Goodbye Memory Scraping Malware
Weston Hecker introduces SkimBad, an open-source anti-scraping defense that injects honeypot decoy credit card numbers into POS system memory to rapidly detect malware breaches.
Summary
The Anatomy of POS RAM Scraping Breaches
High-profile retail breaches (such as Target and Home Depot) demonstrated how memory scraping malware extracts unencrypted Track 1 and Track 2 payment card data from point-of-sale memory.
Introducing SkimBad Anti-Malware
Weston Hecker introduces SkimBad, an open-source defensive platform designed to actively thwart memory skimming operations at the host process level.
Honeypot Credit Card Canaries
Hecker explains how SkimBad injects hundreds of decoy payment card numbers with synthetic canary attributes into application memory, poisoning scraped batches and alerting processors instantly when breached.
Disrupting the Cybercrime Monetization Chain
By contaminating memory dump batches with unmonetizable decoy card numbers, SkimBad collapses the black market value of stolen retailer card dumps while minimizing incident detection times.
Related talks
Main Stage·40 min
Mikko Hypponen
Mikko Hypponen explores the preservation of historic malware samples, early virus artistry, and four decades of digital threats in the Malware Museum.
Main Stage·16 min
Valerio Alessandroni
Valerio Alessandroni demonstrates how remote access trojans abuse trusted Google Cloud services and APIs for stealthy C2 communication and proxy tunneling.
Main Stage·47 min
Alessandro Magnosi
Malware deployment tactic exploiting NTFS features and emulated read-only filesystems to bypass endpoint inspection.