Square: Delayed, fraudulent transactions possible with encrypted Square Reader devices due to lack of server-side verification of device transaction counter

Although Square Readers implement encryption, possibly with a Derived Unique Key Per Transaction DUKPT scheme, the transaction counter of a Square Reader device is not verified when performing server-side decryption of swipe data. During a valid sale, a malicious merchant or third party can recor...

IC3 Releases Scam Alert for Fraudulent Online Advertisements

The Internet Crime Complaint Center IC3 released a Scam Alert regarding fraudulent ads for normally expensive items, such as cars and boats, at discounted prices. Scam operators often use false contact information linked to reputable online marketplaces to imply that the transaction is legitimate...

Visa, MasterCard Remove Passwords from 3D Secure

Payment giants Visa and MasterCard announced plans to eliminate the need for password authentication in the companies’ respective “Verified by Visa” and “SecureCode” payment platforms which are designed to add an additional layer of security to online transactions. In a press release, MasterCard...

CVE-2014-3051

IBM ITCAM for Transactions Internet Service Monitor (ISM) agent fails to validate SSL/X.509 certificates, enabling potential MITM attacks to capture credentials. Affected versions: ITCAM for Transactions 7.1/7.2 (up to 7.2.0.3 IF28), 7.3 (up to 7.3.0.1 IF30), and 7.4 (up to 7.4.0.0 IF18). Remedia...

PayPal Inc #90 PM - Buffer Overflow Vulnerability

Document Title: =============== PayPal Inc 90 PM - Buffer Overflow Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=940 http://www.vulnerability-lab.com/getcontent.php?id=1274 Release Date: ============= 2014-10-02 Vulnerability Laboratory I...

WePay: Horizontal Privilege Escalation

An attacker can update the subscription details of the victim without any action from the victim. Following are the steps to reproduce: 1. Login into account with any set of credentials, say [email protected] 2. Click on "Create an Account", Click on Organization, Fill in all the details. Complete...

Brazilian Payment Fraud Campaign Steals Billions

UPDATE–Hackers are targeting Brazil’s Boleto payment system, the second most popular payment method in the country, and have conducted hundreds of thousands of fraudulent transactions, though researchers differ over how much money has been stolen. Formally known as Boleto Bancario, Boletos are...

Microsoft Windows XP/2000/NT 4 RPC Service Denial of Service Vulnerability (4)

No description provided by source. source: http://www.securityfocus.com/bid/6005/info The Microsoft Windows RPC service contains a flaw that may allow a remote attacker to cause a denial of service. By sending a specifically malformed packet to TCP port 135, the RPC service will be disabled. This...

openSUSE Security Update : xtrabackup (openSUSE-SU-2014:0245-1)

This update fixes the following security and non-security issues with xtrabackup : - update to 2.1.7 bnc860488 - general changes : - rebased on MySQL versions 5.5.35 and 5.6.15 - now uses libgcrypt randomization functions for setting the IV lp1255300 bnc852224 CVE-2013-6394 - bugs fixed : - After...

LoopHole in PayPal Terms Allows Anyone to Double PayPal Money Endlessly

Many of us own a PayPal account for easy online transactions, but most of us don’t have balance in our PayPal Account. But what will happen if your money doubles, triple...or even more folds in just some couple of hours ?? Sounds cherishing!! A loophole in the popular digital payment and money...

FTC Asks Data Brokers, Congress for Transparency, Regulation

The Federal Trade Commission called on data brokers to be more transparent and give users more control over their personal information in a comprehensive report issued yesterday. The 100-plus page document, “Data Brokers: A Call for Transparency and Acccountability,” .PDF criticizes the industry...

Pre-Play Vulnerability Allows Chip-and-PIN Payment Card Cloning

In March this year, we reported that the major card distributor companies, VISA and Mastercard are migrating to EMV chip cards, also known as PIN-and-Chip cards. Unlike traditional magnetic stripe payment cards, EMV chip cards generates a unique code for every transaction, making it nearly...

Points of Sale Poorly Secured, Facing Sophisticated Attacks

The point-of-sale PoS systems on which financial transactions are conducted at nearly every physical retail location in the U.S. and and beyond are fast becoming a favorite target for sophisticated criminal organizations as well as standalone attackers. The emergence of this trend is unsurprising...

Malicious Chrome Extension Hijacks CryptoCurrencies and Wallets

Although the number of malicious browser extensions has significantly increased in the past years, but recently a new extension of the Google Chrome is allegedly targeting Cryptocurrency users that is capable of stealing Bitcoins and other crypto coins silently. The malicious Chrome browser...

Like Apple's TouchID, Galaxy S5 Vulnerable to Fingerprint Hack

Researchers published a video this week demonstrating how Samsung’s latest entry in the smartphone arena, the Galaxy S5, is vulnerable to a hack that involves lifting and copying fingerprints to trick the phone’s biometric sensor. Much like the Apple iPhone 5S, the smartphone, which first hit the...

Coinbase: User Enumeration, Information Disclosure and Lack of Rate Limitation on API

NOTE: I am making this email as I think the response from Coinbase originally, via my emails to them was not correct. They had not acknowledged that this flaw allowed for user enumeration and hence I am posting the report again - in hope of a proper and well evaluated response. The key security...

Gameover ZeuS Trojan Targets Users of Monster.com Employment Portal

Zeus Trojan is one of the most popular families of Banking Trojan, which was also used in a targeted malware campaign against a Salesforce.com customer at the end of the last month and researchers found that the new variant of Zeus Trojan has web crawling capabilities that are used to grab...

CVE-2013-5429

The Risk Based Access functionality in IBM Tivoli Federated Identity Manager TFIM 6.2.2 before FP9 and Tivoli Federated Identity Manager Business Gateway TFIMBG 6.2.2 before FP9 does not prevent reuse of One Time Password OTP tokens, which makes it easier for remote authenticated users to complet...

NSA admits to collect 200 Million text messages per day under Project DISHFIRE

After the exposure of various surveillance programs, including PRISM, XKeyscore, MUSCULAR, DROPOUTJEEP in recent revelation, NSA has come up as the only ‘Government that Actually Listen’. Another day and here comes another revelation - According to the The Guardian, National Security Agency NSA h...

信游科技页游平台程序通用型SQL注入漏洞

简要描述： 某页游平台通用型SQL注入漏洞，可直接提权服务器，涉及页游平台数十个。全是企业站点，涉及资金交易。 详细说明： 今天是我第一次用sqlmap，没钱买电脑，也装不了backtrack 存在漏洞站点：http://www.52xinyou.cn/anli.htm 都在这个客户案例里面，17188不存在这个页面的漏洞。但是我不保证其他页面不存在。 本次渗透测试站点：http://www.teiyi.com/，对不起，让你受苦了。 sql注入地址：http://www.teiyi.com/payment/yeemobile.aspx?code=UNICOM 充值页面 直接sqlmap...