malware steals credit card data from point-of-sale terminals". Ars Technica. Retrieved April 15, 2022.
6. ^ "Dexter point-of-sale malware strikes U.S. and abroad". iTnews. Retrieved April 15, 2022.
7. ^ "Dexter Malware Infects Point-of-Sale Systems". eSecurityPlanet. December 11, 2012. Retrieved April 15, 2022.
8. ^ "Dexter, Project Hook POS Malware Campaigns Persist". threatpost.com. March 6, 2014.
9. ^ "South African banks suffer massive Dexter malware attack". Payments Cards & Mobile. October 15, 2013. Retrieved May 16, 2022.
10. ^ "SA banks in massive data breach". TechCentral. October 15, 2013. Retrieved May 16, 2022.
11. ^ a b Dan Goodin (December 4, 2013). "Credit card fraud comes of age with advances in point-of-sale botnets". Ars Technica. Retrieved November 8, 2014.
12. ^ "Point-of-sale malware infections on the rise, researchers warn - PC World Australia". www.pcworld.idg.com.au. Retrieved April 15, 2022.

## External links

[edit]

* "Dexter - Draining blood out of Point of Sales". blog.seculert.com. December 16, 2012. Archived from the original on December 14, 2012. Retrieved December 17, 2012.

* v
* t
* e

Hacking in the 2010s

| <- 2000s | Timeline | 2020s ->

|
|

Major incidents|

| 2010|

* Operation Aurora (publication of 2009 events)
* Australian cyberattacks
* Operation Olympic Games
* Operation ShadowNet
* Operation Payback

|

2011|

* Canadian government
* DigiNotar
* DNSChanger
* HBGary Federal
* Operation AntiSec
* PlayStation network outage
* RSA SecurID compromise

2012|

* LinkedIn hack
* Stratfor email leak
* Operation High Roller

2013|

* South Korea cyberattack
* Snapchat hack
* Cyberterrorism attack of June 25
* 2013 Yahoo! data breach
* Singapore cyberattacks

2014|

* Anthem medical data breach
* Operation Tovar
* 2014 celebrity nude photo leak
* 2014 JPMorgan Chase data breach
* 2014 Sony Pictures hack
* Russian hacker password theft
* 2014 Yahoo! data breach

2015|

* Office of Personnel Management data breach
* HackingTeam
* Ashley Madison data breach
* VTech data breach
* Ukrainian Power Grid Cyberattack
* SWIFT banking hack

2016|

* Bangladesh Bank robbery
* Hollywood Presbyterian Medical Center ransomware incident
* Commission on Elections data breach
* Democratic National Committee cyber attacks
* Vietnam Airport Hacks
* DCCC cyber attacks
* Indian Bank data breaches
* Surkov leaks
* Dyn cyberattack
* Russian interference in the 2016 U.S. elections
* 2016 Bitfinex hack

2017|

* SHAttered
* 2017 Macron e-mail leaks
* WannaCry ransomware attack
* Westminster data breach
* Petya and NotPetya
* 2017 Ukraine ransomware attacks
* Equifax data breach
* Deloitte breach
* Disqus breach

2018|

* Trustico
* Atlanta cyberattack
* SingHealth data breach

2019|

* Sri Lanka cyberattack
* Baltimore ransomware attack
* Bulgarian revenue agency hack
* WhatsApp snooping scandal
* Jeff Bezos phone hacking incident

Hacktivism|

* Anonymous
* associated events
* CyberBerkut
* GNAA
* Goatse Security
* Lizard Squad
* LulzRaft
* LulzSec
* New World Hackers
* NullCrew
* OurMine
* PayPal 14
* RedHack
* Teamp0ison
* TDO
* UGNazi
* Ukrainian Cyber Alliance

Groups|

* Appin
* Bangladesh Black Hat Hackers
* Bureau 121
* Charming Kitten
* Cozy Bear
* Dark Basin
* DarkMatter
* Elfin Team
* Equation Group
* Fancy Bear
* GOSSIPGIRL (confederation)
* Guccifer 2.0
* Hacking Team
* Helix Kitten
* Iranian Cyber Army
* Islamic State Hacking Division
* Lazarus Group
* BlueNorOff
* AndAriel
* Lords of Dharmaraja
* NSO Group
* Numbered Panda
* PLA Unit 61398
* PLA Unit 61486
* PLATINUM
* Pranknet
* Red Apollo
* Rocket Kitten
* Stealth Falcon
* Syrian Electronic Army
* Tailored Access Operations
* The Shadow Brokers
* xDedic
* Yemen Cyber Army

Individuals|

* Ryan Ackroyd
* Mustafa Al-Bassam
* Kim Anh Vo
* George Hotz
* Guccifer
* Elliott Gunton
* Jeremy Hammond
* Sam Hocevar
* Junaid Hussain
* MLT
* Sabu
* Track2
* Topiary
* The Jester

Major vulnerabilities
publicly disclosed|

* Evercookie (2010)
* iSeeYou (2013)
* Heartbleed (2014)
* Shellshock (2014)
* POODLE (2014)
* Rootpipe (2014)
* Row hammer (2014)
* SS7 vulnerabilities (2014)
* WinShock (2014)
* JASBUG (2015)
* Stagefright (2015)
* DROWN (2016)
* Badlock (2016)
* Dirty COW (2016)
* Cloudbleed (2017)
* Broadcom Wi-Fi (2017)
* EternalBlue (2017)
* DoublePulsar (2017)
* Silent Bob is Silent (2017)
* KRACK (2017)
* ROCA vulnerability (2017)
* BlueBorne (2017)
* Meltdown (2018)
* Spectre (2018)
* EFAIL (2018)
* Exactis (2018)
* Speculative Store Bypass (2018)
* Lazy FP state restore (2018)
* TLBleed (2018)
* SigSpoof (2018)
* Foreshadow (2018)
* Dragonblood (2019)
* Microarchitectural Data Sampling (2019)
* BlueKeep (2019)
* Kr00k (2019)

Malware|

| 2010|

* Bad Rabbit
* Black Energy 2
* SpyEye
* Stuxnet

|

2011|

* Coreflood
* Alureon
* Duqu
* Kelihos
* Metulji botnet
* Stars

2012|

* Carna
* Dexter
* FBI
* Flame
* Mahdi
* Red October
* Shamoon

2013|

* CryptoLocker
* DarkSeoul

2014|

* Brambul
* Black Energy 3
* Carbanak
* Careto
* DarkHotel
* Duqu 2.0
* FinFisher
* Gameover ZeuS
* Regin

2015|

* Dridex
* Hidden Tear
* Rombertik
* TeslaCrypt
* Project Sauron

2016|

* Hitler
* Jigsaw
* KeRanger
* Necurs
* MEMZ
* Mirai
* Pegasus
* Petya and NotPetya
* X-Agent

2017|

* BrickerBot
* Kirk
* LogicLocker
* Rensenware
* Triton
* WannaCry
* XafeCopy

2018|

* VPNFilter

2019|

* Grum
* Joanap
* NetTraveler
* R2D2
* Tinba
* Titanium
* ZeroAccess botnet

*[v]: View this template
*[t]: Discuss this template
*[e]: Edit this template