Hackers put security tool that finds payment card data into their arsenalMay 30, 2014 – 5:19 AM
Like a crowbar, security software tools can be used for good and evil.
Bootleg versions of a powerful tool called “Card Recon” from Ground Labs, which searches for payment card data stored in the nooks and crannies of networks, have been appropriated by cybercriminals.
This month, the security companies Trend Micro and Arbor Networks published research into point-of-sale malware, which has been blamed for data breaches at retailers such as Target and Neiman Marcus, sparking concerns over the security of consumer data.
Both companies found that unauthorized copies of Card Recon had been incorporated into a malware program and a toolkit designed for finding and attacking POS terminals.
“Card Recon looks to be a useful tool when wielded by an auditor or security staff, but it is clearly dangerous in the wrong hands,” Arbor Networks wrote in its report.
Card Recon is intended for organizations seeking to comply with the Payment Card Industry’s Data Security Standard (PCI-DSS), a set of recommendations to safeguard payment card data.
The software tool scans all parts of a network to see where payment card data is stored. Often, companies find card details stashed in unlikely and unknown places. Card Recon compiles a thorough report, and companies can then move to secure the data.