{"id":48159,"date":"2020-11-12T17:22:28","date_gmt":"2020-11-12T09:22:28","guid":{"rendered":"https:\/\/version-2.com.sg\/?p=21520"},"modified":"2022-04-20T12:55:04","modified_gmt":"2022-04-20T04:55:04","slug":"eset-research-discovers-modpipe-backdoor-targeting-pos-software-used-by-thousands-of-restaurants-hotels","status":"publish","type":"post","link":"https:\/\/version-2.com\/en\/2020\/11\/eset-research-discovers-modpipe-backdoor-targeting-pos-software-used-by-thousands-of-restaurants-hotels\/","title":{"rendered":"ESET Research discovers ModPipe, backdoor targeting POS software used by thousands of restaurants, hotels"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

BRATISLAVA<\/strong>\u00a0\u2013 ESET researchers have discovered ModPipe, a modular backdoor that gives its operators access to sensitive information stored in devices running ORACLE MICROS Restaurant Enterprise Series (RES) 3700 POS (point-of-sale) \u2013 a management software suite used by hundreds of thousands of bars, restaurants, hotels and other hospitality establishments worldwide. The majority of the identified targets were from the United States.<\/p>\n

\nWhat makes the backdoor distinctive are its downloadable modules and their capabilities, as it contains a custom algorithm designed to gather RES 3700 POS database passwords by decrypting them from Windows registry values. This shows that the backdoor\u2019s authors have deep knowledge of the targeted software and opted for this sophisticated method instead of collecting the data via a simpler yet \u201clouder\u201d approach, such as keylogging. Exfiltrated credentials allow ModPipe\u2019s operators access to database contents, including various definitions and configuration, status tables and information about POS transactions.\n<\/p>\n

\n\u201cHowever, based on the documentation of RES 3700 POS, the attackers should not be able to access some of the most sensitive information \u2013 such as credit card numbers and expiration dates \u2013 which is protected by encryption. The only customer data stored in the clear and thus available to the attackers should be cardholder names,\u201d cautions ESET researcher Martin Smol\u00e1r, who discovered ModPipe.\n<\/p>\n

\n\u201cProbably the most intriguing parts of ModPipe are its downloadable modules. We\u2019ve been aware of their existence since the end of 2019, when we first found and analyzed its basic components,\u201d explains Smol\u00e1r.\n<\/p>\n

\nDownloadable modules:<\/p>\n\n