Security News

Cybersecurity researchers have disclosed a novel attack that could allow criminals to trick a point of sale terminal into transacting with a victim's Mastercard contactless card while believing it to be a Visa card. The research, published by a group of academics from ETH Zurich, builds on a study detailed last September that delved into a PIN bypass attack, permitting bad actors to leverage a victim's stolen or lost Visa EMV-enabled credit card for making high-value purchases without knowledge of the card's PIN, and even fool the terminal into accepting unauthentic offline card transactions.

Visa announced the availability of a new benefit for its Visa consumer credit accountholders in the U.S. Consumers with Visa Infinite, Visa Signature or Visa Traditional credit cards can now enroll and take advantage of a complimentary offer and discounts on products and services from NortonLifeLock. "The past year has brought tremendous change in the way people are using their Visa credit cards and associated benefits," said Brian Cole, head of product, NA, Visa.

A North American merchant's point-of-sale terminals were infected with a mix of POS malware earlier this year, Visa reports. In May and June 2020, the company analyzed malware variants used in independent attacks on two North American merchants, one of which employed a TinyPOS variant, while the other involved a mix of malware families such as MMon, PwnPOS, and RtPOS. As part of the first attack, phishing emails were sent to a North American hospitality merchant's employees to compromise user accounts, including an administrator account, and legitimate administrative tools were used to access the cardholder data environment within the network.

The United States has revoked visas of more than 1,000 Chinese students and researchers under an order by President Donald Trump that accused some of them of espionage, the State Department said Wednesday. Trump, in a May 29 proclamation as tensions rose with Beijing on multiple fronts, declared that some Chinese nationals officially in the United States for study have stolen intellectual property and helped modernize China's military.

All modern contactless cards that make use of the Visa protocol, including Visa Credit, Visa Debit, Visa Electron, and V Pay cards, are affected by the security flaw, but the researchers posited it could apply to EMV protocols implemented by Discover and UnionPay as well. As a result, the Card Transaction Qualifiers used to determine what CVM check, if any, is required for the transaction can be modified to inform the PoS terminal to override the PIN verification and that the verification was carried out using the cardholder's device such as a smartwatch or smartphone.

A JavaScript skimmer identified earlier this year uses dynamic loading to avoid detection by static malware scanners, Visa warns. The skimmer is basic, containing the expected components and functionality of such a kit, namely an administration panel, an exfiltration gateway, and a skimming script generator, but has an advanced design, suggesting that it is the work of a skilled developer, Visa notes in a security alert.

Visa said it created the Advanced Identity Score to reduce the amount of digital identity fraud. The company described Advanced Identity Score as an effort to combine "Visa's artificial intelligence and predictive machine learning capabilities with application and identity related data to generate a risk score for new account applications to help reduce fraud, prevent negative impact to brand loyalty and trust, and eliminate operational costs due to remediation."

Very Good Security, a leader in modern data security and custodianship, announced that it has received a strategic investment from Visa to expand access to VGS' infrastructure-as-a-service for financial technology companies and large enterprises. Visa joins other notable investors, including Goldman Sachs, Andreessen Horowitz, Vertex Ventures US, and Max Levchin, in advancing VGS' mission to provide a better approach to data security, privacy and compliance.

Network Attacks an Alternative to Use of Skimmers on Pumps, Alert NotesSeveral sophisticated cybercriminals gangs are targeting "fuel dispenser merchants" throughout North America, in some cases...

Sophisticated cybercrime groups have targeted North American gas stations with point-of-sale (PoS) malware, Visa warns. read more