POS Service Confirms Goodwill Breach Lasted 18 Months

Third-party payment vendor C&K Systems released further details this week regarding a breach that affected its systems for 18 months and went on to affect customers who shopped at Goodwill, in addition to two unnamed retailers. The company provided an update on the breach via a press release Mond...

Home Depot Data Breach Prompts Look at Backoff PoS Malware

Naturally, early speculation on the malware culprit behind the possible Home Depot data breach has leaned toward Backoff. The point-of-sale malware, one of many used against payment terminals, has recently been blamed for more than 1,000 attacks on businesses, prompting the U.S. Secret Service to...

Home Depot Investigating Massive Data Breach

Home Depot may be the latest retailer to suffer a costly data breach, and if early indications are correct, the hackers may have been on the home giant’s network longer than hackers were on Target’s systems, and a greater number of consumers may be at risk. A Home Depot representative confirmed...

UPS Admits 51 Stores Hit With Malware For Five Months

The list of corporations that have been victimized by credit card stealing malware in 2014 grew a little longer this week as UPS announced that 51 of its stores suffered a “broad-based malware intrusion” earlier this spring. The company disclosed the breach – which affected franchised locations o...

Grocery Stores 'Supervalu' and 'Albertsons' Hacked for Credit Card Data

Albertson’s and SuperValu - Two nation’s most popular supermarket store chains announced last weekend that a data breach may have revealed the credit and debit card information of their customers at a number of grocery store locations in more than 18 states. Minnesota-based Supervalu announced...

Brute-Forcing Botnet Sniffs Out Lax POS Systems

Over a two-week time span earlier this year, a botnet composed of thousands of computers actively sought out and broke into exposed point of sale POS systems that used poor or default passwords. The botnet, dug up and dubbed BrutPOS by security firm FireEye, leveraged more than 5,000 machines and...

BrutPOS Botnet Compromises insecure RDP Servers at Point-of-Sale Systems

Cyber criminals are infecting thousands of computers around the world with malware and are utilizing those compromised machines to break into Point-of-Sale PoS terminals using brute-force techniques, and the attackers have already compromised 60 PoS terminals by brute-force attacks against...

Remote Access Hack Compromises POS Vendor

A popular point of sale vendor may have suffered a data breach earlier this year that could affect customers of a handful of Pacific Northwest restaurants. Vancouver, Wash.-based Information Systems & Supplies, a supplier of POS systems to restaurants such as Dairy Queen, Buffalo Wild Wings and...

Easy POS System - SQL Injection (login.php)

No description provided by source...

i-pos Storefront 1.3 - 'index.asp' SQL Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/29471/info i-pos Storefront is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to...

CoolShot E-Lite POS 1.0 Login SQL Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/26558/info E-lite POS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise th...

I-Pos Internet Pay Online Store <= 1.3 Beta SQL Injection Vulnerability

No description provided by source. + Title : I-Pos Internet Pay Online Store v1.3 Beta = Remote SQL Injection Vulnerability ========================================================================================== + Author : KnocKout + Special ThanX : Dr.Kacak & Cr@zy-King and CW ALL USERS . . ....

Soraya Malware Packs Form Grabbing, Memory Scraping Functionality

Malware capable of infecting point-of-sale devices once was a novelty, but it’s quickly becoming more common. Researchers at Arbor Networks have unearthed a new strain of PoS malware called Soraya that can scrape memory and has the ability to intercept information sent from Web forms, a specialty...

Pre-Play Vulnerability Allows Chip-and-PIN Payment Card Cloning

In March this year, we reported that the major card distributor companies, VISA and Mastercard are migrating to EMV chip cards, also known as PIN-and-Chip cards. Unlike traditional magnetic stripe payment cards, EMV chip cards generates a unique code for every transaction, making it nearly...

Points of Sale Poorly Secured, Facing Sophisticated Attacks

The point-of-sale PoS systems on which financial transactions are conducted at nearly every physical retail location in the U.S. and and beyond are fast becoming a favorite target for sophisticated criminal organizations as well as standalone attackers. The emergence of this trend is unsurprising...

Target Accelerates Chip-and-Pin Roll Out, Hires New CIO

As Target continues to deal with the consequences of its massive data breach last year, the company is accelerating plans to move to a full chip-and-pin system for its branded credit and debit cards, and also plans to have terminals capable of accepting chip-and-pin cards in all of its nearly 2,0...

CVE-2014-0361

CVE-2014-0361 applies to IBM 4690 OS (used by Toshiba Global Commerce Solutions 4690 POS and related products). The issue stems from the ADXCRYPT password-hashing algorithm, which is vulnerable to known-plaintext attacks and hash collisions, enabling context-dependent attackers to obtain or deduc...

Toshiba Global Commerce Solutions' 4690 Point of Sale operating system contains a password hashing algorithm that can be reversed

Overview Toshiba Global Commerce Solutions' 4690 Point of Sale operating system contains a password hashing algorithm that can be reversed. CWE-328 Description Toshiba Global Commerce Solutions' 4690 Point of Sale operating system contains a password hashing algorithm that can be reversed. CWE-32...

POSH 3.1.x - addtoapplication.php SQL Injection

POSH 3.1.x - addtoapplication.php SQL Injection source: https://www.securityfocus.com/bid/65817/info POSH is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input. Exploiting this issue could allow an attacker to compromise the application, access o...

Easy POS System SQL Injection

Exploit: Easy POS System - SQL Injection + Author: vinicius777 + Contact: vinicius777 AT gmail @vinicius777 + Vendor Homepage: http://sourceforge.net/projects/easypossystem/ 1 Sql Injection POST Time Based Blind Note: Time based Injection on POST requests using burp, as output indicated. You...