Latest Hacking News And Events - dA1337: Credit Card

Fraudsters Stole $680,000 Via MitM Attack on EMV Cards

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjxksQcostBqfooZPzYlQ2vaKHg3UUtaVo6d3vjc7E8POfIVBWsCIQYYoqEz7rbQy5LiapBSKqMyxRrFrccGC92Z2vbo5dXrgecvyBHabr38tX2m75FdzCfMIVP9HhkzTSPcKCbCxuuYSQ/s1600/EMV_banner.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="418" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjxksQcostBqfooZPzYlQ2vaKHg3UUtaVo6d3vjc7E8POfIVBWsCIQYYoqEz7rbQy5LiapBSKqMyxRrFrccGC92Z2vbo5dXrgecvyBHabr38tX2m75FdzCfMIVP9HhkzTSPcKCbCxuuYSQ/s640/EMV_banner.jpg" width="640" /></a></div>
<br />
<br />
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<strong><span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">A team of French researchers have completed their analysis into the techniques of a criminal ring that in 2011 managed to steal $680,000 using modified EMV cards.</span></span></strong></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<strong><span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></strong></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">EMV (Europay, MasterCard, Visa) cards, also known as chip-and-PIN cards, have been used in Europe for many years and the United States is also transitioning to this technology as it’s considered more secure than the magnetic stripe technology that the country’s banks have been using.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">EMV transactions are carried out in three phases: the card is authenticated, the cardholder is verified, and the transaction is authorized.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">In the first phase, the point-of-sale (PoS) system determines which applications are supported by the card (e.g. debit, credit, ATM, loyalty). During the cardholder verification stage, the PoS asks the user to enter their PIN and transmits it to the card, which compares it and informs the PoS if it’s correct or not.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">During the transaction authorization phase, amount, currency, date and other transaction details are sent to the card, which responds with an authorization request cryptogram that is sent to the card issuer. The issuer responds with an authorization request code that instructs the PoS on how the transaction should be handled.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">In 2010, researchers at the University of Cambridge in the United Kingdom discovered a flaw that allowed criminals to use stolen chip-and-PIN cards without knowing their PIN. The <a href="http://www.cl.cam.ac.uk/research/security/banking/nopin/" style="color: #0076b4; font-weight: bold; text-decoration: none;" target="_blank">attack</a> relied on an electronic device that acted as a man-in-the-middle (MitM) designed to prevent the PIN verification message from getting to the card in the second phase of the transaction, and get it to always say that the entered PIN is correct. Researchers noted at the time that it would not be too difficult for criminals to miniaturize the MitM device that needed to be attached to the card.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The next year, a French banking group learned that a dozen EMV cards stolen in France had been used in Belgium. Since conducting fraudulent transactions using EMV cards should have been impossible, an investigation was launched.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Comparing the time and geographical location of the fraudulent transactions to the International Mobile Subscriber Identity (IMSI) numbers of SIM cards present near the crime scenes led investigators to a 25-year-old woman. Authorities later arrested other members of the gang, including the engineer who created the fake chip-and-PIN cards.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The group is said to have stolen roughly €600,000 ($680,000) by conducting 7,000 transactions using 40 modified cards.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The French researchers tasked with analyzing the fake cards named this the “most sophisticated smart card fraud encountered to date.” In a <a href="http://eprint.iacr.org/2015/963.pdf" style="color: #0076b4; font-weight: bold; text-decoration: none;" target="_blank">paper</a> published earlier this month, experts said the fraudsters used two chips, which they placed on top of each other, to conduct the attack.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The first chip was clipped from a genuine stolen card, while the second, which acted as the MitM device tasked with ensuring that the card would accept the PIN regardless of the PIN that was entered, was a FUN card, an open card used by hobbyists and for prototypes.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The two cards were wired to each other and embedded into the plastic body of a different card. Experts noted that creating the forgery required “patience, skill and craftsmanship.” While the resulting card was thicker than a regular card, it could still be inserted into a PoS device.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The cards created by the fraudsters were designed to let the chip from the genuine card conduct the card authentication and transaction authorization phases, while the cardholder verification step was hijacked by the second chip.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">According to the researchers, such attacks are no longer possible thanks to the introduction of a new authentication mode dubbed “Combined Data Authentication” or CDA, and a series of network-level protections.</span></span></div>
</div><br>
<script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<ins class="adsbygoogle"
     style="display:block"
     data-ad-client="ca-pub-7726750987177406"
     data-ad-slot="7596682374"
     data-ad-format="auto"></ins>
<script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>
<br>

A team of French researchers have completed their analysis into the techniques of a criminal ring that in 2011 managed to steal $680,0...

Banking Trojan "Brolux" Targets Users in Japan

10:10 PM Unknown 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh1pNQtqqibdW309SeH1gFidVV8dHwgO5nmi8JkTxgjY1yZEw6reocZvtbHsVaomDlKlvgHEYLttniE6YCBBIbspfnKd595MRhOhfgwBcBci20tsd6i1wgdQWA6SUNS7BDY7AnQhaLVSPg/s1600/Banking-Trojan.gif" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="354" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh1pNQtqqibdW309SeH1gFidVV8dHwgO5nmi8JkTxgjY1yZEw6reocZvtbHsVaomDlKlvgHEYLttniE6YCBBIbspfnKd595MRhOhfgwBcBci20tsd6i1wgdQWA6SUNS7BDY7AnQhaLVSPg/s640/Banking-Trojan.gif" width="640" /></a></div>
<br />
<br />
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<strong><span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">A new banking Trojan dubbed “Brolux” has been spotted targeting online banking users in Japan, researchers at ESET have warned.</span></span></strong></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<strong><span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></strong></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">According to the security firm, the threat, detected as <strong>Win32/Brolux.A</strong>, has been distributed by malicious actors with the aid of a Flash Player exploit leaked as a result of the Hacking Team breach (CVE-2015-5119) and an Internet Explorer vulnerability dubbed “Unicorn” (CVE-2014-6332).</span></span><br />
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The Flash Player flaw was patched by Adobe in July and the Unicorn bug was addressed by Microsoft in November 2014, but it appears even older exploits like these can be useful for delivering malware.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">ESET says the exploits have been hosted on an adult website and there is no indication that any exploit kits have been used to <a href="http://www.welivesecurity.com/2015/10/15/brolux-trojan-targeting-japanese-banks/" style="color: #0076b4; font-weight: bold; text-decoration: none;" target="_blank">distribute Brolux</a>. If the exploits are successful, a signed binary is pushed to the victim’s device.</span></span><br />
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Once it infects a computer, the Trojan’s main payload downloads two configuration files: one containing a list of 88 URLs, and one containing a list of browser window titles associated with Internet banking in Japan.</span></span><br />
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The malware monitors the websites visited by the user in search for online banking sites. If the victim uses Internet Explorer, Brolux compares the visited site’s URL with the URLs in the first configuration file. If Firefox or Chrome are used, the threat compares the window’s title with the list from the second configuration file.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">If the URLs or window titles match, a new process is created and the victim is pointed to a phishing page designed to harvest login information, security questions and answers, payment card data, passwords, email addresses and passwords, and PINs. In order to make everything look legitimate, the phishing pages are designed to appear as if they are associated with the Japanese Public Prosecutors Office and the Financial Services Agency (FSA).</span></span><br />
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">ESET researchers have uncovered clues suggesting that Chinese cybercriminals might be behind this Brolux attack. For example, one of the samples uses a Chinese mutex name, the phishing pages also contain text written in Chinese, and the malware is signed with a certificate issued to a Chinese company. The certificate was previously used to sign other malware, including a banking Trojan aimed at users in Korea, and potentially unwanted applications (PUAs).</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Several pieces of malware have been used over the past period to target the customers of Japanese banks, including Shifu, Neverquest and Tsukuba. However, Trend Micro highlighted in a report published this week that the Japanese cybercriminal underground is still in its infancy.</span></span><br />
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">“Although our observations reveal that Japanese cybercriminals lack the technical know-how needed for malware creation, the interest is there, as evidenced by exchanges on how to monetize malware tools purchased from other regional underground markets,” Trend Micro experts said. “Once enterprising individuals discover the feasibility of making money using hacking or malware, we may see more locally produced hacking tools and tips on Japanese underground sites.”</span></span></div>
</div>
<br />
<script async="" src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<br />
<ins class="adsbygoogle" data-ad-client="ca-pub-7726750987177406" data-ad-format="auto" data-ad-slot="7596682374" style="display: block;"></ins><script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>
</div>

Credit Card Cyber Crime Hacking news Latest News Security news Banking Trojan "Brolux" Targets Users in Japan

A new banking Trojan dubbed “Brolux” has been spotted targeting online banking users in Japan, researchers at ESET have warned. A...

How to Freeze Credit Report To Protect Yourself Against Identity Theft

2:28 AM Unknown 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg4FvF8Rd-NjF2zTRWkyfoXav353Lf0GojzGOR1C0xaob31SMuMnyE3iGkYxwgEpU2Ox8tEWt0oBpjFg2d9sZoGH0HgqZ67xa6qVG20dZCJz6KeveSxQNZXlsOVlBL6rCxOniPaVDtkM7A/s1600/freeze-credit-report.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="332" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg4FvF8Rd-NjF2zTRWkyfoXav353Lf0GojzGOR1C0xaob31SMuMnyE3iGkYxwgEpU2Ox8tEWt0oBpjFg2d9sZoGH0HgqZ67xa6qVG20dZCJz6KeveSxQNZXlsOVlBL6rCxOniPaVDtkM7A/s640/freeze-credit-report.png" width="640" /></a></div>
<br />
<br />
If your <b>Social Security number gets hacked</b> in any data breaches, including recently hacked T-Mobile, then there's a way to prevent hackers from misusing your identity (i.e. identity theft).<br />
The solution here is that you can institute a <b>security freeze </b>at each of the three credit bureaus, Equifax, Experian, or TransUnion.<br />
<br />
Once frozen, nobody will be allowed to access your credit report, which will prevent any identity thieves from opening new accounts in your name.<br />
<br />
Because most creditors required to see your credit report before approving a new account. But, if they are restricted to see your file, they may not extend the credit or open a new account in your name.<br />
However, there are some disadvantages of doing so.<br />
<br /><br><script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<ins class="adsbygoogle"
     style="display:block"
     data-ad-client="ca-pub-7726750987177406"
     data-ad-slot="7596682374"
     data-ad-format="auto"></ins>
<script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>
<br><br>
<b>1. Cost</b><br />
<b><br /></b>
The cost of a security freeze differs by state (check yours here). However, it is often free for already affected people, but the issue is – if you want to let anyone check your credit, you will need to pay a fee every time to lift the freeze.<br />
This happens not just for your credit applications, but your credit report also gets pulled when you register for a mobile phone contract or apply for a new job or a new apartment as well.<br />
The credit agencies will provide you a unique password to lift the freeze and charge up to $12 each time you lift the freeze. So this option can get costly.<br />
<br />
<b>2. Once Used, Nobody can Help</b><br />
<br />
Moreover, if an identity thief has already used your stolen data to open accounts in your name, then a credit freeze will not help you out.<br />
<br />
You can check your credit report for free three times a year at annualcreditreport.com. If you suspect any fraud, change your passwords, notify your financial institutions, keep an eye on your financial statements, and report to police.<br />
.<br />
.<br />
<br /><script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<ins class="adsbygoogle"
     style="display:block"
     data-ad-client="ca-pub-7726750987177406"
     data-ad-slot="7596682374"
     data-ad-format="auto"></ins>
<script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>
</div>

Credit Card Latest News Security news How to Freeze Credit Report To Protect Yourself Against Identity Theft

If your Social Security number gets hacked in any data breaches, including recently hacked T-Mobile, then there's a way to prevent...

Chip-and-PIN Credit Cards and The Deadline: Here's What You need To Know

1:46 AM Unknown 0

<ul style="text-align: left;">
<li>Pre-Play Vulnerability Allows Chip-and-PIN Payment Card Cloning</li>
<li>Chip and PIN payment card system vulnerable to Card cloning</li>
<li>Fraudsters Physically Deploy Malicious Software to Hack ATMs</li>
<li>FAQs about EMV credit cards</li>
<li>Smart ATM offers Cardless Cash Withdrawal to Avoid Card Skimmers</li>
</ul>
<br />
Also, for online usage, neither a PIN nor a Signature is required, so just stealing credit card numbers is sufficient to use them for Fraud.<br />
<br />
<b>Future of Payment Cards</b><br />
<b><br /></b>
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgS7R0OsjPtoBlSsFnwKb5wLbFdLUxbCfK0NONO_6nuQjuz4ruDblJQhyphenhyphenRl27TUAmC-QqFlNUKUAFucN21saHDMzCGje5yfaVHUgnTeDNHbaY03zoq9k5ESUOe40bAeYqJjLWoMUpXajiE/s1600/apple-pay.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" height="332" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgS7R0OsjPtoBlSsFnwKb5wLbFdLUxbCfK0NONO_6nuQjuz4ruDblJQhyphenhyphenRl27TUAmC-QqFlNUKUAFucN21saHDMzCGje5yfaVHUgnTeDNHbaY03zoq9k5ESUOe40bAeYqJjLWoMUpXajiE/s640/apple-pay.png" width="640" /></a></div>
<b><br /></b>
<br />
<br />

<br />
<br />
<br />
chip-n-pin-cred-card<br />
<br />
Moreover, as a solution, mobile payment and digital wallet services like Apple Pay and Google Wallet can be promoted by adopting more robust security mechanism and protocols; and making monetary transactions more safe and easy.<br />
Another solution could be considered as the use of multiple factor authentication methods like Biometrics.<br />
Also, you can take a sneak peak into this Video, where Jerry Irvine, member of the U.S. Chamber of Commerce Cyber Security Leadership Council and CIO of Chicago-based Prescient Solutions, in an interview with Slashdot Media discusses the new technology and its principles that promise safe payment practices.</div>
<br />
<script async="" src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<br />
<ins class="adsbygoogle" data-ad-client="ca-pub-7726750987177406" data-ad-format="auto" data-ad-slot="7596682374" style="display: block;"></ins><script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>

</div>

Credit Card Cyber Crime Latest News Security news Chip-and-PIN Credit Cards and The Deadline: Here's What You need To Know

October 1 Liability shift ENDS! Today, 1st October 2015, is the deadline for US-based Banks and Retailers to roll out Chip-embedded ...

Latest Hacking News And Events - dA1337

Fraudsters Stole $680,000 Via MitM Attack on EMV Cards

Banking Trojan "Brolux" Targets Users in Japan

How to Freeze Credit Report To Protect Yourself Against Identity Theft

Chip-and-PIN Credit Cards and The Deadline: Here's What You need To Know

Popular Posts

Labels

[Gadgets][carouselslide][recent][9]