PT-2021-5138

Name of the Vulnerable Software and Affected Versions MasterCard, Visa, American Express affected versions not specified Apple Pay affected versions not specified Samsung Pay affected versions not specified GPay affected versions not specified Description The issue is related to insufficient...

PT-2021-5136

Name of the Vulnerable Software and Affected Versions MasterCard Tokenisation Service MDES affected versions not specified Visa Tokenisation Service VTS affected versions not specified Description The issue is related to the arbitrary modification of the Amount field in the ISO 8583 Authorisation...

PT-2021-5137

Name of the Vulnerable Software and Affected Versions MasterCard Tokenisation Service MDES affected versions not specified Description The issue is related to the exploitation of weaknesses in the GPay/MasterCard pair, potentially allowing an attacker to clone transactions and make payments...

PT-2021-5135

Name of the Vulnerable Software and Affected Versions MasterCard Tokenisation Service MDES affected versions not specified Visa Tokenisation Service VTS affected versions not specified Description The issue is related to the arbitrary modification of the Amount field in the ISO 8583 Authorisation...

New Hack Lets Attackers Bypass MasterCard PIN by Using Them As Visa Card

Cybersecurity researchers have disclosed a novel attack that could allow criminals to trick a point of sale terminal into transacting with a victim's Mastercard contactless card while believing it to be a Visa card. The research, published by a group of academics from ETH Zurich, builds on a stud...

New Hack Lets Attackers Bypass MasterCard PIN by Using Them As Visa Card

Cybersecurity researchers have disclosed a novel attack that could allow criminals to trick a point of sale terminal into transacting with a victim's Mastercard contactless card while believing it to be a Visa card. The research, published by a group of academics from ETH Zurich, builds on a stud...

Tuesday’s Magento 1 EOL Leaves Clock Ticking on 100K Online Stores

With Magento 1 reaching end-of-life EOL on Tuesday, Adobe is making a last-ditch effort to urge the 100,000 online stores still running the outdated version to migrate to Magento 2. Magento is a popular, Adobe-owned open-source e-commerce platform that powers many online shops. After June 30...

Mastercard Wades Into Murky Waters With Its New Digital ID

The credit card company has more details about its plan for a decentralized, universal digital ID, but questions remain...

CVE-2019-6702

The MasterCard Qkr! app before 5.0.8 for iOS has Missing SSL Certificate Validation. NOTE: this CVE only applies to obsolete versions from 2016 or earlier...

CVE-2019-6702

The MasterCard Qkr! app before 5.0.8 for iOS has Missing SSL Certificate Validation. NOTE: this CVE only applies to obsolete versions from 2016 or earlier...

Design/Logic Flaw

The MasterCard Qkr! app before 5.0.8 for iOS has Missing SSL Certificate Validation. NOTE: this CVE only applies to obsolete versions from 2016 or earlier...

CVE-2019-6702

The MasterCard Qkr! app before 5.0.8 for iOS has Missing SSL Certificate Validation. NOTE: this CVE only applies to obsolete versions from 2016 or earlier...

CVE-2019-6702

CVE-2019-6702 affects the MasterCard Qkr! iOS app prior to version 5.0.8, with missing SSL certificate validation. The issue enables potential MITM interception on affected versions (noting it applies to obsolete 2016-era releases). Connected sources corroborate a MITM SSL certificate vulnerabili...

PT-2019-18274

Name of the Vulnerable Software and Affected Versions MasterCard Qkr! app versions prior to 5.0.8 Description The issue concerns missing SSL certificate validation. It is noted that this only applies to obsolete versions from 2016 or earlier. Recommendations For versions prior to 5.0.8, update to...

CVE-2019-6702: Improper Certificate Validation

The MasterCard Qkr! app before 5.0.8 for iOS has Missing SSL Certificate Validation. NOTE: this CVE only applies to obsolete versions from 2016 or earlier...

SMS Phishing + Cardless ATM = Profit

Thieves are combining SMS-based phishing attacks with new "cardless" ATMs to rapidly convert phished bank account credentials into cash. Recent arrests in Ohio shed light on how this scam works. A number of financial institutions are now offering cardless ATM transactions that allow customers to...

A week in security (September 3 – 9)

Last week on Malwarebytes Labs, we looked at spyware going mainstream, how the popular game Fortnite sparks security concerns for Android users, and how certain Mac App Store apps are stealing user data. Other cybersecurity news: Microsoft announced Windows 7 Extended Security Updates in a blog...

This Week in Security News: Tracking and Hacking

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, Google revealed a secret deal with Mastercard that allows it to track what users buy offline. Also, Senate and House representatives warn th...

Google and MasterCard will track your retail spending under a secret deal

By Waqas Google and MasterCard have jointly cut an ad deal to track your retail transactions. So far, we only knew that Google can track out online shopping preferences as we clicked on ads. However, this is quite surprising that it can now keep track of our retail transactions history from...

Google Secretly Tracks What You Buy Offline Using Mastercard Data

Over a week after Google admitted the company tracks users' location even after they disable location history, it has now been revealed that the tech giant has signed a secret deal with Mastercard that allows it to track what users buy offline. Google has paid Mastercard millions of dollars in...