Endpoint
7/3/2012
04:06 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

PIN Pads Put Millions At Risk, Researchers Say

Payment terminals handled more than 852 million card payments in the U.K. alone in April 2012

Payment terminals, known as PIN Pads, are putting hundreds of millions of consumers worldwide at risk everyday a British IT security company is warning.

Click here for more of Dark Reading's Black Hat articles.

The terminals, which are used by retailers, handled more than 852 million card payments in the UK alone in April 2012 according to the UK Cards Association.

Researchers at MWR InfoSecurity have found that the terminals are not secure and codes can be introduced by malicious smartcards that will then allow criminals to have access not only to a customer’s PIN and PAN (Primary Account Number shown on the front of a plastic card) numbers but also gain access to the merchant’s network.

“Our research shows security of PIN Pads is below that which consumers should expect for transactions of this nature. The security employed in the software is not up to the job for such sensitive transactions, leaving the devices open to many forms of attack”, said Ian Shaw, Managing Director of MWR InfoSecurity.

“As a result of this, a sophisticated attacker may be able to compromise these terminals to the extent that it would be very difficult to identify if they had been breached.”

“Our investigations have shown that the range of vulnerabilities found in these devices, now part of the everyday shopping experience, could compromise consumers’ card details and PIN numbers. It may also leave merchants unprotected and cause serious disruption to their businesses, potentially exposing both of them to serious fraud”, he added.

For example, a customer at a restaurant could pretend to be making a payment with a “Trojan card” but instead has gained access to the payment terminal. From that point onwards, all pin numbers and other card holder information that passes through that terminal can be gathered by the criminal. They can then take advantage of a number of existing communication channels, such as Internet connection –Wireless, Bluetooth, mobile networks– or phone lines to retrieve that information. Alternatively, the criminal could return and insert again the malicious smartcard to collect the recorded data from the payment device.

“Generally, efforts are being directed to securing the PIN Pads physically but the software installed in the terminals remains highly vulnerable. Even the typical consumer smartphone deploys more security features than the technology used in these devices”, said Ian Shaw.

MWR InfoSecurity has been carrying out research on payment terminals that exchange information with this type of card and has found an alarming range of weaknesses shared by vendors of these devices in UK.

The firm has contacted the vendors and has shared their discoveries with them but at the moment is not able to provide any further details in an effort to prevent criminals from taking advantage of the situation.

“We need to work together with the vendors so that the problem is dealt with quickly”, concluded Shaw.

However, MWR believes this is very serious issue and will be highlighting a number of vulnerabilities it has identified and demonstrating its findings at the Black Hat security conference in Las Vegas on July 25th.

MWR InfoSecurity supplies services which support clients in identifying, managing and mitigating their Information Security risks.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Microsoft Word Vuln Went Unnoticed for 17 Years: Report
Kelly Sheridan, Associate Editor, Dark Reading,  11/14/2017
Companies Blindly Believe They've Locked Down Users' Mobile Use
Dawn Kawamoto, Associate Editor, Dark Reading,  11/14/2017
121 Pieces of Malware Flagged on NSA Employee's Home Computer
Kelly Jackson Higgins, Executive Editor at Dark Reading,  11/16/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Managing Cyber-Risk
An online breach could have a huge impact on your organization. Here are some strategies for measuring and managing that risk.
Flash Poll
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
Enterprises are spending more of their IT budgets on cybersecurity technology. How do your organization's security plans and strategies compare to what others are doing? Here's an in-depth look.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.