But according to telco Verizon Business’ Risk team, which published the findings, a “fairly new” threat in the shape of RAM scrapers is increasingly being used by online thieves to bypass PCI DSS rules requiring credit card data to be encrypted anyway.
The company’s 2009 Data Breach Investigations Report found that 74% of security incidents were the result of external attacks. Such events resulted in a huge 285 million records being compromised over the last year - mainly via online systems.
Only 20% of data breaches were caused by insiders, 32% by business partners and 39% by multiple parties. Some 67% of the incidents occurred because the attacker exploited errors made by the victim, while a further 64% were the result of hacking and 38% of malware.
But in its 2009 Supplemental Report called Anatomy of a Data Breach, Verizon Business also pointed to the rising threat of RAM scrapers.
RAM scrapers work by scouring the volatile random access memory in point-of-sale terminals, which process, store or transmit PINs and other credit card data in unencrypted form. When the program detects such information, it captures it and uploads it to servers that are usually controlled by malicious external sources but sometimes belong to trusted partners.
While the technology has been around for a few years, its usage has now increased to the extent that it came in at number 14 in Verizon’s 15 most common type of security attack. Keylogging and spyware software ranked number one, followed by backdoors and SQL injections.
RAM scrapers are often used in conjunction with other malware such as backdoors and command-and-control programs and have to date mainly been discovered in systems belonging to the retail and hospitality sectors.