In the ever-advancing technological world that we live in, security is always a factor. Sending money or payment information over the internet is the modern-day equivalent of a merchant traveling down the silk road in olden times. Back then they had highwaymen and robbers, today we have hackers. These malicious thieves benefit from you when your security is lacking.

 

Credits and Thanks

+++First and foremost, I would like to note that a lot of this information comes from the wonderful people at the RSA Conference. These juggernauts of the security world devote their lives to learning as much as they can about cyber security and informing everyone on how to keep each other safe. Now without further ado, let’s get to it.

What are the leading causes of Point of Sale Security Breaches?

+++Many things can be the cause of a Point of Sale security breach. We’ll start off with the non-technical ones, and then slowly get more advanced.

Vendor Negligence

+++Yes, you heard me right. The biggest cause of Point of Sale security breaches is vendor negligence.

Poor Practices / Bad Habits

+++Poor Practices and bad habits are one of the leading causes of point of sale security breaches. However this isn’t a difficult fix. Your practices and habits might need some checking if it’s been a long time since you’ve:

• Changed your Administrator password
• Using a default Administrator password
• Run a Malware / Virus / Spyware scan on your point of sale
• Even had an Administrator password
• Changed your remote access password

 

Scan type: Quick scan
Objects scanned: 191441
Time elapsed: 12 minute(s), 40 second(s)
Files Detected: 2
C:\WINDOWS\system32\Searcher.dll
(Trojan.Clicker) -> Quarantined and
deleted successfully.
C:\WINDOWS\system32\QOS.dll (Trojan.Agent)
-> Quarantined and deleted successfully.
– System Virus Scan

 

Poor Policy / Origin of Malware

+++As a vendor, it is your responsibility to know what your employees are doing. You should lock down your internet browser to prevent employees from going to unauthorized sites. In a case study presented at the RSA, they found that some of the leading causes for point of sale security malware infections were acquired from:

• Browsing pornographic websites
• Downloading torrents
• Video chatting
• Playing online games
• Visiting social media sites and clicking links shared on them

+++Remember to monitor your browser history and make sure your employees are doing what they are supposed too.

Physical Security

+++Physical security, or lack thereof, is another major cause of point of sale security breaches. Ask yourself the following questions:

• Is your equipment easily accessible?
• Are your locks high quality? Do you just use zip ties?
• Are your network cables exposed?
• Are your ports exposed? (Ethernet, USB, etc.)

 

– This is not secure

+++If you answered yes to any of those questions, you are at risk.

Internal Attacks

+++Internal attacks are another huge cause of point of sale security breaches. Malicious employees, or people with connections, can install what is known as a ‘skimmer’ into a credit card processing terminal or MSR. Make sure you regularly check your magnetic stripe readers and credit card terminals to ensure you don’t see anything that looks like this:

+++If any of your terminals look like those pictured above, contact your credit card processor IMMEDIATELY.

External Attacks

+++External attacks are caused by malware trying to guess your passwords, and then installing themselves on your system. You can prevent many of these attacks by simply choosing a secure administrator password, changing it often, and scanning for malware, viruses, or spyware. These types of malware typically perform the following functions:

• Command and control features of your Point of Sale
• Scan your computer for credit card / payment information
• Automatically upload the data they steal
• Keylog, or record every keystroke
• Update themselves and hide deeper in your system

 

-A credit card number is found in an unsecured point of sale system

 

Poor Hardware Security / Design

+++Many point of sale systems and credit card terminals do not take into account security nearly as severely as they should. In fact, one major hardware vendor was found to be using the same default password for 90% of their products, and they have been doing this since 1990. You might want to contact your point of sale company if your hardware does any of the following things:

• Automatically logs in when you turn it on
• Runs on an administrator account
• Uses an un-encrypted hard drive.

+++If your hardware does these things, contact your point of sale company immediately.

Poor Point of Sale Security or Insecure Programming / Design

+++The hardware security and point of sale security are more difficult for you, as a vendor, to control. In fact one of the only ways for you to control it is for you to pick a secure point of sale. You should contact your point of sale supplier and verify that they do the following things, otherwise you might not be secure:

• Utilize asymmetric keys for data transmission (meaning a different key for encryption and decryption)
• Run your point of sale on a non-administrator account
• Encrypt all stored data
• Send out on-site technicians to do updates or changes (remote access is not secure)
• Do not store payment data locally (on your machine)
• End-to-end encrypt all data, not end-to-end-to-end
• Use tokenization to protect transactions and sensitive information
• Send information over the network on plain text (un-encrypted)
• Change default pin pad configurations

+++If your point of sale system doesn’t perform one or more of the above actions, you are at risk.

Conclusion

+++I hope that this article has in some way helped you, or made you more informed, or kept you safe. If you like what you read, feel free to contact our agents, and you can always contact me personally at raymond@posoncloud.com if you have any questions. We would love to hear from you, and as always our agents are standing by.

With regard,
Raymond Tri