Bratislava – Every year, the Pontis Foundation awards the Via Bona award for exceptional projects and socially responsible companies that change Slovakia for the better. In the 20th anniversary of this award, ESET managed to win in two categories: Responsible Large Company and Good Partner of the Community.

The Via Bona Slovakia award has been given by the Pontis Foundation since 1998 to small and large companies that inspire other companies with their activities. The winners of this prestigious award are companies that change life in Slovakia for the better with their projects and responsible approaches to business. The award in the main category Responsible Large Company for 2019 was acquired by ESET mainly for demonstrating long-term ethical values ​​in our business model and contributing to the popularization of science and research in Slovakia.

“ESET is often cited as an example of a success story of a Slovak company that established itself abroad. We are aware of the responsibility that comes with that, especially at home in Slovakia. We do not choose an easier path. We support areas that have been neglected or overlooked for a long time. At the same time, we strive to be a voice that can be heard when needed. When, as a country, we are going through difficult times, it is desirable that the representatives of companies express themselves and stand out as voices of reason. And I hope that we have people, companies and organizations in Slovakia who really care about the success and fate of Slovakia,” responded ESET CEO Richard Marko in his thank-you speech for the award.

ESET also became the winner of the Good Partner of the Community category for our investment in the popularization and development of Slovak science. Supporting education, science and research are areas that ESET has long been involved in. It is these areas that help Slovakia become a modern and successful country. Therefore, through the ESET Foundation, it created the ESET Science Award, which aims to increase the social status of science and scientists in Slovakia. In October 2020, the second year of the ESET Science Award took place with the participation of the world-famous physicist and Nobel Prize winner, Professor Kip Thorne, who was chairman of a prestigious international commission.

“I thank both the expert jury and the employees of ESET, who are the main reason for our success. It is especially thanks to them that we can celebrate this award. I would also like to wish Slovakia success, because I think it has a positive future ahead of it,” concluded Richard Marko.

BRATISLAVA – ESET researchers have discovered ModPipe, a modular backdoor that gives its operators access to sensitive information stored in devices running ORACLE MICROS Restaurant Enterprise Series (RES) 3700 POS (point-of-sale) – a management software suite used by hundreds of thousands of bars, restaurants, hotels and other hospitality establishments worldwide. The majority of the identified targets were from the United States.

What makes the backdoor distinctive are its downloadable modules and their capabilities, as it contains a custom algorithm designed to gather RES 3700 POS database passwords by decrypting them from Windows registry values. This shows that the backdoor’s authors have deep knowledge of the targeted software and opted for this sophisticated method instead of collecting the data via a simpler yet “louder” approach, such as keylogging. Exfiltrated credentials allow ModPipe’s operators access to database contents, including various definitions and configuration, status tables and information about POS transactions.

“However, based on the documentation of RES 3700 POS, the attackers should not be able to access some of the most sensitive information – such as credit card numbers and expiration dates – which is protected by encryption. The only customer data stored in the clear and thus available to the attackers should be cardholder names,” cautions ESET researcher Martin Smolár, who discovered ModPipe.

“Probably the most intriguing parts of ModPipe are its downloadable modules. We’ve been aware of their existence since the end of 2019, when we first found and analyzed its basic components,” explains Smolár.

Downloadable modules:

• GetMicInfo targets data related to the MICROS POS, including passwords tied to two database usernames predefined by the manufacturer. This module can intercept and decrypt these database passwords, using a specifically designed algorithm.
• ModScan 2.20 collects additional information about the installed MICROS POS environment on the machines by scanning selected IP addresses.
• ProcList with main purpose is to collect information about currently running processes on the machine.

“ModPipe’s architecture, modules and their capabilities also indicate that its writers have extensive knowledge of the targeted RES 3700 POS software. The proficiency of the operators could stem from multiple scenarios, including stealing and reverse engineering the proprietary software product, misusing its leaked parts or buying code from an underground market,” adds Smolár.

To keep the operators behind ModPipe at bay, potential victims in the hospitality sector as well as any other businesses using the RES 3700 POS are advised to:

• Use the latest version of the software.
• Use it on devices that run updated operating system and software.
• Use reliable multilayered security software that can detect ModPipe and similar threats.

For more technical details about ModPipe, read “Hungry for data, ModPipe backdoor targets popular POS software used in hospitality sector,” a blogpost on WeLiveSecurity. Make sure to follow ESET Research on Twitter for the latest news from ESET Research.