Use of 3DES to Encrypt Stolen Target PIN Data Invites Worry

Target Corp.’s admission that encrypted PIN data was stolen in the Black Friday breach was bad news for consumers. For security experts, especially cryptographers, particular exception was taken to the retail giant’s use of Triple DES 3DES encryption to keep the PIN data safe. With all crypto...

[CVE-2013-6986] Insecure Data Storage in Subway Ordering for California (ZippyYum) 3.4 iOS mobile application

Title: CVE-2013-6986 Insecure Data Storage in Subway Ordering for California ZippyYum 3.4 iOS mobile application Published: December 7, 2013 Reported to Vendor: May 2013 CVE Reference: CVE-2013-6986 https://vulners.com/cve/CVE-2013-6986 CVSS v2 Base Score: 4.9 CVSS v2 Vector...

Threat Outbreak Alert: Fake Payment Slip Notification Email Messages on December 19, 2013

Medium Alert ID: 32245 First Published: 2013 December 20 14:16 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain payment transfer details for the recipient. The text in the email message attempts to convince the recipient ...

CryptoLocker Creators Infected Nearly 250,000 Systems, Earned $30 M Since September

UPDATE: The math in this and other reports was simply tabulated incorrectly. New American presidents often are measured by what they accomplish in their first 100 days. By that yardstick, the crew behind the CryptoLocker ransomware have been a raging success. The unknown group of attackers have...

Target Corp. Suffers Black Friday Data Breach

UPDATE – TJX and Heartland Payment Systems may soon have company atop the list of the worst retail data breaches in U.S. history after reports surfaced that Target Corp. was breached around Black Friday and millions of credit and debit cards were stolen. Target confirmed the breach this morning a...

jakarta-commons-httpclient: missing connection hostname check against X.509 certificate name

It was found that Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service FPS merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows...

Santander BillPay Security Vulnerabilities Patched

Security weaknesses on the Santander Group BillPay website and mobile banking application have been addressed by the financial services organization’s developer Headland after they were exposed less than a week ago. U.K. consultant Paul Moore of Cresona Corp., reported a number of serious...

ECShop 2.7.3 /includes/modules/payment/alipay.php SQL注入

No description provided by source...

Threat Outbreak Alert: Fake Payment Advice Notification Email Messages on December 11, 2013

Medium Alert ID: 32135 First Published: 2013 December 12 16:31 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain payment advice for the recipient. The text in the email message attempts to convince the recipient to open th...

Threat Outbreak Alert: Fake Payment Authorization Inquiry Email Messages on December 11, 2013

Medium Alert ID: 32115 First Published: 2013 December 11 20:09 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain payment processing details for the recipient. The text in the email message attempts to convince the recipien...

Threat Outbreak Alert: Fake Bank Payment Confirmation Email Messages on December 11, 2013

Medium Alert ID: 32117 First Published: 2013 December 11 20:06 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a bank payment notification for the recipient. The text in the email message attempts to convince the recipie...

Threat Outbreak Alert: Fake Payment Notice Email Messages on December 6, 2013

Medium Alert ID: 32069 First Published: 2013 December 9 20:03 GMT Version: 1 Summary Cisco Security has detected significant activity related to Italian-language spam email messages that claim to contain a payment notice for the recipient. The text in the e-mail message attempts to convince the...

Threat Outbreak Alert: Fake Missing Payment Request Email Messages on December 9, 2013

Medium Alert ID: 32087 First Published: 2013 December 9 15:51 GMT Version: 1 Summary Cisco Security has detected significant activity related to Portuguese-language spam email messages that claim to contain a missing payment notification for the recipient. The text in the email message attempts t...

ZippyYum 3.4 Insecure Data Storage

Title: CVE-2013-6986 Insecure Data Storage in Subway Ordering for California ZippyYum 3.4 iOS mobile application Published: DATE Reported to Vendor: May 2013 CVE Reference: CVE-2013-6986 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6986 CVSS v2 Base Score: 4.9 CVSS v2 Vector...

Threat Outbreak Alert: Fake Fund Transfer Notification Email Messages on December 5, 2013

Medium Alert ID: 32058 First Published: 2013 December 6 15:33 GMT Version: 1 Summary Cisco Security has detected significant activity related to Portuguese-language spam email messages that claim to contain payment transfer details for the recipient. The text in the e-mail message attempts to...

Threat Outbreak Alert: Fake Payment processing Notification Email Messages on December 2, 2013

Medium Alert ID: 31991 First Published: 2013 December 3 16:21 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a payment processing notification for the recipient. The text in the email message attempts to convince the...

Threat Outbreak Alert: Fake Payment Receipt Notification Email Messages on November 28, 2013

Medium Alert ID: 31935 First Published: 2013 December 2 20:46 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a payment receipt for the recipient. The text in the email message attempts to convince the recipient to open...

Threat Outbreak Alert: Fake Payment Reminder Notification Email Messages on November 24, 2013

Medium Alert ID: 31877 First Published: 2013 November 25 15:52 GMT Version: 1 Summary Cisco Security has detected significant activity related to German-language spam email messages that claim to contain a payment reminder notification for the recipient. The text in the email message attempts to...

Threat Outbreak Alert: Fake Account Payment Information Email Messages on November 24, 2013

Medium Alert ID: 31882 First Published: 2013 November 25 15:31 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain payment advice for the recipient. The text in the email message attempts to convince the recipient to open th...

Threat Outbreak Alert: Fake Payment Information Email Messages on November 22, 2013

Medium Alert ID: 31873 First Published: 2013 November 22 15:56 GMT Version: 1 Summary Cisco Security has detected significant activity related to German-language spam email messages that claim to contain payment information for the recipient. The text in the email message attempts to convince the...