Month: May 2020

Merchant’s guide for payment security requirements

Posted on by admin

Ecommerce, online payment transactions are advancing their path in this developing technology. The customer is concerned with the payment security and that the bank credentials are maintained in a confidential way. To develop a good merchant customer relationship the merchant needs to provide payment security to his customers. They need to ensure that the best payment security measures are taken and that customers don’t need to worry about their data.

Few steps as stated can be taken to manage risk and provide a secure online service :

Getting PCI Compliant

PCI DSS is a set of comprehensive requirements developed by the founding payment brands of the PCI Security Standards Council, to enhance payment account data security. The standard is applicable to any organization that accepts, stores, processes and/or transmits cardholder data, whether you are a merchant, acquirer bank, credit card processor or a payment card brand.

The PCI DSS standard includes requirements for security management, policies, procedures, network architecture, software design and other critical protective measures. By complying with PCI DSS requirements, merchants meets their following obligations:

  • Development of Consumer Trust in the Security of their Sensitive Information
    If the customers feel that they are “safe” with their merchants, it helps grow confidence in the services. Confident customers are loyal and they share their experiences with others
  • Reduce Direct Losses and Operational Expenses.
    Adequate data security protects cardholders and limits risk exposure,minimizing the losses and expense that might stem from compromised cardholder information.
  • Maintained Positive Image
    With Information security at the center of everyone’s mind, data loss or compromise not only hurts customers, it can seriously damage a business’s reputation. Compliance with PCI DSS manages to reduce the risk of breach considerably.

SSL protocol

Customers should be ascertained with trust and peace of mind when they are using e-commerce websites. Hence, it’s necessary to implement SSL protocol on the payment application as the first thing crucial for your payment security. SSL helps us to encrypt information that goes on the site such as credit card details and sensitive data that customers share during the checkout process. Transport layer security (TLS) provides a trademark for all E-commerce websites as it verifies the data transaction whatever happens is safe or not.

The identification of an SSL protocol is to check whether the payments page on the internet shall start with https:// and the padlock icon visible in the URL bar next to your web address. This builds your credibility as a secure service provider

Tokenization

Tokenization initiates secure payments and it is very much difficult to engineer the card details from the token. Tokenization reduces the PCI to strive hard for secure payments  and optimises the cost. The customers can store the card information in their e-wallets without exposing their original card information. Merchants accepting the recurring payments can get habituated easily and also offer quick mobile payments and easy purchases.

Rise of the Cerberus, financial institutions warned ahead

Posted on by admin

Named after the monstrous wrath dog of the underworld from greek mythology,  Cerberus  is a banking trojan, created by the remote attackers which allows it to steal the account data, SMSs and all other important data of the device.

Taking advantage of the ongoing pandemic situation, scammers are targeting the financial data of the users’ smartphones.  Cerberus, the malicious software is being blessed with the amid pandemic scenario impersonates and sends SMSs providing some content and links that might deploy it’s malicious app by usually by sending emails pretending that they are from reputed companies and procuring the personal data that reveals the financial credentials of the customer. Recently on Tuesday the CBI announced that this kind of trojan often tends to be tricky for the users as they ask to provide the authentication details.  CERT  recently issued a security notification regarding zoom stating it as not a safe platform for the usage of individuals. The cerberus is more impacted to the internet users who are involved in the work from home jobs.

Impertinent behaviour and speed of criminal activity has been increasing from the time since our prime minister Narendra Modi has announced about the PM cares fund for helping the victims of  COVID-19  pandemic. Various cerberus attacks have been phished off to transfer money in the name of treating patients. Fraudulent E- commerce sites have developed rapidly promising to treat corona victims.

The investigator could face the challenges like sending email to susceptible people for sharing password and bank credentials. Meanwhile the fraudsters are surging their way through the meeting places of corporate offices like google hangout and zoom. Some of the advisories warned that usage of open WiFi networks is dangerous also changing the default passwords would reduce the risk of the crime happening forth.

Operation Pangaea was launched by the  INTERPOL  to eradicate this kind of malicious software and nearly around 120 criminals from 90 countries which would worth around 14 million dollars were caught by them but this has not been executed in Indian government didn’t have any such kind of execution for such kind of issues. Slew of malicious software has become a banking trojan exploiting the name of coronavirus.

Cerberus makes use of an overlay top display of an actual mobile banking app and can trick the users into entering their banking credentials into the fake login screen. All the financial data can be acquired by the remote attackers. Such kind attacks are done for unique targets and banking apps. When the cerberus trojan gets installed in your device it doesn’t show any icon for the application to the user. It pretends to act like a flash player in order to gain permission from the system.

By chance if the software gets installed due the lack of security it automatically registers the command and control over the systems. To robb the credential information of the device it launches remote screen overlay attacks. This impinges the customers to provide their details on some of the websites with fake login screens. The victim totally gets devastated by all the credential data over their respective devices.

To be safe from such malicious practices one should beware of downloading the applications as this malware relies on social engineering tactics to make its way onto a victim’s device. Click the links from trusted sources, if you receive any suspicious link stay cautious and avoid interacting with the message. Using an antivirus software would be more adorable to protect from such harming trojans.

Software files especially from the third party unofficial sites shady sites, third party downloaders, Peer-to-Peer networks, freeware download pages, free file hosting sites, etc., can be and often are used to proliferate malicious programs. Third party, fake installers are often used to spread malware too. If the above precautions are taken care off the malicious software could not be encouraged and there shall be no threat for the users credentials.

Delivery attacks the increasing of payment fraud

Posted on by admin

Ongoing Corona Crisis have led to a spike in the number of fraudulent transactions and cybercriminals nowadays are sitting tight to exploit the new avenues. Reports spurred in showing the increasing curve of the fraud attacks and how even AI and ML technologies alone are proving ineffective against them. Ecommerce has been the major target, apart from the prevalent areas of cards and user accounts.

Pandemic has unfortunately led to increased “Delivery Attacks” that target the BOPIS segment, (Buy Online, Pickup In Store) as customers and merchants both try to accommodate with the needed social distancing norms. The prime vulnerability in the BOPIS segment is the end delivery point, since there have observed inconsistencies in verifying the information against who has purchased the commodities. Frauds as such are on the rise in regions that are still under lockdown. Mobile orders have seen as prime victims in the increasing rise of account takeover attacks

Fraudsters have been using multiple attack vectors to hamper the security overtime. While initial activities involved were meant for information gathering, actors have stepped up and started verifying the compromised credentials as valid. News accounts are made and kept dormant with the merchants and overtime create an illusion of being a longtime customer. They make them fall under the category of more relaxed fraud strategies, trying to build trust and credibility, which actually makes it difficult for the analysts to differentiate it from genuine accounts.

These observations spotlights the fact that how organized and sophisticated the fraud regines are and while the world is dealing with the pandemic, new actors are on the rise to make a quick buck even in these situations and considering the ongoing situations the fraud activities can only be expected to rise since the world and economy has shifted online for a major portion of their operations.

AI and ML in fraud mitigation.

Adaptation of AI based anti-fraud systems have increased, but it has also been observed that technology alone cannot be relied on against payment frauds. In times where the customer buying pattern changes rapidly, it is difficult to stick on one logic or strategy.

Let’s take a look at the travel industry, normally the last minute purchase of a one way ticket is flagged as high risk, but the COVID-19 showcased the surge in the purchase of tickets at that particular time even before restrictions took effect. The increasing activities of using Amazon vouchers and other gift cards which are cash redeemable.

These incidents have mirrored the need of a multi layered fighting approach which the technologies are clubbed with a rule-based strategy. Since AL and ML require established pattern recognition to detect fraudulent transactions, a rule based strategy enables the business to set the context and define parameters. Relying alone on the ‘black box’ of an AI / ML technology can be dangerous, we require an explanatory and context based approach or XAI the upcoming generation of AI models.

PCI mandates Open-Source hygiene as a key requirement

Posted on by admin

PCI Software Security Framework: The Beginning.

The Payment Card Industry Security Standards Council (PCI SSC) released a new security framework for software vendors that develop payment applications. This new framework will be replacing the current guidelines of the PCI Payment Application Data Security Standard (PCI PA-DSS) which will be retired in the coming years. The  PCI SSF  standards now cover two separate standards namely:

  1. PCI Secure Software Standard (PCI SSS)
  2. PCI Secure Software Lifecycle Standard (PCI Secure SLC).

PCI SSF and Open Source

Software products have been using open source components over a while now, in their development process. This practice has also paved a way for malicious players to hack their way into the systems in case the open source components aren’t secure enough. Hence, its necessary to maintain and manage to ensure the security of open source components as equal as that of the proprietary software

The new SLC guidelines emphasize on securing the integrity of the code and hence have included them in the requirements. Previously, the  PCI DSS guideline 6.1 – 6.5  focused more on responding to security vulnerabilities post their discoveries. The guidelines emphasize the responsibility to patch up the vulnerabilities within a month post discovery.

As per the  3.2b in the new PCI Secure SLC  document, the guideline states that :

Where open source software components are utilized as part of the software, the assessor shall examine vendor evidence, including process documentation and assessment results to confirm these components are managed as follows:

  • An inventory of open source components used in the software is maintained
  • A mature process exists to analyze and mitigate the use of open source components with known vulnerabilities.
  • The vendor monitors vulnerabilities in open source components throughout their use or inclusion in the vendor’s software to determine when new vulnerabilities are identified.
  • An appropriate patching strategy for the open source components is defined.

The new guideline under PCI Secure SLC encourages the vendors to track components they are using and block with the vulnerabilities from the product. The approach ensures that the risks are eliminated before vulnerabilities are shipped to the product.

The vendors would require to convert their open source usage management with Software Composition Analysis (SCA) solutions like Software Composition Analysis (SCA) that can integrate into the SDLC and automate open source components approval processes, initiate damage processes automatically, trigger real-time alerts, and generate on-demand reports along with other features.

Hence, including open source components will now require more stringent policies and security checks.

Will Compliance with the new PCI Software Security Standards be smooth in the future?

Measures have already been taken by the PCI SSC as getting compliance with the necessary regulations is a painful process. The PCI team has taken due effort in making the transition process smooth for vendors planning the implementation and timeline accordingly.

As a PCI QSA company, QRC would enable customers to map out the dependencies in their applications and highlight the current vulnerabilities and testing against a comprehensive vulnerability.

Web skimmer on the rise amidst the Covid-19 crisis

Posted on by admin

Consumers today have ramped up their online usage and with brick and mortar stores out of reach temporarily, ecommerce has become more of a lifeline. These shifts to digital platforms for payment have widened the playfield for cyber criminals and digital skimming of credit cards is on the rise.

In times of this pandemic, PCI SSC and the US Chamber of Commerce shared guidance and information on protection against digital skimmers. Understanding the evolved threatscape, PCI SSC council shared guidance and information for protecting against the rising online skimming attacks. The following segments outline the key points :

COVID-19 Crisis : Newly evolved threats online

We have seen a drastic rise in the online activity due to the lockdown. With people spending hours on social and ecommerce sites, it has provided widened access for cybercriminals.  There has been an increase in the number of online phishing and scamming incidents with evolved sophistication and volume.

What and Why’s of Digital Skimming

Digital skimmers are online threat players, involved in injecting malicious code (JS sniffers) into legitimate websites to grab payment data. Once the website is infected, the payment card information is skimmed during the transaction without the merchant or consumer being aware.

It is being counted as under the  Magecart  Umberlla, a term popular with cyber professionals and researchers to summarise all the threat groups responsible for online skimming.

“Ecommerce crime spikes whenever there is an event that forces or entices people to perform more online transactions,” Yonathan Klijnsma, Head of Threat Research, RiskIQ

How does Digital Skimming Attacks work ?

Hackers exploit the vulnerable plugins, credential stuffing and undertake phishing and other social engineering techniques to gain access to third party softwares libraries or ecommerce websites to inject the malicious code. Service providers are not aware of the risk they create if they don’t focus on the security and potential threats.

Third party applications and services that are used involve : Live chat function, advertising scripts, customer rating features etc. Since third party functions are more widely used by ecommerce websites, exploit of one function opens doors for multiple websites through mass distribution of malicious Javascript.

Code is executed when a victim submits his payment details during checkout. Cybercriminals involved gather different details as per their target like billing address, names, email, phone number, credit card details, username and password.  The code running logs the data either locally or remotely to a computer controlled by the threat agent.

How severely does this affect small merchants and business ?

Small merchants and service providers do not have sufficient security controls in place and hence at the most risk of these attaches. In times of these crises, small businesses have hassly moved online to remain operational relying on attimes unevaluated technologies. With reduced staff at work and unavailability of large IT infrastructure, they are more susceptible to suck attacks.

It’s evident  from previous Data breach reports that small businesses are  a major chunk of organizations affected by cyber attacks, In the dire time of this pandemic, the sales of COVID-19 domains have increased dramatically which are also used as platforms to launch phishing campaigns and spread malware.

Digital Skimming : Who’s most vulnerable ?

Any e commerce service provider or implementation that doesn’t have sufficient controls in place, provides their platforms as a playfield for digital skimmers. The insecure third party service providers,  and API developers to be used with the website are at a major risk. The hackers keep evolving their attacks and customize their code based on the susceptibility of their target.

The security checks and controls needs to be persistent as the threats are. The Magecard infected stores have been reported to be re-infected in a short while after being assessed. Hence, it is essential that the systems are cleaned and the vulnerabilities are patched or mitigated.

Best practices : How can we remain secure ?

Detection and prevention of these threats are the only ways to remain secure . Few detection methods are as listed below :

Prevention of Digital Skimming :

  • Implement malware protection and keep up to date
  • Restrict access to payment data and supporting environments to only what is necessary and deny all other access by default
  • Ensure responsibilities with third-parties are well understood
  • Use strong authentication for all access to system components

POS Device Security and the Cleanliness

Posted on by admin

POS devices and their usage have become an integral part of every customer facing business. While they provide an ease of making transaction payments, maintaining a hygiene around these crucial devices is also necessary. With  COVID-19  crisis around the clock, the risk of getting affected has quadrupled and with masses inkling more towards the user of cashless mediums to make payment, merchants are facing an increasing challenge in protecting the safety of their customers. These uncertain times requires an increased awareness about the potential risk associated with the touching the payment terminals.

The PCI SSC Council recently shared an article addressing the needs to maintain the POS hygiene and listed down some considerations to be undertaken by the merchants to maintain the security and cleanliness of the POS devices.

Prioritizing Internal Security for Hygiene

While POS devices are more customers facing, the employees handling the devices are prone as well to exposure. In such situations, access to POS devices can be reduced to specific individuals rather than the entire on-shift employees. POS vendors provide internal security feature to segment the managing staff based on multiple criteria.

Promoting Contactless Transactions

Contactless cards prove to a safe payment method for transaction, since they don’t require any physical interaction between the customer and the POS device. Owing to these many countries across the world have increased the maximum value for transactions by contactless or non-PIN means. These methods greatly reduce any physical interaction required for payment. Merchants are encouraged to contact their processor or acquirer to investigate the use of these techniques.

Hygiene of Payment Terminals

POS systems are quite an investment. The increasing pandemic further adds to the need of them to be regularly sanitized. However, many merchants use the same old methods of cleaning the devices by means of spraying disinfectants directly on the keyboard before wiping it. These leads to reduced lifespan of the electronic device.

The vendor’s instruction can come in handy at times like this since the device making varies from one vendor to another. Also, many keypads are not designed to be watertight and hence disinfectants sprayed on can damage the sensitive hardware. Keypads should be wiped gently, also in times like these, customers should be provided with a wipe and sanitizer.

POS Overlays:Precautions and Hazards

Use of Overlays has been seen as means to protect the POS devices from the spray and disinfectants. However plastic wrapping adds an additional layer of risk to the PCI PTS approved devices.

Overlays can be used to capture the card and PIN data from the ATMs and POS devices. By placing an overlay containing an illegal card reader or wires over a card, the customer data can be recorded, along with skimming or hiding of tamper evidence. Only a small degree of opaqueness is sufficient enough to slip or conceal any wire or sensor with malicious intent.

Owing to these, the use of overlays poses a securityrisk to both the merchants and consumers. The use of these on the operations device may also affect the PCI device approval. Its advisable that merchants should consult the acquirer regarding the used of overlays during these crises.

QRC’s Awareness Program

QRC has been creating awareness among the Payment Card Professionals regarding forming and putting down the best practices in use in their daily operations regularly. Being awareness of the various possible threatscape can prove to be vital for any organization is safeguarding any losses due to data breach that might lead to loss of reputation and resources.