Mobile point-of-sale exploit exposes customers to card fraud

Devices from PayPal, Square, iZettle and SumUp all found to contain critical security flaws

Updated with comments from those companies affected

Mobile point-of-sale machines from some of the industry's leading payment providers have been found to contain vulnerabilities that allow fraudulent merchants to steal credit card information or intercept transactions to steal funds from customers.

Research presented at the Black Hat security conference in Las Vegas revealed that mPOS devices supplied by PayPal, iZettle, SumUp and Square all contained flaws that could lead to customers being tricked into paying more for their purchases.

Positive Technologies researchers Leigh-Anne Galloway and Tim Yunusov said that mPOS systems, such as card readers, had become a favoured target among criminals given how easy it is to get their hands on a device.

Advertisement
Advertisement - Article continues below

These systems are usually linked via Bluetooth to a smartphone or tablet mobile app, which then sends data to the payment provider's server. Researchers found that criminals or malicious merchants could intercept this traffic and change the value being transferred during a magstripe payment, without alerting the customer.

"Currently there are very few checks on merchants before they can start using an mPOS device and less scrupulous individuals can, therefore, essentially, steal money from people with relative ease if they have the technical know-how," said Galloway.

"As such, providers of readers need to make sure security is very high and is built into the development process from the very beginning."

Hackers typically target cheaper devices, those frequently used by smaller businesses and places such as food stalls that require temporary payment systems, that tend not to be compatible with the latest secure payment options, such as EMV-enabled chip and pin.

Only 59% of card readers in the US are compatible with EMV payments, and the majority of payments are still made using a magstripe and signature, according to the researchers.

It was also discovered that it was possible to use remote code execution attacks to gain access to a device's operating system. This means that criminals could manipulate those devices that do use more secure chip and pin methods by making it look as if the payment method wasn't working, forcing the customer to opt for a magstripe instead.

Yunusov added that "merchants should also assess the risk of any device they plan on integrating into their business. There is no need to still be reliant on magstripe transactions".

"While the market for most of these products is currently not very mature, the popularity is growing so it is imperative that security is made a priority."

The researchers said that Square, PayPal, iZettle and SumUp had all been informed of the vulnerabilities and that Positive Technologies was working with them to help secure the devices.

A SumUp spokesperson told us that "there has never been any fraud attempted through its terminals using the magnetic stripe-based method."

Advertisement
Advertisement - Article continues below

"All the same, as soon as the researchers contacted us, our team successfully removed any possibility of such an attempt at fraud in the future. We welcome the magnetic stripe being phased-out, and user behaviour suggests that both vendors and purchasers share our position."

A spokesperson from iZettle said that "the issue flagged to us by the researcher is resolved, and the iZettle service and its community remain unaffected".

PayPal also said there has been no evidence that their devices have been exploited in such a way.

"Security is a top priority at PayPal and we recognize the important role that researchers and our user community play in helping to keep PayPal secure. PayPal's systems were not impacted and our teams have remediated the issues raised by the researcher."

Featured Resources

The IT Pro guide to Windows 10 migration

Everything you need to know for a successful transition

Download now

Managing security risk and compliance in a challenging landscape

How key technology partners grow with your organisation

Download now

Software-defined storage for dummies

Control storage costs, eliminate storage bottlenecks and solve storage management challenges

Download now

6 best practices for escaping ransomware

A complete guide to tackling ransomware attacks

Download now
Advertisement

Recommended

Visit/security/354156/google-confirms-android-cameras-can-be-hijacked-to-spy-on-you
Security

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019

Most Popular

Visit/security/identity-and-access-management-iam/354289/44-million-microsoft-customers-found-using
identity and access management (IAM)

44 million Microsoft customers found using compromised passwords

6 Dec 2019
Visit/cloud/microsoft-azure/354230/microsoft-not-amazon-is-going-to-win-the-cloud-wars
Microsoft Azure

Microsoft, not Amazon, is going to win the cloud wars

30 Nov 2019
Visit/hardware/354237/five-signs-that-its-time-to-retire-it-kit
Sponsored

Five signs that it’s time to retire IT kit

29 Nov 2019
Visit/business/business-strategy/354195/where-modernisation-and-sustainability-meet-a-tale-of-two
Sponsored

Where modernisation and sustainability meet: A tale of two benefits

25 Nov 2019