Fraudsters attack from almost everywhere. Have you been to any of these hotels?

Have you given a second thought before swiping your card while booking hotels? I bet you never rethink on doing that... but what if we say you have to...

This is something that had happened at InterContinental Hotels recently. IHG didn’t reveal just how many hotel properties were considered to be at risk, but the examination shows that the state-by-state lookup tool they published online reveals it to be higher than 1170. 

In recent years many hotel chains – including Hyatt, Omni, Hilton Hotels, Starwood Hotels, and Trump Hotels – have found themselves targeted by criminals using malware to steal payment card information. The problem has become so serious that you might start to wonder whether it might be safer to pay on hotel properties with cash, or at least with a card which has a low payment limit.

The investigation identified signs of the operation of malware designed to access payment card data from cards used onsite at front desks for certain IHG-branded franchise hotel locations between September 29, 2016 and December 29, 2016. Although there is no evidence of unauthorized access to payment card data after December 29, 2016, confirmation that the malware was eradicated did not occur until the properties were investigated in February and March 2017. Before this incident began, many IHG-branded franchise hotel locations had implemented IHG’s Secure Payment Solution (SPS), a point-to-point encryption payment acceptance solution. the implementation of SPS ended the ability of the malware to find payment card data and, therefore, cards used at these locations after SPS implementation were not affected.

The malware searched for track data (which sometimes has cardholder name in addition to card number, expiration date, and internal verification code) read from the magnetic stripe of a payment card as it was being routed through the affected hotel server. There is no indication that other guest information was affected.

It is always advisable to remain vigilant to the possibility of fraud by reviewing your payment card statements for any unauthorized activity. You should immediately report any unauthorized charges to your card issuer because payment card rules generally provide that cardholders are not responsible for unauthorized charges reported in a timely manner. The phone number to call is usually on the back of your payment card. 

Be aware, Be safe !

Mastercard Unveils Next Generation Biometric Card

If you have read the subheading, then you must be wondering as to how the simple implementation of the ultra-common fingerprint sensor on your debit card will change the banking experience? Consider your cash withdrawals during the period of "demonetization" in 2016. You must be remembering that it was a tricky method to enter your debit card PIN while hiding the num-pad of the ATM machine from prying eyes behind you, pushing each other to get a glimpse of your transaction details.

If you remove that num-pad based PIN entry from the scene, no one in the world would get a clue about your debit card PIN, apart from your bank. This implementation would also make card payments at restaurants or shopping malls a lot more secure.

However, all fingerprint sensors are not alike. Mastercard implementation as involving a trip to "an enrollment center," where a user could store one or two different prints (of their own) on their card. An encrypted digital template of your fingerprint is stored on the card's EMV chip. The new cards authenticate when a matching fingerprint is supplied by the user after inserting the card into a Chip and Pin terminal (not swiped). The card sensor would also not work when used in an ATM that ingests the card.

MasterCard is keen on embedding this basic technology on its line-up of credit and debit cards to enhancing the user security. Not only security, a biometric authentication would make payments faster, in the same way as unlocking your smartphone is just a tap away instead of those complex mazes that you used (many of you still do it) to set as your pattern password.

The demo cards are currently being tested in South Africa and MasterCard plans to roll it out to the world by the end of 2017. The cards are not any different from your regular credit/debit card that you carry in your wallet. While the basic architecture remains mostly the same, you will notice only a matte coloured sensor patch on the top left corner of the card.

The card itself is no thicker than a regular credit card. The fingerprint sensor is a small, thumbnail-sized rectangle that sits at the top right corner, and is easily accessible when you stick the card into a payment terminal.

When the terminal asks you to insert the card, it's communicating to the bank information like your identity and the amount of the transaction. Then, it verifies your identity by asking for your fingerprint. The sensor reads your finger, and sends the information to the card's chip, which determines if you're the owner. If you are, it sends a "Yes" or "Authorized" message to the bank, which then allows the payment to pass.

As for the vendors, there’s no need to upgrade any hardware, unless you are still using the magnetic-type swipe-based transaction machine on your billing desk.

While MasterCard is planning a global roll-out of the fingerprint-enabled debit card, you can be assured that it will take a few years due to the additional time being taken by banks and financial institutions to get their approvals from the management for the implementation of this new convenience.

Android Spyware SMSVova found on Google Play Store

Millions of users have been tricked into downloading Android spyware disguised as a system update in the Play Store. The app that claims to give users access to the latest Android updates remained undetected in the Play Store for three years and was downloaded between one and five million times. 

Experts at Zscaler discovered that the bogus app was posing as a legitimate application called “System Update” and claiming to provide users with access to the latest Android software release.

It has been estimated that the fake application hiding the SMSVova spyware was uploaded in the Google Play in 2014, and has been downloaded between 1,000,000 and 5,000,000 times.

Experts reported the discovery to Google that promptly removed it from the store.

The SMSVova spyware was developed to track the physical location of the users, it was controlled by attackers via SMS messages.

“In our ongoing effort to hunt malware, the Zscaler ThreatLabz team came across a highly suspicious app on the U.S. Google Play Store that has been downloaded between one and five million times since 2014.” reads theanalysis published Zscaler. “Upon analysis, we found it to be an SMS-based Spyware, which can steal and relay a victim’s location to an attacker in real time.”

According to Zscaler, once the app was installed when users try to open it they were displayed the message:

‘Unfortunately, Update Service has stopped.’

Then the app hides itself from the main screen and launches the phone’s MyLocationService which collect location data and stores it in the Shared Preferences directory of the mobile device.

Despite the error message, the spyware sets up an Android service and broadcast receiver:

• MyLocationService: Fetches last known location
• IncomingSMS (Receiver): Scans for incoming SMS message

SMSVova monitors specific incoming SMS messages with specific characteristics, messages with more than 23 characters in length and that contain the text string “vova-” and “get faq.”

It is curious to note that according to the recent Google Android Security 2016 Year In Review report, in 2016 devices that installed applications only from Google Play had fewer than 0.05 percent of potentially harmful applications installed.

“There are many apps on the Google Play store that act as a spyware; for example, those that spy on the SMS messages of one’s spouse or fetch the location of children for concerned parents. But those apps explicitly state their purpose, which is not the case with the app we analyzed for this report,” concluded the analysis.

It is unclear why exactly was the malware focusing on user location alone. The app also hasn’t been updated since December 2014, however, millions of people kept downloading it. Google has now removed it from the store after being alerted, but the app did go undetected since it first appeared in 2014. We are still to hear back from the search giant on why this app remained active for three years in the Play Store.

IOT security and Mobile application security trends

How about taking a look a look at the latest mobile application & IOT security trends. Here is a summary of the Mobile application and IOT application security study conducted. The CIO, CISO, CTO, CRO and the COOs were surveyed from organizations pertaining to Financial Services, Health & Pharmaceuticals, Public Sector, Retail, Technology and Services and several other industries.

58% - Organizations were concerned that they could get hacked through an IOT application.
53% - Organizations were concerned that they could get hacked through a mobile device.

84% - Organizations were concerned about the threat of malware to mobile apps
66% - Organizations were concerned about the threat of malware to IOT apps

79% - People believe that use of mobile apps increases risk
75% - People believe that use of IOT apps increases risk

15% - People say that CISOs are responsible for the security of the mobile application
31% - People say that Head - Applications are responsible for the security of the IOT apps

54% - People believe that only a serious hacking incident influences the organization to increase budget
46% - People believe that New regulations also influences the organization to increase budget

Application security assessment frequency

42% - Organizations care to secure their IOT apps urgently
32% - Organizations care to secure their mobile apps urgently

48% - Organizations do not test their IOT apps
18% - Organizations test the mobile apps when there is a code change

Difficulty levels in fixing OWASP vulnerabilities

57% - People believe that pentesting the primary means of securing mobile apps
30% - People believe that security testing through SDLC is the primary means of securing mobile apps

69% - People believe that the rush to release the mobile app on the development team leaves the code vulnerable
40% - People believe that the lack of testing procedures leaves the code vulnerable

32% - Mobile applications are tested in the development environment
26% - IOT apps are tested in the development environment

Credits: Ponemon Institute.

Is Bose secretly collecting personal data through your headphones??

Audio electronics giant Bose faces data mining charges over accusations that it has been covertly collecting its customers’ personal information, including tastes in music and podcasts, in cooperation with a San Francisco-based aggregator.

According to the class action suit’s lead plaintiff, Kyle Zak, who invites fellow Bose customers to join the fight, the app asks for the user’s phone number, name, email address and headphone serial number in exchange for the extra oomph. Per the suit, the app makes detailed profiles of listening history and habits. Sending that information to a third party without the user’s express consent violates what is known as the WireTap law.

This company has collected and recorded the details of music and audio files customers listen to via its Bose Connect app. They then transmit this data, along with customers’ personal identifies, to third-parties, including data miners. Consumers have no idea that this takes place, according to the suit.