Cell Phone Tapping: GSM Encryption Hacked
By Michael Coats for Information Security Short Takes
GSM cellular networks in the US and Europe use the A5/1 stream cipher meant to ensure cellular calls cannot be listened into by unauthorized parties monitoring radio traffic. However, the guarantee of privacy is no longer ensured. New attack techniques were unveiled at the Hacking at Random conference in The Netherlends which would allow an attacker to decrypt cellular calls made over a GSM network. The attacker only needs the new software and about $500 in radio monitoring equipment.
ISR News: CardSystems Breach Spurs Suit
Excerpts From Digital Transactions
Four years later, the fallout from the notorious CardSystems Solutions Inc. data breach—at the time the biggest hacking of payment card data ever—surfaced last week and looks like it could go on for months or even years. Merchant acquirer Merrick Bank Corp. is suing Savvis Inc., the company that inspected CardSystems before the breach, for alleged negligence because Savvis had concluded that the processor’s security systems met Visa Inc.’s standards.
ISR News: US Banks Going Biometric
Excerpts From Finextra.com
A global survey conducted by Unisys last year found that 72% of US citizens would be willing to undergo fingerprint scans to verify their identities when dealing with banks and government organisations.
ISR News: FBI Raids Texas Data Centers
Excerpts From Blog.wired.com
The raids were part of an investigation prompted by complaints from AT&T and Verizon about unpaid bills allegedly owed by some data center customers, according to court records. One data center owner charges that the telecoms are using the FBI to collect debts that should be resolved in civil court. But on Tuesday, an FBI spokesman disputed that charge.
ISMG Launches GovInfoSecurity.com
Press Release From GovInfoSecurity.com
We have a new President, a new Administration, a new session of Congress … and a new national mission throughout government to secure personal data and protect our borders from cyber threats. Information security has never been more important to the federal government - or to all of us, as we conduct personal and professional business in this electronic world.
ISR News: PCI DSS verses Cybercrime
Excerpts From BankInfoSecurity.com
Yvette Clarke, D-NY, Chair of the Subcommittee, admonished the payments industry, saying “The payment card industry and issuing banks should be ashamed about the current state of play and doing everything possible to immediately institute improvements in infrastructure.”
Payment Card Industry Swallows Its Own Tail
By Anthony M. Freed, Information-Security-Resources.com Financial Editor
Anyone who has been following the cascade of security failures plaguing the payment card industry in the last year, and punctuated by the still-shrouded breaches at RBS WorldPay (RBS) and Heartland Payment systems (HPY), has to acknowledge that there are major problems with security that need to be addressed pronto. But the greatest threat to the survival of PCI DSS (Payment Card Industry Data Security Standard) may not be the ever-evolving tactics of the criminal hackers intent on a “big score,” but instead the dysfunctional nature of the relationships between the very parties the standards are meant to serve.
ISR News: Heartland Class Action Lawsuit
Excerpts From ComputerWeekly.com
An investor has filed a proposed class action in the US district court of New Jersey on behalf of all other investors in Heartland between August 2008 and February 2009. The complaint alleges that Heartland issued false or misleading statements and failed to disclose material adverse facts about its business, operations and prospects during that period. Heartland’s shares during that period also declined from $21.84 per share, or approximately 80%, from its high of $27.19 per share in September 2008.
ISR News: Visa Sanctions RBS Too
Excertps From BankInfoSecurity.com
In the statement, Visa confirmed that both Heartland and RBS WorldPay as a result of their recent data breaches, have been removed from the company’s Payment Card Industry Data Security Standard (PCI DSS) Compliant Service Providers list. This list represents the service providers that Visa has validated as being PCI DSS compliant for merchants and other businesses to run their credit card transactions.
Visa Sanctions: Heartland Issues Statement
STATEMENT FROM HEARTLAND PAYMENT SYSTEMS
March 13, 2009
Heartland was certified as PCI-DSS compliant in April 2008 and expects to continue to be assessed as PCI-DSS compliant in the future. We’re undergoing our 2009 PCI-DSS assessment now, which Heartland believes will be complete no later than May 2009 and will result in Heartland, once again, being assessed as PCI-DSS compliant.
