Make Point of Sale security a reality with DNS
Point-of-Sale systems are used to process a ton of customer transactions. But what happens when convenience gets in the way of security?
Key takeawaysThis key takeaway was generated through LLMs crawling the page and coming up with an overview of the content.The article explains how point-of-sale (POS) systems are frequent targets for data breaches because they process highly sensitive cardholder data in clear-text in memory before encryption, enabling RAM-scraper malware to harvest Track 1/Track 2 data and exfiltrate it, often by encoding and tunneling over DNS. It describes an attack flow where adversaries gain initial access (phishing, social engineering, or disclosed exploits), push malicious updates to terminals, scrape memory for card data, and send the stolen data via DNS to remote command-and-control servers. The piece outlines how BlueCat DNS Edge defends POS environments by enabling strict whitelist policies, blocking or monitoring non-permitted DNS requests, surfacing blocked queries and malicious patterns, and thereby reducing time-to-detect and isolate compromised terminals to limit operational and customer-impacting breaches.
Why are POS systems particularly vulnerable to data theft despite PCI standards?
POS systems remain vulnerable because sensitive card data exists in clear-text in terminal memory during batching and processing before it is encrypted for transmission, creating a narrow but exploitable window for RAM-scraper malware. While PCI DSS mandates controls such as firewalls, encryption in transit, and anti-malware, attackers use social engineering, phishing, or known vendor exploits to bypass those external defenses and install malicious updates or code. Once malware runs on POS servers or terminals, it can scrape memory, package the captured Track 1/Track 2 data (often Base64-encoded), and exfiltrate it over channels like DNS, which many organizations historically under-monitor.
How do attackers exfiltrate stolen payment data using DNS?
After RAM scrapers harvest clear-text card data from terminal memory, attackers often package the information (for example, encoding it in Base64) and chunk it into strings appended to DNS query names or URLs. Because DNS is a ubiquitous, often-allowed protocol, these malicious queries are sent to attacker-controlled name servers or C2 infrastructure, enabling stealthy data tunneling out of the network. The use of DNS for exfiltration leverages the protocol’s normal behavior and a lack of monitoring, allowing adversaries to collect batches of stolen data without directly contacting externally suspicious services.
What specific capabilities does DNS Edge provide to protect POS environments and speed incident response?
DNS Edge helps teams create strict whitelist policies that permit POS terminals to communicate only with a pre-authorized set of on-network services and domains, effectively blocking or flagging any out-of-scope DNS requests. Deployed points of DNS Edge (for example, behind internal POS servers) can analyze all DNS queries to detect malicious patterns such as tunneling or domain-generation-algorithm activity and surface violated block or monitor policies. Reviewing blocked queries and their originating hosts in the Edge console enables faster identification of potentially compromised terminals and shortens mean-time-to-repair, aiding containment and forensic prioritization.
You may not be intimately familiar with Point of Sale (POS) systems but unless you’ve been living under a rock, you’ve definitely used them. They’re everywhere these days – from older cash register look alikes to hot new mobile POS card readers tethered to mobile phones. See something you like? Swipe, tap or PIN away, and you own it.
But are you confident your credit card details aren’t being shared?
Unfortunately, POS security is a real challenge, because these payment systems are a favorite target of hackers, and account for 90% of the data breaches seen in the industry according to Verizon’s DBIR 2018 report. The drive behind this is the demand on the black market for credit card data, with active numbers fetching $1 to $3 or more apiece. For example, the now infamous Target breach in 2013 affected 40 million customer debit and credit card accounts – a staggering amount. Network teams must do more to protect customers.
Point-of-sale system are rather straightforward. They collect customer data and apply updates. The information collected by terminals is incredibly sensitive, and deserves appropriate data protection. Sensitive customer information like names, addresses, contact information and of course credit card information is routinely processed with every transaction. This is often referred to as Track 1 and Track 2 data. Several times a day, updates are pushed down to the terminals on things like inventory levels, pricing and promotions.
The systems are secured – for the most part – and governed by the Payment Card Industry (PCI) which sets the Data Security Standard (DSS). These standards require the use of things like using a firewall, encrypting sensitive data in transit across open, public networks, using regularly-updated anti-malware solutions. The list goes on.
But hackers have found a loophole.
They target the most vulnerable point of the POS – on the terminal as it’s batching payments for processing. This procedure is done in-memory on the device before it’s encrypted and sent to internal servers for processing. Using a small window, RAM scrapers can gain access, infected the terminal and harvest this payment data to send it off to the adversary’s remote Command & Control (C2) server.
THE ATTACK
Here’s how it works.
First RAM scrapers bypass external defenses such as a firewall or IDS using run-of-the-mill methods like social engineering, phishing. Sometimes they use embedded links in vulnerability exploits that are often disclosed and patched every month by the PoS vendors themselves. Once inside, they infect the central POS servers to push down a malicious update to the terminals.
It’s a real cat-and-mouse game.
Once the malicious RAM scraper has infected the terminal, it targets the clear-text credit card data, collects the data and begins processing it. In the majority of these cases this process includes packaging the data using Base64 encoding, or another format, and chunking it into packets of weird strings appended to the front of a URL. It then sends this data over DNS to a malicious server for collection.
How BlueCat DNS Edge Helps
DNS security to the rescue.
DNS Edge, the cornerstone of BlueCat’s intelligent security offerings, helps network security to prevent these exploits.
First, it allows teams to set whitelist policies that automatically block all non-relevant connections. These are like “single-lane highways with no exits” between the POS devices and the terminals during a transaction. If a POS terminal attempts to go outside that narrow list of whitelisted domains, it can be blocked or monitored.
For example, If a POS device is trying to reach google.com, that’s a problem. Visiting Google.com is outside the device’s normal function, so it indicates there’s a compromise and that terminal needs to be ripped out of the wall.
DNS Edge service points elsewhere on your network (for example, placed behind your internal PoS Server) can help analyze all DNS queries and identify patterns of malicious activity like tunneling or any DGAs. Adversaries are known to attempt data exfiltration from multiple spots.
Reviewing DNS data in the DNS Edge console to look at violated block and monitor policies, in addition to malicious patterns detected by its smart analytics, can help shorten mean-time-to-repair and identify patient zero.
DNS is a powerful protocol that adversaries have been exploiting maliciously for many years as it’s often been unmonitored by most organizations.
How This Works in Edge
Create a policy in Edge to whitelist only the on-network services and domains point-of-sale terminals are allowed to speak to.
Attempts to reach any domains outside of the allowed list are blocked.
Review blocked query attempts within Edge and the originating host to identify potentially compromised PoS devices.
Published in:
Mark is a Senior Product Marketing Manager at BlueCat Networks.
Related content
How to map your network with user-defined links in Integrity X
Map your network with user-defined links in Integrity X to define and manage custom relationships, such as dual-stack and NAT environments.
Automate your DDI modernization path by migrating with Micetro
Automate cross-platform DNS and DHCP migration with Micetro to reduce risk, eliminate manual effort, and modernize infrastructure faster.
Your journey to intelligent NetOps begins at Cisco Live
Visit BlueCat’s booth or book a meeting now to learn more about how our solutions can help you build a network that supports constant change.
Replace BIND and ISC with Micetro DNS/DHCP Server (MDDS)
Tired of patching and manually configuring BIND DNS and ISC DHCP? Discover how Micetro MDDS appliances can replace them for modern DDI.