 |
||||
 What's New
|
 Highlights
|
|||
|
The Countdown to PCI DSS 4.0 The publication of the PCI DSS v4.0 standard, along with the summary of changes from v3.2.1 to v4.0, is scheduled for late March 2022. The “Report on Compliance” (ROC) template and the Attestations of Compliance (AOC) will also be published at that time, and the Self-Assessment Questionnaires (SAQ) will be published shortly thereafter. The PCI DSS v3.2.1 standard will remain active for two years after the publication of v4.0. As of March 31, 2024, the PCI DSS v3.2.1 standard will be retired, and v4.0 will become the only active version of the standard. In addition to the transition period during which both v3.2.1 and v4.0 will be active, organizations have until March 31, 2025, to gradually introduce the new requirements that are initially identified as best practices in v4.0. You can find more information at the following link: Request for Comments: New COTS Mobile Payments (MPoC) Standard The Council is currently developing a new mobile standard designed to support the future evolution of mobile payments. The standard is based on the PCI Software-based PIN Entry on COTS (SPoc) and PCI Contactless Payments on COTS (CPoC) standards. The goal is to create a flexible mobile standard and a program for developing payment solutions that allows both PIN entry and contactless payments through native COTS interfaces. More information at the following link: National Cybersecurity Alliance and PCI Security Standards Council Publish Joint Bulletin on Ransomware Attack The PCI Security Standards Council (PCI SSC) and the National Cybersecurity Alliance published a joint bulletin on February 14 regarding the growing threat of ransomware attacks, describing the main threat, how these types of attacks are carried out, and some of the best preventive actions. More information at the following link: What Are the Acceptable Formats for Truncating Primary Account Numbers? The PCI SSC updated the list in January 2022 for acceptable truncation formats for different PAN / BIN lengths. More information at the following link: EU Cuts Seven Russian Banks Out of Swift The European Union formally agreed to expel seven Russian banks from Swift. After being published in the Official Journal of the EU, Bank Otkritie, Novikombank, Promsvyazbank, Bank Rossiya, Sovcombank, Vnesheconombank (VEB), and VTB Bank will no longer be able to use Swift for their daily operations. Sberbank and Gazprombank, two of the country's three most important entities, have been left out of the sanctions, as the bulk of payments for oil, gas, or coal purchased from Russia are channeled through them. More information at the following link: Visa and Mastercard Hit Russian Banks - Anonymous Intensifies Cyberwar Visa and Mastercard have blocked multiple Russian financial institutions from their network in compliance with government sanctions. Visa stated it was taking swift action to ensure compliance with applicable sanctions and added that it would donate $2 million for humanitarian aid, as will Mastercard. Meanwhile, Anonymous appears to be getting involved in the conflict between Ukraine and Russia by declaring that it is waging a cyberwar against President Vladimir Putin and the Russian government. Anonymous account messages claimed responsibility for disabling websites belonging to: Gazprom, the Russian state-controlled news agency, and numerous Russian and Belarusian government agencies, including the official Kremlin website. More information at the following link: |
Mapfre Expands PCI DSS Certification for its Alcalá de Henares Data Processing Center Internet Security Auditors, as a company accredited by the PCI SSC through its QSA certificate, awarded PCI DSS (Payment Card Industry Data Security Standard) Certification to Mapfre. This certifies that the data centers located in Alcalá de Henares meet the necessary security measures to ensure compliance with PCI SSC requirements, thus helping to strengthen and support the trust placed in them by their customers and card-issuing entities. IoT Devices Within Everyone's Reach, Even Bad Actors Hector Berrocal, from the audit department, explains the danger that poor configurations in our hyperconnected devices can pose in a world where we are increasingly connected to physical devices and electronic systems. Playing with Bettercap (Man in the Middle) A Man in the Middle attack occurs when an attacker can intercept or manipulate traffic between two parties known as the victim and the recipient. In the following article, Héctor Berrocal, from the audit department, explains how to use Bettercap, a versatile tool that can be used to perform many modern network attacks, such as MitM attacks. ISO 27701 is the standard that specifies and provides guidance for implementing an Information Privacy Management System as an extension of Information Security Management Systems established in the ISO 27001 standard. In the following article, Jose Antonio Prieto, from the consulting department, describes the requirements needed to adapt implemented Information Security Management Systems into an Information Privacy Management System, thereby meeting the requirements of REGULATION (EU) 2016/679, better known as the General Data Protection Regulation. |
|||
 Incident Analysis
|
||||
|
Scammers Placed Fake QR Codes on Parking Meters to Steal Payment Data
Last January, fraud attempts using QR codes were reported in several Texas cities, including Austin, Houston, and San Antonio. Apparently, scammers placed stickers with fake QR codes on parking meters that directed users to a fake payment platform domain to steal financial data. More information at the following link: |
||||
|
"Small Portion" of Customer Data Accessed Without Authorization in a Security Breach at a Hong Kong Online Shopping Platform
Hong Kong Technology Venture Company Limited (HKTV) reported detecting "abnormal and suspicious activities" in its computer systems on January 26, after servers located in other Asian regions gained unauthorized access to customer information on its distribution platform. HKTV reported that a small portion of the information of 4.38 million customers registered on HKTVmall was accessed. More information at the following link: |
||||
|
PulseTV Reveals Possible Compromise of 200,000 Credit Cards
The American online store PulseTV has revealed a large-scale compromise of customer credit cards. According to the notification letter shared with the Maine Attorney General's Office, more than 200,000 shoppers have been affected. The platform learned of a possible breach through VISA on March 8, 2021, which informed them that unauthorized transactions were being made with credit cards on the site. The information that may have been compromised includes the following: Full Name, Shipping Address, Email Address, Payment Card Number, Payment Card Expiration Date, Payment Card Security Code (CVV). More information at the following link: |
||||
 Trends
|
||||
|
The mobile wallet and the rise of the Super App
The mobile wallet sector has made significant strides over the past decade, changing the way people manage and spend their money, and the tasks these wallets can perform have expanded rapidly. Today, mobile wallets are essentially a way to organize existing financial accounts. So-called “Super Apps” provide a connected ecosystem in which users can manage payments, savings, investments, cryptocurrencies, budgets, loans, insurance, and much more, all in one place. User experience, key in e-mobility Visa calls on the industry to promote the standardization of payments at electric vehicle charging points so that users can choose their preferred payment method. The transition to electric vehicles depends on a simple and effective infrastructure that supports and facilitates this development. To date, users consider charging electric vehicles complex, as there are no standards that promote the homogenization of the sector and offer a satisfactory experience. New Xenomorph Android malware targets customers of 56 banks A new malware called Xenomorph, distributed through the Google Play Store, has infected more than 50,000 Android devices to steal banking information. Although still under development, this malware targets users of dozens of financial institutions in Spain, Portugal, Italy, and Belgium. Banking Trojans like Xenomorph aim to steal sensitive financial information, take over accounts, and perform unauthorized transactions, and operators then sell the stolen data to interested buyers. Trickbot abuses major brands such as Bank of America and Wells Fargo in attacks against customers Trickbot was known as a relatively simple banking Trojan alongside others such as Zeus, Agent Tesla, Dridex, and DanaBot. On February 16, Check Point Research (CPR) published a new study on Trickbot, noting that the malware is being used in targeted attacks against customers of 60 "high-profile" organizations, many of which are located in the United States. Hackers use video player to steal credit cards from over 100 sites Hackers used a cloud-based video hosting service to carry out a chain attack on more than a hundred real estate sites, injecting malicious scripts to steal information entered into the website forms. These scripts, known as “skimmers,” are usually injected into hacked websites to steal sensitive information entered into forms. “Skimmers” are commonly used on online store checkout pages to steal payment information. Open Banking users in the United Kingdom pass the 5 million milestone There are currently more than 5 million active users of open banking services in the United Kingdom. This major milestone comes after the celebration in January of the fourth anniversary of PSD2, which makes open banking a regulatory requirement in the United Kingdom. |
||||
| Internet Security Auditors C. Santander, 101. Edificio A, 2º. E-08030 Barcelona (Spain) | Tel.: +34 93 305 13 18 C. Arequipa, 1. E-28043 Madrid (Spain) | Tel.: +34 91 763 40 47 Carrera 13 # 90-17. 110221 Bogotá (Colombia) | Tel.: +57 601 638 68 88 |
||||
     
|
||||
|
This message has been sent by virtue of your authorization to receive commercial information from Internet Security Auditors. You can view our Data Privacy Policy here. You have the option to exercise the rights of access, rectification, erasure, restriction, objection, and portability provided for in the “Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC” by sending a letter addressed to Internet Security Auditors, Calle Santander, 101. Edificio A-2 08030 Barcelona (Spain), or by email to the following address: legal@isecauditors.com, attaching your request with a copy of your ID card or equivalent document proving your identity. If you only wish to unsubscribe from these communications, click the following link and send that email from the email address where you received our communication: marketing@isecauditors.com This email is sent according to your previous authorization for sending commercial information from Internet Security Auditors. You can read our Data Privacy Policy here. You have the possibility at all times to exercise the rights of access, rectification, erasure, restriction of processing, objection, and portability according to the “Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC” by sending a letter addressed to Internet Security Auditors, Calle Santander, 101. Edificio A-2. 08030 Barcelona (Spain), or through the following email: legal@isecauditors.com, attaching your request with a copy of your ID card or equivalent document proving your identity. If you only wish to request the cancellation of these communications, click on the following link and send that email from the email address where you received our communication: marketing@isecauditors.com |
||||
Newsletter