A vulnerability in the way that Visa cards work with Apple Pay Express Transit mode “could enable hackers to bypass an iPhone’s Apple Pay lock screen and perform contactless payments”, researchers at the University of Birmingham and the University of Surrey have found... More
A new white paper that looks in-depth at Trusted Execution Environment (TEE) technology, the architecture and principles underpinning its operation and how it can be used to secure a variety of mobile wallet and IoT applications is now available to download free of charge from the NFC World Knowledge Centre... More
This $150 mask beat Face ID on the iPhone X — The Verge — “Vietnamese cybersecurity firm Bkav claims it’s been able to bypass the iPhone X’s Face ID feature using a mask… The firm does stress that the product is just a proof of concept at the moment and more research is needed… ‘Exploitation is difficult for normal users, but simple for professional ones,’ Bkav said.”
EMVCo launches EMV secure remote commerce technical framework — EMVCo — “EMV SRC will address the complexities and potential vulnerabilities within the remote payments environment by defining a consistent approach to enable the secure transmission and interaction of payment card data among participants. This helps reduce exposure to data compromise and simplify merchant support of these solutions.”
The White House and Equifax agree: Social security numbers should go — Bloomberg — “The Trump administration is exploring ways to replace the use of Social Security numbers as the main method of assuring people’s identities in the wake of consumer credit agency Equifax Inc’s massive data breach. The administration has called on federal departments and agencies to look into the vulnerabilities of employing the identifier tied to retirement benefits, as well as how to replace the existing system.”
A simple design flaw makes it astoundingly easy to hack Siri and Alexa — Co.Design — “Using a technique called the DolphinAttack, a team from Zhejiang University translated typical vocal commands into ultrasonic frequencies that are too high for the human ear to hear, but perfectly decipherable by the microphones and software powering our always-on voice assistants. This relatively simple translation process lets them take control of gadgets with just a few words uttered in frequencies none of us can hear.”
The Federal Reserve has released details of nine new tactics it plans to employ to improve the US payments system across five key areas — speed, security, efficiency, international payments, and collaboration... More
New bill seeks basic IoT security standards — Krebs on Security — “The bill would require vendors of internet-connected devices purchased by the federal government make sure the devices can be patched when security updates are available; that the devices do not use hard-coded (unchangeable) passwords; and that vendors ensure the devices are free from known vulnerabilities when sold.”
Samsung has responded to the group of hackers from the Chaos Computer Club (CCC) who managed to defeat the iris recognition system on the Samsung Galaxy S8 and S8+ smartphones, saying that the hackers’ claims could “only have been made under a rare combination of circumstances”. More
Apple has released a security update that fixes more than 100 iOS bugs, including a vulnerability in Apple Pay that allowed third parties to see sensitive information as a payment was made... More
A video published by a group of hackers has demonstrated how a stolen Apple Watch could be used by the thief to make payments using Apple Pay without them having to authenticate the transactions in any way — as long as they are quick. More
The first version of the EMV Payment Tokenization Specification has now been published and is available to download... More
Two Italian hackers have told the Defcon convention about a pair of vulnerabilities in some contactless transportation ticketing systems that allow tickets to be altered by an NFC phone to give unlimited free rides... More
Noted security researcher Charlie Miller is to present the findings from his research into NFC P2P and tag reading vulnerabilities at Black Hat 2012 today... More
“To address an issue that could have allowed unauthorized use of an existing prepaid card balance if someone recovered a lost phone without a screen lock, tonight we temporarily disabled provisioning of prepaid cards,” says Google Wallet VP Osama Bedier. More
The latest Google Wallet hack is the first to impact users of stock Android phones and allows anyone who obtains a lost or stolen device which does not have a screen lock set up to gain access to and spend the owner’s prepaid card balance. More
Zvelo engineer Joshua Rubin has released details of a security vulnerability in rooted Android phones running Google Wallet... More