The FBI expects more to come as the software is affordable and easily available

The U.S. Federal Bureau of Investigation (FBI) is warning retailers that the recent security breach against Target’s credit systems was not a one-time deal, and that they should remain aware of their own software in an effort to ward off similar attacks.

According to Reuters, the FBI sent a confidential, three-page report out to retailers to clue them in on the risks of memory-parsing malware in point-of-sale (POS) systems. The report, dated January 17, is called “Recent Cyber Intrusion Events Directed Toward Retail Firms.”

Memory-parsing software is also known as a “RAM scraping.” It occurs during a normal retail process, where a customer swipes a credit or debit card, the POS terminal grabs the transaction data from the magnetic stripe and transfers it to the payment processing provider. Even though data is encrypted during the process, RAM scrapers have found a very small window where the information appears in plain text while in the computer\’s live memory. At that point, the information is extracted and either used or sold for profit.

The FBI wants retailers to know that they could easily experience the kind of cyber attack that Target endured because memory-parsing malware is affordable, accessible in underground forums and promises huge profits for the hackers.

The FBI report said that many of the POS malware cases it has seen involve small-to-mid sized local or regional businesses, since they can\’t afford the kind of security tools that major retailers can. The estimated losses from these cases range from tens of thousands of dollars to millions of dollars.

While RAM scraping is not a new thing, the cyber attack against Target during the holiday season has drawn more attention to it. Target\’s breach ran from November 27 through December 15, where customer information like their names, card numbers, expiration dates and CVV verification codes were compromised. Also, the breach occurred in nearly all Target stores across the U.S. in-store, not online.

Original reports said the breach affected 40 million customers, but it was later found that it was actually 70 million customers.

Target wasn\’t the only retailer to get hit last year. Neiman Marcus said about 1.1 million customer cards were exposed by a data breach from July 16 to October 30 last year.

“We believe POS malware crime will continue to grow over the near term, despite law enforcement and security firms\’ actions to mitigate it,” said the FBI report.

via DailyTech – FBI: Retailers Beware, Target’s Cyber Attack Was Just a Warm-Up.