Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Breached Retailers Harden PoS, For Now
Newest First  |  Oldest First  |  Threaded View
macker490
50%
50%
macker490,
User Rank: Ninja
9/29/2014 | 8:13:49 AM
Re: Please people - EMV is not a silver bullet
AAPL is taking this 1 step further in the right direction with Apple Pay: the phone does not transmit the customer's accont number to the merchant.    EMV still does, although it also requires a 1-time use authorization code,-- which -- theoretically -- you need the original card to generate.

you can't steal what isn't there -- and thus Apple's aporoach is and even better step

the underlying problem remains though

we keep attacking encryption and passwords when the actual problem is AUTHENTICATION particularly of softwtwware updates.

by this time we all know: if your phone is hacked -- the hacker will likely have access to your payments mechanism -- if you have one on a "smart" phone

sometimes i wonder just how "smart" these gadgets are...
Stratustician
50%
50%
Stratustician,
User Rank: Moderator
9/26/2014 | 1:56:17 PM
Re: Please people - EMV is not a silver bullet
We here in Canada are huge proponents of Chip and PIN technology, mostly because in the grand scheme of things we are pretty much a heavy electronic currency-based country. But to see that many retailers do not use encryption on their POS is so mind baffling to me.  The problem is that while so many organizations are still scratching their heads around PCI, they forget that one of the biggest baby steps to start with is to encrypt their sensitive information, primarily card information.  I think the industry could do more to really push retailers to comply and educate them on the importance of encryption, especially at the POS level.
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
9/26/2014 | 12:48:17 PM
Re: Please people - EMV is not a silver bullet
Good points, @hhendrickson274. EMV is definitely not a silver bullet. But the data does show that it's much better than our existing payment card technology at least at the point of sale. 
hhendrickson274
50%
50%
hhendrickson274,
User Rank: Strategist
9/26/2014 | 12:45:03 PM
Please people - EMV is not a silver bullet
I take serious excetion to the comment in the story about EMV (chip-n-pin) making stolen card data worthless.  EMV doesn't work on the Internet, so all Internet transactions will still be "card not present" transactions.  So the number and CVV will still be very valuable for Internet based fraud.  That and EMV implementation have already proven to be far from secure.  Don't get me wrong, I'm all for EMV adoption in the US, but as long as the press and the analyst pundits keep telling everying that EMV will solve all the ills of POS (in)security, they are doing a major disservice to us all, especially those in retail that are trying hard to secure their environments from compromise.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
9/26/2014 | 11:15:56 AM
Re: PoS-Negative Reinforcement
Good question, Ryan. They are definitely not going to get anywhere by "waiting for someone to knock on their door" and tell them they've been breached," as Seculert's Aviv Raff noted in the story.

 

 
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
9/26/2014 | 9:35:00 AM
Re: PoS-Negative Reinforcement
Very true. Are there methods by which smaller organizations can effectively discover there network health at low cost? Maybe a baseline analyzer for the PoS systems.
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
9/26/2014 | 9:16:14 AM
Re: PoS-Negative Reinforcement
I am sure there are plenty more breached retailers in the pipeline who we will be hearing from. But what's more scary are the smaller ones who have no clue and may never find out.
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
9/26/2014 | 8:53:07 AM
PoS-Negative Reinforcement
Its good to hear that retailers are starting to take these breaches seriously. It is unfortunate that most are the result of negative reinforcement. If these breaches had not happened would many of these companies be pushing for stricter security standards? If the stove never burns you why not touch it?

A positive from this is that retailers that have not been breached are starting to increase their security measures and more organizations need to follow suit. Like the saying goes, a smart person learns from his or her own mistakes but a brilliant one learns from others.


COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/9/2020
Omdia Research Launches Page on Dark Reading
Tim Wilson, Editor in Chief, Dark Reading 7/9/2020
Mobile App Fraud Jumped in Q1 as Attackers Pivot from Browsers
Jai Vijayan, Contributing Writer,  7/10/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15105
PUBLISHED: 2020-07-10
Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session (base64-encoded). The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor authenticati...
CVE-2020-11061
PUBLISHED: 2020-07-10
In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows a malicious client to corrupt the director's memory via oversized digest strings sent during initialization of a verify job. Disabling verify jobs mitigates the problem. This issue is also patched in...
CVE-2020-4042
PUBLISHED: 2020-07-10
Bareos before version 19.2.8 and earlier allows a malicious client to communicate with the director without knowledge of the shared secret if the director allows client initiated connection and connects to the client itself. The malicious client can replay the Bareos director's cram-md5 challenge to...
CVE-2020-11081
PUBLISHED: 2020-07-10
osquery before version 4.4.0 enables a priviledge escalation vulnerability. If a Window system is configured with a PATH that contains a user-writable directory then a local user may write a zlib1.dll DLL, which osquery will attempt to load. Since osquery runs with elevated privileges this enables l...
CVE-2020-6114
PUBLISHED: 2020-07-10
An exploitable SQL injection vulnerability exists in the Admin Reports functionality of Glacies IceHRM v26.6.0.OS (Commit bb274de1751ffb9d09482fd2538f9950a94c510a) . A specially crafted HTTP request can cause SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerabi...