Black Hat is Over, But SQL Injection Attacks Persist

Privacy Rights Clearinghouse reported that 312 million data records have been lost since 2005 and 83% of hacking-related data breaches were executed via SQL injection attacks.

Image source: imsmartin

In a period of six months, UK-based secure cloud hosting company FireHost reported a huge 69% jump in SQL injection attacks. It tracks these numbers based on the hundreds of thousands of total attacks it blocks on behalf of its cloud hosting clients.

Consider the stance from cloud hosting providers. If they can detect and block an attack against one website residing on their network, then they can collect this information over time, building knowledge that can be used to protect the entire hosted community.

For the most part, SQL injection attacks are automated and website owners may be blissfully unaware that their data could actively be at risk. Sites continue to lose customer data to digital thieves. Is your CU one of them? Read the article to learn more.

Android app steals contactless credit card data

Better not let your members get too comfy with their contactless cards.

Image source: Article

paycardreader, the Android application capable of siphoning credit card data from contactless bank cards has been posted on Google Play Store by a German penetration tester.

The app, which skims card numbers, expiration dates, transaction data, and merchant IDs, was launched at Integralis Security World 12 in Germany while considered still unstable. Developer and senior consultant for Integralis Thomas Skora said the app was "only for technical demonstration" to show how data could be swiped from contactless cards, such as PayPass Mastercard and GeldKarte.

Not the first time contactless cards have been proven hackable by security researchers. And thankfully for all your CU's contactless card holders, paycardreader was available for download on Google Play Store and GitHub. Get the full story from SC Magazine.

Researchers Find Serious Flaws in Popular Point-of-Sale System

VeriFone Systems' widely used Artema Hybrid point-of-sale system has been found by Security Research Labs in Germany to have several serious vulnerabilities which enable attackers to alter transactions, steal card data, and perform other malicious activity.

Image source: Nik Hewitt

The series of weaknesses discovered within some of the terminals gives attackers pathways into the system both remotely and via local interface. The bigger issue however is what an attacker can do after gaining access to the system. The most serious attack scenario would involve the attacker not only stealing data from a payment card, but modifying the transaction itself as well by changing the amount charged to the card.

VeriFone is currently investigating the situtation to determine the appropriate countermeasures and will release an update when further information is available. Read the details of the report in the Threatpost article.

Hackers Blackmail Belgian Bank With Threats to Publish Customer Data

What's worse - cybercriminals breaking into your credit union's systems and stealing your members' confidential information, or being told by your attackers that you must cough up €150,000 if you don't want this member data to be published?

Image source: Bergquist

Just this week Belgian credit provider Elantis faced both. Claiming that the compromised data was unencrypted and unsafely stored, the hackers told Elantis that "while this could be called 'blackmail,' we prefer to think of it as an 'idiot tax' for leaving confidential data unprotected on a Web server."

The attack is now being investigated by the Belgian Federal High Tech Crime Unit and the outcome remains to be seen. In the meantime, lesson to be learned. There's no excuse for not properly securing and safeguarding your members' confidential data.

Are your members protected from such a breach? Read more.