There is a reason why some features have a "Security" tag - If you don't use them then you won't get security - For Example: A full 60 million U.S. cards were compromised in the past 12 months. While 93 percent of those were EMV chip-enabled, merchants continued to use mag stripes.

Interesting bit - U.S. leads the rest of the world in the total amount of compromised EMV payment cards by a massive 37.3 million records

75 percent, or 45.8 million, were records stolen from in-person transactions (“card-present” in the industry parlance). These were likely compromised through card-skimming malware and point-of-sale (POS) breaches at establishments like retailers, hotels and restaurants.

“There are numerous merchant locations that are still asking their customers to swipe rather than use the chip-insert method, thus completely neglecting the EMV security features,”

https://threatpost.com/u-s-chip-cards-are-being-compromised-in-the-millions/139028/

Be vigilant - Voice phishing scams are becoming harder to differentiate. However, old school best practices still help. Never, give out your PIN or any security information over the Phone

Fraudsters can use a variety of open-source and free tools to fake or “spoof” the number displayed as the caller ID, lending legitimacy to phone phishing schemes. Often, just sprinkling in a little foreknowledge of the target’s personal details — SSNs, dates of birth, addresses and other information that can be purchased for a nominal fee from any one of several underground sites that sell such data — adds enough detail to the call to make it seem legitimate.

https://krebsonsecurity.com/2018/10/voice-phishing-scams-are-getting-more-clever/

BEWARE - cybercriminals have figured out a new way to steal funds from people’s credit cards

The malefactors use a legit remote access tool for mobile devices called AirDroid. They try to dupe as many people as possible into installing the app and authenticating with credentials provided by the attackers. The main target audience is 25 year-olds and up. The idea is to transfer money from a card by sending a specific text message to a short number on behalf of the victim. While this service number varies for different banks, regular Google search helps find it in the blink of an eye.

https://www.tripwire.com/state-of-security/featured/crooks-drain-your-credit-card-account/

In case you have Expedia/Orbitz account - Keep an eye on your credit card statements

The unauthorised intruders may have accessed the personal data of approximately 880,000 customers, including the following information:
•customers’ payment card details
•customers’ full names
•customers’ dates of birth
•customers’ gender
•customers’ email addresses
•customers’ physical addresses
•customers’ billing addresses
•customers’ phone numbers

The data is said to be related to purchases made in the first six months of 2016 for Orbitz platform customers, and between January 1 2016 and December 22 2017 for “certain partners’ customers.”


https://www.tripwire.com/state-of-security/security-data-protection/orbitz-data-breach/

Did you know - Browsers are intermediaries in an online transaction

By moving the storage of payment card details in the browser, the responsibility of keeping these details safe is moved to the browser and the user.

The Payment Request API also demands that users take greater responsibility for their data security. 

For More:
https://www.grahamcluley.com/browser-credit-cards/

Hacking Chip-and-PIN is not "improbable" (according to EMVCo and the UK Cards Association) anymore.

All truth passes through three stages. 

First, it is ridiculed. 

Second, it is violently opposed. 

Third, it is accepted as being self-evident.

— Arthur Schopenhauer, German philosopher (1788 – 1860)

From the article:

When in 2010 a team of computer scientists at Cambridge University demonstrated how the chip and PIN system used on many modern payment cards can be bypassed by making the POS system accept any PIN as valid, the reaction of the EMVCo and the UK Cards Association was to brand the attack as "improbable".

The FUNcard chip was programmed to intercept the POS systems' PIN query and return an answer that says that the PIN is correct.

The card itself didn't look suspicious - the "double" chip still allowed the card to be inserted into POS systems.

Thusly modified cards were used in France by a group of fraudsters that were ultimately arrested in 2011 and 2012 because they repeatedly used them at the same few locations.

According to Wired, the French authorities estimated that before getting arrested, they managed to spend nearly 600,000 euros.

For More info:

http://www.net-security.org/secworld.php?id=19003

"Selfie" based 2nd factor Authentication?

MasterCard wants to try it

From the article:

MasterCard is launching a facial recognition payment service based on “selfies” taken on a smartphone. This new technology features a photo scanner that creates a map of the shopper’s face, which is then translated into a code for confirmation of future payments.

According to a survey released by Visa Europe, 69 percent of Europeans aged 16-24 believe that their lives will be “faster and easier” without passwords. Contactless payments would be the next natural step, enabling shoppers to complete transactions far more quickly.

However, when it comes to the extensive use of biometrics in the payments industry, the biggest hurdle to overcome is widespread adoption. 

For more info:

http://techcrunch.com/2015/08/09/biometric-security-from-selfies-to-walking-gaits

New event (that could have) happened at a ZOO near you - Credit Card Breach

Just be careful (I am not talking about the wild animals here)

From the article:

Service Systems Associates, a company that serves gift shops and eateries at zoos and cultural centers across the United States, has acknowledged a breach of its credit and debit card processing systems.

If a guest used a credit or debit card in the gift shop at one of our partner facilities between March 23 and June 25, 2015, the information on that card may have been compromised.”

At least two dozen cities, including:

Birmingham, Ala.

Tucson, Ariz.

San Francisco, Calif.

Fresno, Calif.

Sacramento, Calif.

Colorado Springs, Colo.

Palm Desert, Calif.

Miami, Fla.

Honolulu, HI

Boise, Id.

Fort Wayne, Ind.

Louisville, Ky.

Baltimore, Md.

Battle Creek, Mich.

Apple Valley, Minn.

Cincinnati, Ohio

Tulsa, Okla.,

Pittsburgh, Penn.

Columbia, SC

Dallas, Texas

El Paso, Texas

Houston, Texas

Nashville, Tenn.

Salt Lake City, Utah

For more info:

http://krebsonsecurity.com/2015/07/credit-card-breach-at-a-zoo-near-you/

Sally Beauty Breached (Again???)

Approximately one year ago they had Credit Card data breach.

They are breached again?
Did they learn any lessons at all



From the Article

Last week, KrebsOnSecurity began hearing from multiple financial institutions about a pattern of fraudulent charges on cards that were all recently sally used at Sally Beauty locations in various states. 

The company also sent out an urgent alert today to its employees, asking associates to direct any customers with credit card issues to the Sally Beauty Web site or to call customer service. “We hadn’t gotten an email like that since last year when we had our breach,” the Sally Beauty employee said on condition of anonymity.

check this link for more details:

https://krebsonsecurity.com/2015/05/sally-beauty-card-breach-part-deux/

Link to the previous Breach article:

http://martin-news-bytes.blogspot.com/2014/03/beauty-chain-sally-beauty-turns-ugly.html

If you shopped in STAPLES - Keep an eye on your credit card activity

Target is old news - STAPLES is the latest - 1.2Million Credit Card information lost

From the Article

“At 113 stores, the malware may have allowed access to this data for purchases made from August 10, 2014 through September 16, 2014,” 

While the Staples breach is dwarfed in the number of lost records by Home Depot and Target, the common link is poorly secured point-of-sale systems and effective malware targeting those platforms and stealing payment card data before it is encrypted.

Follow this link for additional details:

http://threatpost.com/staples-confirms-1-2-million-cards-lost-in-breach/110030

Security is only as good as the weakest link - micro-chipped credit cards are no exception

Hackers didn't hack the cards. They hacked the bank and are processing fake transactions with the more secure cards.

From the Article

Each microchipped credit card has something called a cryptogram. It tells the bank whether a card or transaction has been modified in any way.But the hackers got control of a payment terminal, they could change the data and make a fraudulent purchase.

So what happened with the cryptograms and the card security? The Consumerist says the banks were relying on them to be secure... and no one actually checked the transaction reports! 

Follow this link for additional details:

http://www.wfmynews2.com/story/news/local/2-wants-to-know/2014/10/29/hackers-microchipped-credit-cards/18129591/

Another day , Another Breach - it is STAPLES('s) turn

From the Article

It appears likely that fraudsters have succeeded in stealing customer card data from some subset of Staples locations, including seven Staples stores in Pennsylvania, at least three in New York City, and another in New Jersey.


Follow this link for additional details:

http://krebsonsecurity.com/2014/10/banks-credit-card-breach-at-staples-stores/

New member to the list of credit card hacked companies - it is UPS now

News might be new but

It started infiltration started in January and attacks in March

And...........

We only know now

Customers’ credit and debit card information at 51 franchises in 24 states may have been compromised.


Follow this link for additional details:

http://time.com/3151681/ups-hack/

Chip-n-Pin may be better than swipe card but still vulnerable

(From the article)

His team found that several devices were not, in fact, made to the security specifications they claimed to follow. With a minimum of effort, he said they could wiretap the devices and extract the PIN during a sale.

Scammers installed their evil wares into card readers before they were even delievered to merchants.

In order to get European merchants to switch, the banks promised merchants that they would be responsible for fraudulent charges. With swipe cards, a fraudulent charge is simply reversed to the merchant. 

The victims of fraud were frequently blamed by the banks, who accused them of exposing their PINs somehow. In other cases, the banks simply changed their minds and reversed charges to the merchants. In extreme cases, banks and credit card companies declined to press charges against known scammers, apparently out of embarrassment.

The link below has more information:-

http://securitywatch.pcmag.com/hacking/326213-chip-and-pin-cards-more-secure-than-swipe-cards-also-pretty-awful

Apple scammed 42 time - by a 24 Year old:-

Simple but brilliant..............

From the article)

Parrish allegedly tricked Apple Store employees in 16 states starting around December 2012 into accepting fake authorization codes to purchase $309,768 worth of Apple goods.

Here’s how it works: Parrish allegedly visited Apple Stores and tried to buy products with four different debit cards, which were all closed by his respective financial institutions. When his debit card was inevitably declined by the Apple Store, he would protest and offer to call his bank — except, he wasn’t really calling his bank.

he would offer the Apple Store employees a fake authorization code with a certain number of digits, which is normally provided by credit card issuers to create a record of the credit or debit override

“It does not actually matter what code the merchant types into the terminal,” the U.S. Attorney’s Office in New Jersey said publicly after a similar case occurred there in February. “Any combination of digits will override the denial.”

The link below has more information:-

http://www.businessinsider.com/sharron-laverne-parrish-jr-charged-with-apple-credit-card-scam-2014-7

Another day another Breach - Now it is Goodwill (Victim 8)

I am getting tired of tracking(check my list at the end)

(From the article)

According to sources in the financial industry, multiple locations of Goodwill Industries stores have been identified as a likely point of compromise for an unknown number of credit and debit cards.

t remains unclear how many Goodwill locations may have been impacted, but sources say they have traced a pattern of fraud on cards that were all previously used at Goodwill stores across at least 21 states

those same financial industry sources say the breach could extend back to the middle of 2013.

Financial industry sources said the affected cards all appear to have been used at Goodwill stores, but that the fraudulent charges on those cards occurred at non-Goodwill stores, such as big box retailers and supermarket chains. This is consistent with activity seen in the wake of other large data breaches involving compromised credit and debit cards, including the break-ins at Target, Neiman Marcus, Michaels, Sally Beauty, and P.F. Chang’s.

The link below has more information:-

http://krebsonsecurity.com/2014/07/banks-card-breach-at-goodwill-industries/

Previous Victims: (Count started in March 2014)

7. SPEC Liquor Chain - Half a million cards (Lasted 18 Months)

http://martin-news-bytes.blogspot.com/2014/04/liquor-chain-credit-card-breach-whats.html

6. Anonymous claims 800 Million credit card 

http://martin-news-bytes.blogspot.com/2014/03/not-sure-how-true-this-anonymous.html

5. California DMV

http://martin-news-bytes.blogspot.com/2014/03/another-day-another-data-breach.html

4. US Navy

http://martin-news-bytes.blogspot.com/2014/03/someone-forgot-to-patch-their-databases.html

3. Korea Telecom

http://martin-news-bytes.blogspot.com/2014/03/12-million-customer-records-stolen-korea.html

2.  Comixology

http://martin-news-bytes.blogspot.com/2014/03/another-day-another-data-breach-current.html

1. Sally Beauty

http://martin-news-bytes.blogspot.com/2014/03/beauty-chain-sally-beauty-turns-ugly.html

Credit cards with "CHIP and PIN" are better but they may still be vulnerable

A chain is only as strong as its weakest link

Apparently the weak link here is the Random Number Generator.

According to the article:-

Our new paper shows that it is possible to create clone chip cards which normal bank procedures will not be able to distinguish from the real card.

The paper analyses the EMV protocol, the leading smart card payment system with 1.62 billion cards in circulation, and known as “Chip and PIN” in English-speaking countries.

When a Chip and PIN transaction is performed, the terminal requests that the card produces an authentication code for the transaction. Part of this transaction is a number that is supposed to be random, so as to stop an authentication code being generated in advance. However, there are two ways in which the protection can by bypassed: the first requires that the Chip and PIN terminal has a poorly designed random generation (which we have observed in the wild); the second requires that the Chip and PIN terminal or its communications back to the bank can be tampered with (which again, we have observed in the wild).

To carry out the attack, the criminal arranges that the targeted terminal will generate a particular “random” number in the future (either by predicting which number will be generated by a poorly designed random number generator, by tampering with the random number generator, or by tampering with the random number sent to the bank). Then the criminal gains temporary access to the card (for example by tampering with a Chip and PIN terminal) and requests authentication codes corresponding to the “random” number(s) that will later occur. Finally, the attacker loads the authentication codes on to the clone card, and uses this card in the targeted terminal. Because the authentication codes that the clone card provides match those which the real card would have provided, the bank cannot distinguish between the clone card and the real one.

Because the transactions look legitimate, banks may refuse to refund victims of fraud.

The link below has more information:-

http://www.lightbluetouchpaper.org/2014/05/19/the-pre-play-vulnerability-in-chip-and-pin/

Another incident that reminds that people should use credit cards instead of debit cards.

According to the article:-

Earlier this month, I began hearing from sources in the banking industry about fraudulent debit card activity on cards that were all recently used at self-service stamp vending machines at U.S. Post Offices in at least 13 states and the District of Columbia.

Banking sources said the fraud follows a fairly consistent pattern: The thieves are targeting debit card users and somehow stealing the PINs associated with the cards. Ostensibly, the fraudsters then fabricate new cards and make cash withdrawals at ATMs ranging from $500 to $800 per card.

One way to protect yourself against this type of fraud is to use a credit card in lieu of a debit card whenever possible. With a credit card, your liability is maxed out at $50 in the case of fraudulent transactions. Things get more complicated with debit cards. Although many banks also will observe the $50 limit on debit card fraud, customers could be facing losses of up to $500 if they wait more than two business days after learning about the fraud to report it. 

The link below has more information:-

http://krebsonsecurity.com/2014/05/postal-service-beware-stamp-kiosk-skimmers/

Another day , Another Credit card Breach - Michaels

While  web servers (and other application) using OpenSSL are (Heart)Bleeding Credit card data breach continuous - Michales had a 8 month long breach leading up to 3 Million  cards.

According to the article:-

According to Michaels, the affected systems contained certain payment card information, such as payment card number and expiration date, about both Michaels and Aaron Brothers customers. 

The company’s statement says the attack on Michaels’ targeted “a limited portion of the point-of-sale systems at a varying number of stores between May 8, 2013 and January 27, 2014.”

This incident marks the second time in three years that Michaels Stores has wrestled with a widespread compromise of its payment card systems.

Michaels says that while the Company has received limited reports of fraud, it is offering identity protection, credit monitoring and fraud assistance services through AllClear ID to affected Michaels and Aaron Brothers customers in the U.S. for 12 months at no cost to them. 

Incidentally, credit monitoring services will do nothing to protect consumers from fraud on existing financial accounts — such as credit and debit cards — and they’re not great at stopping new account fraud committed in your name. The most you can hope for with these services is that they alert you as quickly as possible after identity thieves have opened or attempted to open new accounts in your name.

The link below has more information:-

http://krebsonsecurity.com/2014/04/3-million-customer-credit-debit-cards-stolen-in-michaels-aaron-brothers-breaches/

Finally LaCie admits that it had Credit Card Breach

According to the article:-

Computer hard drive maker LaCie has acknowledged that a hacker break-in at its online store exposed credit card numbers and contact information on customers for the better part of the past year. The disclosure comes almost a month after the breach was first disclosed by KrebsOnSecurity.

On Mar. 17, 2014, this blog published evidence showing that the Web storefront for French hardware giant LaCie (now owned by Seagate) had been compromised by a group of hackers that broke into dozens of online stores using security vulnerabilities in Adobe’s ColdFusion software.

It is unclear how many customer records and credit cards may have been accessed during the time that the site was compromised; Over said in his email that the company did not have any additional information to share at this time.

The link below has more information:-

http://krebsonsecurity.com/2014/04/hardware-giant-lacie-acknowledges-year-long-credit-card-breach/