Apparel Company Files Landmark Lawsuit Against Visa in PCI Dispute

A Tennessee-based footwear and apparel company has filed a $13 million lawsuit against Visa for what it considers random, subjective penalties for being out of compliance with the Payment Card Industry PCI standard the credit card company regulates. Last week Nashville-based Genesco, which operat...

Retailer Challenges Visa $13.2M PCI Fine in Court

Genesco Inc., a Tennessee-based shoe retailer, is taking Visa to court in what is being reported as the first case challenging fines and penalties levied by the Payment Card Industry Data Security Standard PCI DSS under which Genesco was fined $13.3 million. In late 2010, attackers compromised...

Microsoft ASP.NET MS-DOS Device Name DoS (PCI-DSS check)

The web server running on the remote host appears to be using Microsoft ASP.NET, and may be affected by a denial of service vulnerability. Requesting a URL containing an MS-DOS device name can cause the web server to become temporarily unresponsive. An attacker could repeatedly request these URLs...

P2PE Hybrid, the next best thing since the Prius

P2PE promises many things, the most coveted being scope reduction for the merchant and a shifting of the compliance burden from the merchant to the service provider. A properly implemented P2PE solution can indeed reduce the risk of compromise for a merchant as well as reduce the scope of what mu...

PT-2012-1037

Name of the Vulnerable Software and Affected Versions libssh versions prior to 0.5.3 Description The issue affects multiple functions in keys.c in libssh, including publickey make dss, publickey make rsa, signature from string, ssh do sign, and ssh sign session id. This might allow remote attacke...

Attorney Adds Security Company, State IT Department to Data Breach Lawsuit

A former South Carolina lawmaker has added the data security firm Trustwave and the state’s technology department to a lawsuit filed in the wake of a massive data breach at the state’s Department of Revenue. The Associated Press reports attorney John Hawkins in an amendment claims Trustwave...

PCI DSS Compliance : Handling False Positives

Note that per PCI Security Standards Council PCI SSC standards, if the version of the remote software is known to contain flaws, a vulnerability scanner must report it as vulnerable. The scanner must still flag it as vulnerable, even in cases where a workaround or mitigating configuration option ...

Airlock WAF 4.2.4 Overlong UTF-8 Sequence Bypass

Exploit for multiple platform in category dos / poc title: Airlock WAF overlong UTF-8 sequence bypass product: Airlock vulnerable version: = 4.2.4 without hotfix HF4213 fixed version: 4.2.5 impact: critical homepage: http://www.ergon.ch/ found: 2012-04-05 by: G. Wagner SEC Consult Vulnerability L...

Surprises Ahead for Some Level 2 Merchants

The PCI DSS has been around for years, and most PCI "pros" are familiar with the processes needed to validate compliance. However, insiders often forget that small changes to the guidelines can have a big impact on merchants. One such change is upon us: MasterCards new validation guidelines for...

PCI Compliance No Real Obstacle to Compromises

SAN FRANCISCO–The PCI DSS standard has taken a beating from critics, security experts and CSOs virtually since the day it appeared in its earliest form in 2004. It’s evolved quite a bit in the intervening years, but it hasn’t shaken any of that criticism, and security folks say there’s a good...

PCI DSS Compliance : Database Reachable from the Internet

The remote host is running a database server that is reachable from the Internet. This violates PCI DSS, section 1.3.7. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid57581; scriptversion"1.13"; scriptsetattributeattribute:"pluginmodificationdate", value:"2020/04/27"...

Cisco IOS Command EXEC Unspecified Vulnerability

An unspecified vulnerability in Command EXEC allows local users to bypass command restrictions and obtain sensitive information via an unspecified 'variation of an IOS command'. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid17775; scriptversion"1.5";...

Apache Mixed Platform AddType Directive Information Disclosure

The remote host appears to be running Apache. When Apache runs on a Unix host with a document root on a Windows SMB share, remote, unauthenticated attackers could obtain the unprocessed contents of the directory. For example, requesting a PHP file with a trailing backslash could display the file'...

Web Server Allows Password Auto-Completion (PCI-DSS variant) (deprecated)

This plugin has been deprecated because the corresponding failure item in the ASV Program Guide no longer pertains, as of the May 2013 release. Plugin ID 42057 should be used instead. %NASLMINLEVEL 999999 C Tenable Network Security, Inc. @DEPRECATED@ Disabled on 2016/06/13. Confirmed not required...

PCI DSS Compliance : Insecure Communication Has Been Detected

Applications that fail to adequately encrypt network traffic using strong cryptography are at increased risk of being compromised and exposing cardholder data. An attacker who is able to exploit weak cryptographic processes can gain control of an application or even gain cleartext access to...

New Guidelines Address PCI DSS Tokenization

"Tokenization" is one of the best techniques to reduce the risk of credit card data loss. Basically, it is the process of substituting sensitive data with other values not considered sensitive. By doing this, tokenization technology essentially removes anything of value from the data stream, and,...

Пластиковая безопасность: взгляд на аудит сквозь призму стандарта PCI DSS

Проведение «мероприятий по оценке соответствия требованиям стандарта безопасности данных индустрии платежных карт PCI DSS» стало одной из востребованных услуг среди их прочего спектра, предоставляемой консалтинговыми организациями. Насколько эта оценка отражает реальное положение дел в...

SpyEye Trojan Targeted Verizon's Online Billing Site

Attackers used the infamous SpyEye Trojan to target Verizon’s online billing page for nearly a week earlier this month, trying to nab users’ sensitive personal and financial information, researchers say. The Trojan used a method of attack known as HTML injection to modify the pages presented in a...

Sophisticated Attack Yields Data On IEEE Members

IEEE, the world’s leading society for technical professionals, has warned some 800 members that their credit card and personal information may have been stolen. The FBI has been notified of the breach. The group disclosed the November, 2010 breach in a letter to the New Hampshire Attorney General...

Restaurant Chain is First Fined Under Massachusetts Data Breach Law

UPDATE: A Massachusetts restaurant chain was the first company fined under the state’s toughest in the nation data breach law and will have to pay $110,000 in penalties, according to a statement by the Massachusetts Attorney General. The Briar Group LLC entered into a settlement with Massachsuett...