PCI DSS Compliance : Scan Interference

Interference from either the network or the host did not allow the scan to fulfill the PCI DSS scan validation requirements. This report is insufficient to certify this server. There may be a firewall, IDS or other software blocking Nessus from scanning. C Tenable Network Security, Inc...

QID 86725 “F5 BIG-IP Load Balancer Internal IP Address Disclosure”

QID 86725 “F5 BIG-IP Load Balancer Internal IP Address Disclosure Vulnerability” will be marked as a PCI Fail as of May 1, 2018 in accordance with its CVSS score. F5 BIG IP encodes private IP addresses in the persistent cookies, which could be collected by the attacker and decoded back. The...

OS vulnerabilities detected in banner reporting (PCI-DSS check)

A service banner response from the remote host indicates an OS install at a level that may be vulnerable to one or more vulnerabilities. This plugin only runs when 'Check for PCI-DSS compliance' is enabled in the scan policy. It does not run if local security checks are enabled. It runs off of...

Kernel vulnerabilities detected in banner reporting (PCI-DSS check)

A service banner response from the remote host indicates a Linux kernel install at a level that may be vulnerable to one or more non-denial-of-service vulnerabilities. This plugin only runs when 'Check for PCI-DSS compliance' is enabled in the scan policy. It does not run if local security checks...

PCI DSS Compliance : Point-of-Sale (POS) Software

Due to increased risk to the cardholder data environment when a point-of-sale system is visible on the Internet, 1 confirm that this system needs to be visible on the Internet, that the system is implemented securely, and that original default passwords have been changed to complex passwords, or ...

PCI DSS v3.2 & Exposing Session ID in URL

Passing the session ID in the URL such as QID 150068 “Session ID in URL” will be marked as a Fail for PCI as of April 15, 2018 in accordance with PCI DSS v3.2. QID 150068 is a PCI Fail according to PCI DSS v3.2 Requirement 6.5.10: 6.5.10 Examine software development policies and procedures and...

If You Think File Integrity Monitoring is Boring, Think Again

You’ll be hard pressed to find file integrity monitoring on any list of cool, emerging, cutting-edge cybersecurity technologies. But if you choose to ignore this mature, foundational technology, it’ll be at great risk. File integrity monitoring, or FIM, plays a key role in critical security and...

SSL/TLS Services Support RC4 (PCI DSS)

At least one of the SSL or TLS services on the remote host supports the use of RC4 for encryption. RC4 does not meet the PCI definition of strong cryptography as defined by NIST Special Publication 800-57 Part 1. The RC4 cipher is flawed in its generation of a pseudo-random stream of bytes so tha...

Weak DH Key Exchange Supported (PCI DSS)

At least one of the services on the remote host supports a Diffie-Hellman key exchange using a public modulus smaller than 2048 bits. Diffie-Hellman key exchanges with keys smaller than 2048 bits do not meet the PCI definition of strong cryptography as specified by NIST Special Publication 800-57...

OnePlus Site’s Payment System Reportedly Hacked to Steal Credit Card Details

This year's first bad news for OnePlus users—a large number of OnePlus customers are reporting of fraudulent credit card transactions after buying products from the Chinese smartphone manufacturer's official online store. The claim initially surfaced on the OnePlus support forum over the weekend...

PCI DSS v3.2 & Private IP Address Disclosure

Private IP addresses disclosure such as QID 86247 “Web Server Internal IP Address/Internal Network Name Disclosure Vulnerability” will be marked as a Fail for PCI as of February 1, 2018 in accordance with PCI DSS v3.2. QID 86247 is a PCI Fail according to PCI DSS v3.2 Requirement 1.3.7: 1.3.7 Do...

Cloudflare: Cloudflare does not sufficiently truncate credit card numbers in invoices

When a Cloudflare user has a paid account, but Cloudflare can't process the user's credit card, Cloudflare emails the user from [email protected], subject line "Cloudflare Failed Taking Payment for INV-D1234567". The email contains an attachment, "2017-11-19CloudflareINV-D1234567.pdf", a PDF...

TLS Version 1.0 Protocol Detection

The remote service accepts connections encrypted using TLS 1.0. TLS 1.0 has a number of cryptographic design flaws. Modern implementations of TLS 1.0 mitigate these problems, but newer versions of TLS like 1.2 and 1.3 are designed against these flaws and should be used whenever possible. As of...

GDPR Talk Dominates Barcelona’s  PCI DSS Community Conference

Recently, I returned from the European PCI DSS community conference in Barcelona. As always, the conference featured analysis of current hot topics within the PCI community and was helpful for any security professional looking to learn about the latest advancements in data security and protection...

An Analysis of PCI DSS Requirement 11.3.4.1 and the Compliance Expectations

For some organizations, understanding, navigating, and complying with the Payment Card Industry PCI Data Security Standard DSS, especially after the release of the latest version v3.2 released in April 2016, has become confusing and/or challenging because of the inclusion of phased-in applicabili...

Lessons Learned from the Equifax Disaster

143 million U.S. consumers, Equifax.com users who may have been affected by the the worst data breach in history are receiving all sorts of advice including a free TrustedID product license from Equifax. But despite numerous public reports about the incident, there are still many important...

Threat Intelligence for WAF

It’s all about security rules Stephen Hawking said, “Intelligence is the ability to adapt to change”. One could say much the same of web application firewalls and WAF security rules. With web applications now one of the most attacked components of IT infrastructures, organizations have a critical...

Command Execution Vulnerability in Dahua DSS-Peaceful City

DSS-Safe City is a set of integrated monitoring and management platform. Dahua DSS-Peaceful City uses Apache Struts 2 as the web application framework. Due to a remote command execution vulnerability in the software, an attacker can trigger the vulnerability by modifying the Content-Type value in...

PCI DSS v3.2 & Migrating from SSL and Early TLS v1.1

SSL & Early TLS vulnerabilities such as QID 38628 “SSL/TLS Server supports TLSv1.0”\ will be marked as a Fail for PCI as of May 1, 2017 in accordance with the PCI DSS v3.2. For existing implementations, merchants will be able to submit a PCI False Positive / Exception Request and provide proof of...

What's new in RIPS 2.0.0?

The new release RIPS 2.0.0 includes the following major changes: A complete new interface with optimized performance demo.ripstech.com A new extensive REST API for full feature automation api.ripstech.com Team and user privilege management Application-specific analysis profiles More detailed code...