What is a 'RAM Scraping Attack'

A RAM scraping attack is a type of digital attack which implants malware in a point-of-sale (POS) terminal to steal consumer credit card information.

BREAKING DOWN 'RAM Scraping Attack'

RAM scraping attacks were first identified by security researchers in an alert issued by Visa in October 2008. Visa noticed that cybercriminals had infiltrated point-of-sale (POS) machines and gained access to unencrypted customer information from the volatile random access memory (RAM) system within those terminals. Targets of those early scrapers tended to be in the hospitality and retail industries. These industries process huge volumes of credit card transactions at a similarly huge number of locations. Investigators noticed an uptick in the introduction of new malware bugs between 2011 and 2013 but POS attacks did not gain widespread attention until the rise of BlackPOS in 2013 and 2014. Hackers used this program to infiltrate the networks of the Target and Home Depot retail chains. The Target and Home Depot attacks coincided with a further multiplication of POS malware variants. In recent years, RAM scrapers have steadily been replaced by more sophisticated malware elements such as screen grabbers and keystroke loggers. 

How RAM Scrapers Work

The plastic credit cards that we all carry contain two sets of information. The first is contained within the magnetic stripe and invisible to the human observer. Within the stripe are two tracks of electronic information that identifies the card account and account holder. Track 1 contains an alphanumeric sequence based on a standard developed by the International Air Transport Association (IATA). This sequence contains the account number, cardholder’s name, expiration date and other data in a sequence recognizable by all POS machines. Track 2 uses a shorter but analogous sequence developed by the American Bankers Association (ABA). A third track is almost entirely unused.

The second identifier on a credit card is the three- or four-digit code often located on the back of the card, known as the card verification number (CVN) or card security code (CSC). This number can add an additional layer of security if it is not included in the electronic data contained in the magnetic stripe. The data that a POS terminal collects from Track 1 and Track 2, sometimes including the CVN or CSC in Track 1, are held in the memory of that POS machine until it is periodically purged.

All parties to the credit card transaction chain are beholden to the 12 security requirements detailed in the Payment Card Industry Data Security Standard (PCI DSS), but hackers have taken advantage of gaps in this framework. The gap that is directly vulnerable to RAM scrapers is the temporary storage of large amount of intact credit card data stored in the POS machines’ software for a short period after transacting a sale. Small merchants are a relatively easy target for cybercriminals, but larger retailers like Target and Home Depot are far more attractive due to the massive amounts of data they retain at any given time. So far, hackers have been rewarded for taking the time to attack those big firms’ extensive security systems.

  1. Point of Purchase - POP

    A point of purchase is a place where sales transactions occur, ...
  2. Point Of Sale - POS

    A point of sale (POS) is where customers execute payments for ...
  3. Credit Card Dump

    A credit card dump is a criminal practice wherein a person or ...
  4. Cloning

    Cloning is copying stolen credit or debit card information to ...
  5. Credit Card

    Issued by a financial company giving the holder an option to ...
  6. Chip-And-PIN Card

    A chip-and-PIN card is a credit or debit card that contains data ...
Related Articles
  1. Personal Finance

    Which Home Depot Card Do You Need?

    Got a home improvement project? A Home Depot credit card can help you get supplies to tackle it – but keep in mind these downsides.
  2. Personal Finance

    What happens when your credit card expires?

    Find out why it's a good idea to change and update your credit card once in a while. Learn about other cards that may better suit your needs.
  3. Personal Finance

    10 Considerations For Using Your Credit Card Abroad

    Credit cards can be the best item you pack when traveling, just make sure that you are taking the right card that suits your needs.
  4. Insights

    Equifax Hack: 5 Biggest Credit Card Data Breaches

    Credit bureau Equifax revealed a giant data breach covering 143 million customers including credit cards.
  5. Personal Finance

    How Credit Cards Affect Your Credit Rating

    The average American household has four cards, but does that mean more is better?
  6. IPF - Banking

    Credit versus debit cards: Which is better?

    Credit and debit cards may look identical, it is important to note their differences. Be strategic about which card you choose and learn more about which is better for you.
  7. Personal Finance

    Why More Millennials Need Credit Cards

    Here's why more Millennials should have credit cards – even though a majority don’t.
  8. Personal Finance

    10 Reasons To Use Your Credit Card

    There's a surprising credit card strategy you should employ as a consumer ... use your card for everything (or almost).
  9. Personal Finance

    Take Control Of Your Credit Cards

    The plastic in your wallet doesn't have to hurt your finances. Learn how to manage it responsibly.
Trading Center