via https://ift.tt/2aWSl1P
Microfinance institution rolls out mobile banking, ATM cash-by-code with Compass Plus
via https://ift.tt/2aZybVR
Westin, Marriott, and Hyatt hotels hit with payment malware
HEI Hotels has issued a notice alerting its customers about a credit card breach. The company first became aware of the issue when its bank card processor told it there was a possible security issue at play. HEI Hotels initiated what it says was an “extensive forensic investigation,” which turned up malware installed on payment processing systems at certain hotels. The current list of affected locations includes hotels under the Marriott, Hyatt, and Westin chains, among others.
Tags:
via https://ift.tt/2aXhPwB
Hackers Compromise Keyless Entry Systems On Every Volkwagen AG Vehicle For The Last 20 Years
Tens of millions of vehicles sold by Volkswagen AG over the past 20 years are vulnerable to theft because keyless entry systems can be hacked using cheap technical devices, according to European researchers.
via https://ift.tt/2bdWWiI
We can get into your car, say hackers
A group of computer security experts say they have figured out how to hack the keyless entry systems used on millions of cars, meaning that thieves could in theory break and steal items without leaving a broken window. The experts say that remote entry systems on millions of cars made by Volkswagen since 1995 can be cloned to permit unauthorized access to the car’s interior.
via https://ift.tt/2aWCMYe
Bangladesh c.bank says withholding heist probe info from ‘foreign perpetrators’
Bangladesh’s central bank said it is withholding findings of investigations into the cyber theft of $81 million from its account at the Federal Reserve Bank of New York to avoid tipping off the "foreign perpetrators" of the hack. Bangladesh Bank lawyer Ajmalul Hossain was responding to comments by Rizal Commercial Banking Corp. in the Philippines – through which the stolen money was routed before disappearing into Manila’s casino industry – that the central bank in Dhaka was wary of releasing reports that could implicate its own officials.
via https://ift.tt/2bhNPcU
NIST is No Longer Recommending Two-Factor Authentication Using SMS
NIST is No Longer Recommending Two-Factor Authentication Using SMS
NIST is no longer recommending two-factor authentication systems that use SMS, because of their many insecurities. In the latest draft of its Digital Authentication Guideline, there’s the line:
[Out of band verification] using SMS is deprecated, and will no longer be allowed in future releases of this guidance.
Tags: authentication, NIST, SMS, two-factor authentication
Posted on August 3, 2016 at 7:11 AM
• 0 Comments
via https://ift.tt/2asqG7Z
Android Tamer: Virtual platform for Android security professionals
Android Tamer is a free and open source Swiss army knife type of tool for Android security.
The recently released version 4 moves towards Debian package compatibility. Users are able to obtain or use Android Tamer in multiple formats:
1. Download the OVA directly and use it.
2. Configure Debian 8 machines to use tools from Android Tamer repositories.
3. A Vagrant Image can be used to build Android Tamer and see the process transparently.
More options such as ISO and Docker builds are in the works and should be available soon.
“As with any other open source project, I’m faced with multiple challenges. The highly volatile nature of the upstream projects (frequent updates, no release tags, sudden project abandonment), and the fact that each developer has his/her own idea on how to run a tool, are the main reasons we have more than 60 open bugs related to adding new tools to Android Tamer,” Anant Shrivastava, Leader at Android Tamer, told Help Net Security.
The project is looking for contributors in different areas, including writing documentation and testing and bug reporting, to take everything to the next level.
Future plans
The aim of the project is to become a one-stop location for anything related to Android security. The development team is working on the following:
- Android Tamer VM: Standard Linux distribution customized for Android security
- Tools repository: A Debian (and Red Hat in the future) compatible repository of Android security tools
- Custom Android emulator: specifically customized to help with Android security
- Android Play Store equivalent for offensive and defensive software that are not available on Google Play.
If you’re at Black Hat USA 2016 in Las Vegas this week, you can see the tool in action at the Arsenal.
via https://ift.tt/2b4sy6P
75% of the top 20 US banks are infected with malware
SecurityScorecard released its 2016 Financial Cybersecurity Report, a comprehensive analysis that exposes cybersecurity vulnerabilities across 7,111 global financial institutions including investment banks, asset management firms, and major commercial banks.
Among the report’s findings are the following observations:
- The US Commercial bank with the lowest security posture is one of the top 10 largest financial service organizations in the US (by revenue).
- Only one of the top 10 largest banks, Bank of America, received an overall “A” grade.
- 95 percent of the top 20 US commercial banks (by revenue) have a Network Security grade of “C” or below.
- 75 percent of the top 20 US commercial banks (by revenue) are infected with malware and a number of malware families were discovered within these banks, including Ponyloader, and Vertexnet.
- Nearly 1 out of 5 financial institutions use an email service provider with severe security vulnerabilities.
- The best performing Investment Banks in IT Security include Goldman Sachs, Exchange Bank, BNP Paribas Fortis and Banco Popolare.
Each US financial organization was evaluated based on their overall security hygiene and security reaction time compared to their industry peers. The conclusions and rankings featured in the report are based on data derived from SecurityScorecard’s security rating platform.
The company also analyzed the specific security ratings of Scottrade, Bangladesh Bank, and CharlesSchwab, all of which fell victim to data breaches recently. The analysis provides details on the data breaches as part of a holistic view on the financial industry’s vulnerability to attacks.
Additionally, the company found third party vendors and partners that provide essential services to the financial services industry also pose some of the greatest security risks.
“As banks continue to grow through acquisition, legacy IT systems and their vulnerabilities are also acquired. In many cases, they remain in place for years,” said Sam Kassoumeh, a cybersecurity expert with over 10 years’ experience and COO and Co-Founder of SecurityScorecard.
“Despite major financial institutions spending billions of dollars on cybersecurity annually, this report suggests the financial industry may not be spending those dollars as effectively as possible. A greater level of protection is required, which should be a concern for their customers and partners.”
“Financial companies rely on data exchanges with other vendors and may have limited visibility into the cyber risk associated with these transactions. As cybercriminals find new ways to attack, breach, and exploit organizations, threat patterns such as phishing, spear-phishing, and social engineering evolve and become more sophisticated. Financial organizations need solutions that assess vulnerabilities continuously and have the ability to see risks and vulnerabilities before a breach takes place,” said Dr. Luis Vargas, Sr. Data Scientist at SecurityScorecard.
via https://ift.tt/2aDkJ9Q
This ATM Hack Allows Crooks to Steal Money From Chip-and-Pin Cards
Forget about security! It turns out that the Chip-and-PIN cards are just as easy to clone as magnetic stripe cards.
It took researchers just a simple chip and pin hack to withdraw up to $50,000 in cash from an ATM in America in under 15 minutes.
We have been told that EMV (
Europay, MasterCard and Visa
) chip-equipped cards provides an extra layer of security which makes these cards more secure and harder to clone than the old magnetic stripe cards.
But, it turns out to be just a myth.
A team of security engineers from Rapid7 at Black Hat USA 2016 conference in Las Vegas demonstrated how a small and simple modifications to equipment would be enough for attackers to bypass the Chip-and-PIN protections and enable unauthorized transactions.
The demonstration was part of their presentation titled,
“Hacking Next-Gen ATMs: From Capture to Washout,”
[
]. The team of researchers was able to show the audience an ATM spitting out hundreds of dollars in cash.
Here’s How the Hack Work
The hack requires two processes to be performed.
First, the criminals need to add a small device known as a
Shimmer
to a point-of-sale (POS) machine (here, ATM’s card reader) in order to pull off a man-in-the-middle (MITM) attack against an ATM.
The shimmer sits between the victim’s chip and the card reader in the ATM and can record the data on the chip, including PIN, as the ATM reads it. It then transmits this data to the criminals.
The criminals then use a smartphone to download this stolen data and recreate the victim’s card in an ATM, instructing it to eject cash constantly.
Tod Beardsley, a security research manager for Rapid7,
the BBC that shimmer is basically a tiny RaspBerry-Pi-powered device that could be installed quickly to the outside of the ATM without access to the internals of the cash machine.
“It’s really just a card that is capable of impersonating a chip,” Beardsley said. “It’s not cloning.”
The perpetrators would only be able to replicate each card for a few minutes and use it to fraudulently withdraw money, enabling them to make between up to $50,000, but Beardsley suggests that a network of hacked chip-and-pin machines could create a constant stream of victims.
Researchers have disclosed full details about the issue in Chip-and-PIN ATMs to banks and major ATM manufacturers and said they hope the institutions (currently unnamed) are examining the issue.
via https://ift.tt/2azMWAP