Researchers Find Serious Flaws in Popular Point-of-Sale System

VeriFone Systems' widely used Artema Hybrid point-of-sale system has been found by Security Research Labs in Germany to have several serious vulnerabilities which enable attackers to alter transactions, steal card data, and perform other malicious activity.

Image source: Nik Hewitt

The series of weaknesses discovered within some of the terminals gives attackers pathways into the system both remotely and via local interface. The bigger issue however is what an attacker can do after gaining access to the system. The most serious attack scenario would involve the attacker not only stealing data from a payment card, but modifying the transaction itself as well by changing the amount charged to the card.

VeriFone is currently investigating the situtation to determine the appropriate countermeasures and will release an update when further information is available. Read the details of the report in the Threatpost article.

BYOD is a user-driven movement, not a secure mobile device strategy

As phenomenal as the “bring your own device” (BYOD) movement may be, it sure is complicating things for IT security planning.

Image source: imsmartin

Whether people are bringing their own mobile devices into the workplace in order to access corporate resources or simply to check their social networks, the movement is unstoppable. Recent reports from sources such as Gartner and Cisco forecast 90% of businesses supporting corporate applications on mobile devices by 2014, and a 3.47 average number of devices per person by 2015, expected to increase to 6.58 devices per person by 2020.

That’s a lot of personal devices for your credit union to manage. What to do?

The basic options are: block ALL devices not provisioned, block NO devices at all, or control access for SOME devices, granting or blocking access to resources based on need and risk. Addressing this question alone, however, is not enough, as the real challenge still remains: secure mobility. Even more important than managing device access to your network is controlling what these devices can do while they have access.

What’s your strategy? Is it working? Learn more about combining "mobile device management" (MDM) with "mobile application management" (MAM) and stay on top of BYOD.

5 Enterpriseworthy Cloud Storage Services

Cloud storage and file sharing services have been emerging at an impressive clip over the past few years.

Image source: Fotopedia

What if you want a secure business solution for your virtual office?

One solution for cloud storage and document management on the list is Ftopia, which allows you to configure a file structure and create branded, secure, tamper-evident, virtual rooms that can be shared with colleagues or clients.

Sit back and relax and let the article take you on a tour of the best cloud storage services for small to midsize businesses such as your own Credit Union. The list contains: Box, Carbonite, Egnyte HybridCloud, Ftopia, and SugarSync.

Federal appeal court raps bank over shoddy online security

A U.S. construction company may stand a greater chance of recovering some of the US$345,000 it lost in fraudulent wire transfers that it blames on poor online banking practices of its bank.

Image source: Flickr

Fraudsters made six wire transfers using the Automated Clearing House (ACH) transfer system amounting to more than $588,000 in May 2009. About $243,000 was recovered.

The court found that Ocean Bank was not monitoring its transactions for fraud nor notifying customers before a suspicious transaction was allowed to proceed, both capabilities that it did possess with its security system.

Pay me now or pay me later...Are you doing enough to protect your members and your CU? Read the full article to see what could have been done to alter the outcome.

App Development: Been There Done That

The age of the Internet has created a sense of urgency in the world. There is a strong want for instant gratification.

Image source: Article

People expect news, status updates from friends and feedback on anything and everything instantly. So why should it be any different for mobile Apps?

When creating your own apps, be mindful of the following pitfalls described in this article.

Read the full article to see if your apps are up to snuff.

eHarmony analysis shows people just don’t care about passwords

Trustwave's SpiderLabs has completed an analysis of the passwords dumped on the Internet in this month’s eHarmony breach.

Image source: FR

The results of the analysis reached the depressing conclusion that too few people really seem to care about password strength.

As it was, more than 1.2 million passwords were cracked in 72 hours, using three NVIDIA GPUs and the oclHashcat and John the Ripper cracking tools.

Are these tools being used against your members? Read the full article to learn more.

Operation High Roller Targets Corporate Bank Accounts

Two security firms say a new type of cyberattack is targeting corporate bank accounts.

Image source: Random Squeegee

The attacks began in Europe but have spread to Latin America and the United States.

So far, hackers have attempted to steal at least $78 million in fraudulent transfers from accounts at 60 or more financial institutions.

Read the full article to learn more.

Did ONE high-tech worker bring RBS to its knees?

Was RBS brought to its knees by ONE junior IT technician?

Image source: Article

A junior technician in India caused the RBS computer meltdown which froze millions of British bank accounts, it was claimed.

The ‘inexperienced operative’ erased a massive swathe of information during a routine software upgrade for the Royal Bank of Scotland and its subsidiaries NatWest and Ulster Bank, according to reports.

Read the full article to see if your CU IT staff is up to snuff.

DroidSheep: Android tool for session hijacking

DroidSheep is a simple Android tool for web session hijacking (sidejacking).

Image source: Article

The tool listens for HTTP packets sent via a wireless (802.11) network connection and extracts the session id from these packets in order to reuse them.

The tool's main intention is to demonstrate how EASY it can be, to take over nearly any internet account.

Read the full article and watch the video to see how it works.

Dozens Held in FBI Credit-Card Fraud Sting

The Manhattan District Attorney and the FBI released details of a huge international cybercrime takedown.

Image source: Rude Cactus

The sting, known as Operation Card Shop, was established to thwart criminals from stealing credit or debit card information from the Internet and using the information for fraudulent transactions.

According to a news release, the coordinated action involved 13 countries and resulted in 24 arrests.

Read the full article to learn more about the sting. Were any of your members impacted?

IBM Acquisitions Deliver Storage for the Rest of Us

Beginning in late 2005, IBM recognized the huge potential in the storage market, investing in a big way in storage hardware, software, and other storage infrastructure elements.

Image source: Article

“We made somewhere between 13 and 14 acquisitions between 2006 and 2010,” said IBM systems storage VP, Bob Cancilla. “We wanted to invest more organically, taking some of our own technology from R&D, but at the same time not to be afraid to go out and acquire where it makes sense.”

IBM’s storage portfolio has become extremely comprehensive for all ranges of organizations, including Credit Unions.

IBM is not buying companies and technologies and hoping for the best. Read the full article to see how IBM is bringing storage to the mass market with a vengeance.

Keys to Cloud Success: Security, Flexibility, Reliability and Management Simplicity

During the Dell Storage Forum 2012 in Boston, Brocade Global Solutions Architect Roger Bouchard met with Stu Miniman of Wikibon.org as part of theCube’s conference coverage.

Image source: Article

“In talking to customers about SAN security, it used to be that storage administrators would have their eyes glaze over when asking them about security,” Bouchard said.

Bouchard added that the advent of the cloud model has forced security, networking and storage teams to work closely together to address security, which is an impediment to businesses moving to the cloud, particularly when it comes to data confidentiality.

Read the full article and watch the video to get Bouchard's view on how Fibre can help address cloud security concerns.

Big Data Must Shift from Creativity to Scalability and Reliability

Geoffrey Moore of Mohr Davidow Ventures and author of many books including Crossing the Chasm, Inside the Tornado, and Inside the Fault Line, delivered the keynote at the Hadoop Summit 2012.

Image source: Article

In the article, Moore discusses how early media companies, such as Yahoo, which found the Hadoop stack, found the Big Data space, but now the rest of the world is figuring out how and when to start working with Big Data.

In assessing how the market will evolve, Moore said early adopters will start with projects. Those that are successful will get visibility while others will hold off. But as successful use-cases emerge, others will jump in.

Read the full article and watch the video to get Moore's expanded view on Big Data success.

Big Data and the Cloud – Take the Lead or Be Disrupted

Most organizations have successfully tackled structured data collection and some have even overcome some of the challenges associated with structured data analysis.

Image source: Flickr

Unfortunately, the methods used rely on data stores that were built "the old way".

Big Data requires a new look at how we collect and analyze information, and "the true power and incremental value comes from layering on unstructured, contextual information on top of this structured data," claimed Kim Stevenson, Vice President Information Technology Group CIO at Intel. "Bring in the data, assess what’s important, and get out."

Read the full article and watch the video to see how Intel is driving adoption of the Cloud and the use of Big Data.

CHART: Here's How Fast Square Is Growing

Square, the payments startup run by Twitter cofounder Jack Dorsey, is growing payments volume at a runaway clip.

Image source: Article

For Square, payments volume is a very close proxy for revenues: It takes a 2.75% cut of most transactions, which it then splits with Visa, MasterCard, and the banks.

The company has 330 employees at last count. We don't believe it's profitable yet, but at these growth rates—20 percent in the last two months—it could easily make money if it chose to. We think instead it's going to keep spending to acquire small-business customers.

View the full size chart and read more about Square and how it could impact your CU.

7 tips for establishing a successful BYOD policy

This pressure might leave you wondering the keys to developing a BYOD policy and how best to implement it.

Image source: Article

The seven core ideas contained in the article should be a part of any good Bring Your Own Device program. Each idea comes with many important questions to ask yourself, your IT associates and your executive team while developing a BYOD policy.

First on the list: Specify what devices are permitted. It's important to decide exactly what you mean when you say "bring your own device." Make it clear to employees who are interested in BYOD which devices you will support - in addition to whatever CU-issued devices you continue to deploy-and which you won't.

Read the full article to see the rest of the BYOD tips.

Central logging with open source software

A common thread among many IT/Engineering roles is having the data available, searchable, and visible.

Image source: Atom Smasher

While in the midst of implementing a comprehensive solution, this post is a brain dump and road map for how the author went about it, and why.

Read the full article to see if open source logging is right for your CU.

Woman Who Couldn’t Be Intimidated By Citigroup Wins $31 Million

Sherry Hunt never expected to be a senior manager at a Wall Street bank. She was a country girl, raised in rural Michigan by a dad who taught her to fish and a mom who showed her how to find wild mushrooms.

Image source: Article

In November 2004, Hunt, joined Citigroup (C) Inc. as a vice president in the mortgage unit. It looked like a great career move.

Hunt’s team was responsible for protecting Citigroup from fraud and bad investments. She and her colleagues inspected loans Citi wanted to buy from outside brokers and lenders to see whether they met the bank’s standards.

“All a dishonest person had to do was change the reports to make things look better than they were,” Hunt says. “I wouldn’t play along.” Instead, she took her employer to court -- and won. In August 2011, five months after the meeting with Polkinghorne, Hunt sued Citigroup in Manhattan federal court, accusing its home-loan division of systematically violating U.S. mortgage regulations. Read the full article to learn more.

Arizona Credit Union Hopes New Tech Will Attract Small Businesses

While the ability of credit unions to lure disaffected consumers away from large banks is debatable, Desert Schools Federal Credit Union believes it can use technology to lure small businesses away from the banks they use for transaction processing.

Image source: Facebook

Only 8,500 of its 300,000 members are businesses. To reach a broader range of business clients, the Phoenix-area credit union is planning to implement a web based, centralized payment processing system and broader financial services portal that provides access to payment processing services via any web-connected device.

The CU will also offer a web-based reporting system that provides access to financial and business reports.

What is your Credit Union doing to attract and keep your members? Read the full article to learn more about how this CU is using new technology.

Underbanked, But Not for Long

Financial institutions and tech firms are working to use mobility and analytics tied to prepaid cards to reach underbanked consumers

Image source: Flickr

Financial institutions can spot healthy customers among prepaid users to grow deposits and, eventually, credit and loan accounts.

At the same time, consumers escape the high fees of payday lending and check cashing businesses, a chronic problem that can prevent consumers from establishing a track record that makes them more attractive to banks.

The bottom line: New mobile and data analysis technologies and processes are making it easier to reach underbanked consumers. Read the full article to see how your Credit Union fits in.