Mobile Payment Industry News: 08/11/09

Tuesday, August 11, 2009

RBS WorldPay to Offer VeriShield Protect

VIEW THE DEMO

Whitepapers:

Understanding End to End Encryption

Protecting Cardholder Data: The Elusive Goal

Interactive:

All-New Mini Site

RBS WorldPay to offer VeriFone's end-to-end encryption solution

San Jose, Calif., Aug. 11, 2009--VeriFone Holdings, Inc. (NYSE: PAY) today announced that RBS WorldPay, the fastest growing top ten payment processor in the US, has agreed to work jointly and expeditiously towards marketing VeriFone's VeriShield Protect end-to-end solution for encrypting payment card data.

RBS WorldPay is the first merchant acquirer to endorse a commercial end-to-end encryption solution. By encrypting the card number on swipe, right at the point of sale, RBS WorldPay merchants who choose the VeriShield Protect solution will be able to dramatically reduce both their own risk and that of their customers as well.

"RBS WorldPay merchants and prospects are telling us they want to significantly reduce the impact of PCI compliance on their business - and they want a solution their processor endorses," said Ian Stuttard, president and CEO of RBS WorldPay. "VeriShield Protect will easily integrate into multi-lane retailers' existing systems and networks."

VeriFone's VeriShield Protect eliminates usable cardholder data from the merchant's POS applications, networks and servers, using AES-level encryption that preserves existing card track data formats so it works transparently with retailers' existing payment infrastructure.

"RBS WorldPay is taking a leadership position in addressing merchant concerns with potential liability over data breaches and the complexity of complying with card issuer requirements," said Douglas Bergeron, VeriFone, CEO. "Using VeriShield Protect's true hardware-fortified end-to-end encryption, usable card data can be removed from the merchant environment, eliminating the leading source of compromise."

With end-to-end encryption, even in the event of a breach of the retailer's system, any stolen data would be unusable. Because VeriShield Protect preserves the format of the card data there is no need to redesign the POS applications to deal with a new data format. In addition to encrypting card data, VeriShield Protect monitors all systems in real time at the device level via VeriShield Secure Device Management Service (VSDMS), so if a breach occurred the retailer would be immediately alerted. In addition, data encryption keys can be managed remotely as part of the device management service.

About RBS WorldPay, Inc.

RBS WorldPay, Inc. is a leading, single-source provider of electronic payment processing services - including credit, debit, EBT, checks, gift cards, e-commerce, customer loyalty cards, fleet cards, ATM processing and cash management services.

RBS WorldPay is the US-based payment processing division of the Royal Bank of Scotland Group plc. For more information, please visit www.RBSWorldPay.us .

About The Royal Bank of Scotland Group (RBS)

The RBS Group is a financial services company providing a range of retail and corporate banking, financial markets, consumer finance, insurance, and wealth management services. The RBS Group operates in the Americas, Asia and the Middle East serving more than 40 million customers. For more information, please visit www.RBS.com .

About VeriFone Holdings, Inc. (www.verifone.com )

VeriFone Holdings, Inc. ("VeriFone") (NYSE:PAY) is the global leader in secure electronic payment solutions. VeriFone provides expertise, solutions and services that add value to the point of sale with merchant-operated, consumer-facing and self-service payment systems for the financial, retail, hospitality, petroleum, government and healthcare vertical markets. VeriFone solutions are designed to meet the needs of merchants, processors and acquirers in developed and emerging economies worldwide.

Source: Company press release.

RBS WorldPay to Offer VeriShield Protect

VIEW THE DEMO

Whitepapers:

Understanding End to End Encryption
Protecting Cardholder Data: The Elusive Goal

Interactive:

All-New Mini Site

First Data Renews PNC Processing Agreement

First Data renews PNC processing agreement

Denver, August 11, 2009--Global technology and payments processing leader First Data today announced that The PNC Financial Services Group (NYSE: PNC) has renewed and expanded its agreement for transaction processing services. Under the agreement, First Data will provide signature debit, PIN debit and ATM processing services, ATM terminal driving, credit card, small business and home equity loan processing, fraud and collections services, remittance processing, prepaid processing as well as plastic, statement and letter production services.

PNC will transfer some credit card processing not currently with First Data as well as adding PIN debit and ATM processing it had gained through its acquisition of National City Corp. PNC acquired National City on Dec. 31, 2008.

First Data has provided transaction processing services to PNC since 1992 and services more than 15 million total accounts on file for PNC. Financial terms of the agreement are not being disclosed.

About PNC

The PNC Financial Services Group, Inc. (www.pnc.com ) is one of the nation's largest diversified financial services organizations providing retail and business banking; residential mortgage banking; specialized services for corporations and government entities, including corporate banking, real estate finance and asset-based lending; wealth management; asset management and global fund services.

About First Data

First Data powers the global economy by making it easy, fast and secure for people and businesses to buy goods and services using virtually any form of electronic payment. Whether the choice of payment is a gift card, a credit or debit card or a check, First Data securely processes the transaction and harnesses the power of the data to deliver intelligence and insight for millions of merchant locations and thousands of card issuers in 36 countries. For more information, visit www.firstdata.com .

Source: Company press release.

First Data Renews PNC Processing Agreement

Ukash Available in Poland

Ukash virtual cash extends to Poland with epay

Poland, August 10, 2009--As Ukash, the online payment specialist, continues in its quest to make online shopping available to everybody, anywhere in the world, the company has signed a significant global deal with epay, a Division of Euronet Worldwide, Inc. – a leading provider of payment services and technology – to extend the availability of its e-cash vouchers to epay retailers across Poland.

The Ukash partnership with epay enables Ukash to expand into 6,000 epay locations across Poland, and the deal offers all internet users the opportunity to pay, play and shop online using cash without having to pay for a prepaid card.

With the growth of the e-commerce market in Poland – one that is dominated by payment methods of cash on delivery and bank transfers – the Ukash deal with epay allows online merchants to tap into the large base of consumers preferring to use cash as a safer method for online purchases.

Unlike some other financial products in Poland, Ukash vouchers do not attract a service or convenience fee. Consumers simply exchange their cash for a unique 19-digit code to use online. This provides them with a secure payment system where they don’t need to reveal any financial information, enabling those without access to credit or debit cards that can be used online – or those with fears of online fraud – to enjoy online shopping.

Mark Chirnside, chief executive officer Ukash, explained, “Given that a significant number of banked customers in Poland cannot use their cards online – as many cards are not accepted on the internet – this country is a key growth market for Ukash and we are pleased to be able to extend the availability of our product to physical points of purchase. By partnering with epay we are able to reach a huge number of potential new customers and expand our global footprint to allow more consumers in Poland to pay, play and shop online using cash.”

“This deal also opens the virtual door for many online retailers as they can now offer alternative payment methods and attract the cash consumer, as well as eliminate any risk of online fraud.”

“epay is pleased to be able to partner with Ukash in Poland, thereby combining the strengths of both businesses to offer consumers more convenient locations to obtain Ukash vouchers – a safe and alternative method of online payment,“ said Piotr Adamek, Country Manager, epay Poland. “Utilising our Polish cash collection network, we can deliver a value-added service to Ukash customers, further extending our payment service and technology offering.”

From today, Ukash vouchers will be available at 6,000 physical point of sale terminals operated by epay at independent supermarkets, petrol stations, call shops, drug stories and convenience stores in Poland. The vouchers will be available in PLN 20, 25, 100, 200, 500, 750 and can be combined, split and/or converted.

Ukash is undergoing a period of rapid global growth and in the last few months has expanded its offer in Germany, Australia and Spain with epay. This deal is expected to lead to further new countries being added in the coming months.

About Ukash®

Ukash® is a globally-recognised e-commerce payment method to enable online purchases using cash, providing freedom from credit and debit card fraud, repudiations and charge-backs, and protecting personal identity. Ukash® is regulated by the UK Financial Services Authority (FSA) and operates as one of the only a small number of Electronic Money Institutions, a status that allows a single maximum online cash payment transaction of up to £500/€750. Uniquely numbered Ukash® vouchers are widely available through payment terminals in retail outlets across Europe and South Africa. And from spring 2009, Ukash vouchers will also be issued online from the company’s website in most European territories. The technology behind Ukash is protected by several patents registered across the Smart Voucher database and functionality and is, as such, protected by Patent Law in all the major economies of the world. Ukash® is a registered trademark of Smart Voucher Ltd. In 2008, Ukash® established a strategic partnership with South African payments giant Blue Label Telecoms to develop the brand’s services. For more information please visit www.ukash.com

About epay

epay, a Division of Euronet Worldwide, Inc. (NASDAQ: EEFT), is a global business with a retail network of approximately 227,000 locations across a number of international markets including the UK, Germany, Spain, Italy, Australia, New Zealand, USA, Poland, Romania, Austria, Switzerland and Ireland. epay enables service providers to deliver electronic payment products and services to consumers through an extensive worldwide retail network. epay’s proprietary payment technology is backed by a cash collection service that manages the payment of funds back to the service providers and a range of marketing solutions to assist both the retailer and service provider to maximise their sales opportunities. In 2008 epay processed over 700 million payment transactions with a total face value of $11 billion. epay’s product portfolio includes top-up or recharge services for prepaid mobile airtime, prepaid debit cards and e-wallets; payment services for bills, road tolls and money transfer; and marketing and distribution services for gift cards, digital content and transport tickets. epay’s commitment to customers is supported by a strong roadmap of innovative new epayment products to bring to market. epay’s corporate headquarters is located in London, United Kingdom. For more information please visit www.epayworldwide.com or contact Angela Wong, Global Marketing Manager on awong@epayworldwide.com or +44 (0) 7787 225 164.

Source: Company press release.

Ukash Available in Poland

Electronic B2B Payments Study

Report on the benefits of electronic B2B payments

Boston, August 11, 2009--With current economic conditions forcing enterprises to focus on cost containment, top-performing organizations are driving efficiencies within the final phase of the accounts payable process to unveil a wealth of cost and time benefits, according to a new research study published by Aberdeen Group, a Harte-Hanks Company (NYSE: HHS).

The E-Payables: Electronic Payments research report, which examined the strategies, intentions, and performance of over 140 enterprises, found that nearly 70% of enterprises place a critical / high-priority level on improving overall payment processes and procedures, a figure that reinforces the notion that overall financial success within the enterprise rests on the operational shoulders of the accounts payable department.

"Top-performing enterprises realize the value in automating the final phase of the A/P process," said Christopher Dwyer, research analyst and author of the study, Aberdeen. "By leveraging electronic payment methods, such as ACH, commercial cards and wire transfer, they have significantly cut payment-processing costs in addition to reducing the risk of payment fraud."

In addition to driving payment-processing costs that are nearly 14.6-times lower than all other organizations, leading enterprises utilized a core set of A/P capabilities and technologies to achieve superior performance. These organizations are:

53% more likely to have electronic payments requirements established
as a standard means of conducting business with key suppliers

43% more likely to integrate payment solutions with existing A/P
systems

42% more likely to have standardized payment processes

A complimentary copy of this report is made available due in part by the following underwriters: SunGard, SunTrust, and Visa. To obtain a complimentary copy of the report, visit: http://www.aberdeen.com/link/sponsor.asp?cid=5984 .

For additional access to complimentary Global Supply Management Research, please visit http://research.aberdeen.com/index.php/-global-supply-management

About Aberdeen Group, a Harte-Hanks Company

Aberdeen provides fact-based research and market intelligence that delivers demonstrable results. Having queried more than 30,000 companies in the past two years, Aberdeen is positioned to educate users to action: driving market awareness, creating demand, enabling sales, and delivering meaningful return-on-investment analysis. As the trusted advisor to the global technology markets, corporations turn to Aberdeen for insights that drive decisions.

As a Harte-Hanks Company, Aberdeen plays a key role of putting content in context for the global direct and targeted marketing company. Aberdeen's analytical and independent view of the "customer optimization" process of Harte-Hanks (Information - Opportunity - Insight - Engagement - Interaction) extends the client value and accentuates the strategic role Harte-Hanks brings to the market. For additional information, visit Aberdeen or call (617) 854-5200, or to learn more about Harte-Hanks, call (800) 456-9748.

Source: Company press release.

Electronic B2B Payments Study

53% more likely to have electronic payments requirements established as a standard means of conducting business with key suppliers
43% more likely to integrate payment solutions with existing A/P systems
42% more likely to have standardized payment processes

Payment Data: Don't Store It, Don't Handle It

CyberSource is holding a webinar entitled Payment Data: Don't Store It, Don't Handle It.   It's the best way to remove yourself from the scope of PCI Compliance. Simply remove yourself from all contact with payment data. It the way HomeATM designed it's eCommerce platform.

Our PCI 2.x Certified PIN Entry Device encrypts the data instantaneously, and simply utilizes the "internet" as the conduit with with to send the encrypted packet.   Since the data is never in the clear, a web merchant would be in the clear when it comes to PCI Compliance. It's easy to protect your business from potential breaches with HomeATM's secure 3DES DUKPT end-to-end encryption. And you'll save money on processing costs with True PIN Debit.

Maintaining payment security doesn’t require adding even more proverbial locks and bolts to your infrastructure. In fact, you can secure your payment process – including complying with PCI-DSS standards - with less cost, complexity, and time.   In the upcoming CyberSource webinar Payment Data: Don’t Store It, Don’t Handle It, you’ll see how your peers are adopting a safer, more secure approach by eliminating all contact with payment data – a strategy we call Enterprise Payment Security 2.0.

Payment Data: Don't Store It, Don't Handle It

Shift Happens...Debit Rewards up 45%...Credit Down 67%

CardTrak.com

During
a recession... shift happens. New research shows membership in credit
card rewards programs is decreasing significantly while debit card
rewards programs are gaining popularity.

Also, most consumers are not
willing to pay a higher interest rate for rewards and those that do are
only willing to pay slightly more.

The study by First Data Competitive
Intelligence found that the number of cardholders holding a rewards
credit card declined from 71% in 2008 to 67% this year, while the
number of cardholders holding a rewards debit card jumped from 34% last
year to 45% this year.

Continue Reading

Shift Happens...Debit Rewards up 45%...Credit Down 67%

CardTrak.com

Duringa recession... shift happens. New research shows membership in creditcard rewards programs is decreasing significantly while debit cardrewards programs are gaining popularity.

Also, most consumers are notwilling to pay a higher interest rate for rewards and those that do areonly willing to pay slightly more.

The study by First Data CompetitiveIntelligence found that the number of cardholders holding a rewardscredit card declined from 71% in 2008 to 67% this year, while thenumber of cardholders holding a rewards debit card jumped from 34% lastyear to 45% this year.

Continue Reading

"Hardware Needed for Online Security" Bandwagon Growing

New Portable Smart Card Readers From SCM Microsystems Enhance Online Security


SANTA ANA, Calif. and ISMANING, Germany, Aug. 11 /PRNewswire-FirstCall/ -- SCM Microsystems, Inc. (Nasdaq: SCMM; Prime Standard, SMY), a leading provider of solutions for secure access, secure identity and secure exchange, is expanding its smart card reader product family with three new models that usher in a new era of compact, portable, personal devices. The new handheld, USB or Near Field Communication (NFC) connected readers are designed to be carried - on key rings, in pockets or purses - and used every day with contact or contactless smart cards, regardless of technology or manufacturer. In many instances, users insert the card and leave it in the reader - leaving them with a single small device for all smart card-related needs. Smart cards are being used worldwide to secure identities in many applications, such as bank payment cards, employee access badges, government identity cards and healthcare IDs. SCM's new readers enable cardholders to use their smart cards anytime, anywhere with PCs, the Internet or other terminals. Many models allow physical access to buildings, too. Cardholders can use the reader to pay more securely or to authenticate their network identities with banks, employers, government agencies, or healthcare providers. They can even download discounts or promotion links from NFC smart posters, take them home and load them into a PC. "Our new readers address two important market drivers that are at the core of our strategy, the growth of contactless technology and the convergence of physical access and IT security systems," said Felix Marx, chief executive officer of SCM Microsystems. "Organizations making large scale deployments need to provide their end users with ways to use smart cards for secure physical entry, as well as with PCs and over the Internet at home, at work or at school. We engineered these personal smart card readers to fill that gap. They are compact and ultra-portable, so people can carry them to use with their smart cards wherever they go." The new smart card readers are the SCR3500 SmartFold, the SCT3511 and the @MAXX lite. SCM will make them available in August through both OEM and distribution channels. SCR3500 SmartFold: portable contact smart card reader The SCR3500 SmartFold is a uniquely designed small, portable contact smart card reader that fits easily on a key ring and in every pocket. Since it is easy to carry around, users do not have to wait to come home to make secure online transactions. Online services can be accessed and payments can be made from anywhere, with full protection from password stealing spyware. The reader is unfolded and inserted into a free USB port of a notebook. Then, the smart card in ID-1 (credit card) format is inserted into the reader to enable secure access to bank accounts, online payments, Web services or company information systems. SCT3511: contact and contactless USB token The SCT3511 is a USB token with both contact and ISO 14443 and MIFARE(TM) contactless capabilities. It acts as a contact reader for ID-000 (SIM card format) smart cards, and has an antenna for use with a dual interface contact/contactless smart card that supports an antenna connection. This device is ideal for contactless payment and ticketing applications. Additionally, it is used for converged physical and logical access control in the enterprise. At work, with the smart card inserted, it is used for secure logon to networks or PCs using a PKI digital identity certificates. It can also be used for more secure physical access to the building instead of the usual employee badge. @MAXX lite: contact/contactless USB token with integrated Flash memory @MAXX lite is the newest addition to SCM's innovative @MAXX family of products. Like the SCT3511, @MAXX lite is a token with both contact and contactless smart card-based functionalities. It adds on-board Flash memory for secure storage of sensitive data. With a smart card in PC-connected mode, @MAXX lite encrypts data on a hard disk and the onboard Flash memory, and protects access by requiring a PIN entry. Other uses include contactless payment, ticketing applications, secure logon to PCs and networks with a digital identity certificate, storing encrypted and PIN protected logins and passwords in the smart card or Flash, or filling Web forms using securely stored personal information. About SCM Microsystems, Inc. SCM Microsystems (NASDAQ: SCMM; Prime Standard: SMY) is a global leader in security and identity solutions for secure access, secure identity and secure exchange. Together with its Hirsch Electronics subsidiary, SCM provides complete, integrated solutions that secure digital assets, electronic transactions and facilities. The company offers the world's broadest range of contact, contactless and mobile smart card reader technology; physical and logical access control systems; digital identity transaction platforms; biometrics; and digital video. SCM's solutions enable a wide variety of applications including enterprise security, identity management, contactless payment, e-health and electronic government services. For more information please go to www.scmmicro.com and www.HirschElectronics.com. Note: MIFARE is a trademark of NXP Semiconductors. All other trademarks are the property of their respective owners.

SOURCE SCM Microsystems, Inc.

"Hardware Needed for Online Security" Bandwagon Growing

New Portable Smart Card Readers From SCM Microsystems Enhance Online Security


SANTA ANA, Calif. and ISMANING, Germany, Aug. 11 /PRNewswire-FirstCall/ -- SCM Microsystems, Inc. (Nasdaq: SCMM;Prime Standard, SMY), a leading provider of solutions for secureaccess, secure identity and secure exchange, is expanding its smartcard reader product family with three new models that usher in a newera of compact, portable, personal devices. The new handheld, USB orNear Field Communication (NFC) connected readers are designed to becarried - on key rings, in pockets or purses - and used every day withcontact or contactless smart cards, regardless of technology ormanufacturer. In many instances, users insert the card and leave it inthe reader - leaving them with a single small device for all smartcard-related needs. Smart cards are being used worldwide to secure identitiesin many applications, such as bank payment cards, employee accessbadges, government identity cards and healthcare IDs. SCM's new readersenable cardholders to use their smart cards anytime, anywhere with PCs,the Internet or other terminals. Many models allow physical access tobuildings, too. Cardholders can use the reader to pay more securely orto authenticate their network identities with banks, employers,government agencies, or healthcare providers. They can even downloaddiscounts or promotion links from NFC smart posters, take them home andload them into a PC. "Our new readers address two important market driversthat are at the core of our strategy, the growth of contactlesstechnology and the convergence of physical access and IT securitysystems," said Felix Marx, chief executive officer of SCM Microsystems."Organizations making large scale deployments need to provide their endusers with ways to use smart cards for secure physical entry, as wellas with PCs and over the Internet at home, at work or at school. Weengineered these personal smart card readers to fill that gap. They arecompact and ultra-portable, so people can carry them to use with theirsmart cards wherever they go." The new smart card readers are the SCR3500 SmartFold, the SCT3511 and the @MAXX lite. SCM will make them available in August through both OEM and distribution channels. SCR3500 SmartFold: portable contact smart card reader The SCR3500 SmartFold is a uniquely designed small, portablecontact smart card reader that fits easily on a key ring and in everypocket. Since it is easy to carry around, users do not have to wait tocome home to make secure online transactions. Online services can beaccessed and payments can be made from anywhere, with full protectionfrom password stealing spyware. The reader is unfolded and insertedinto a free USB port of a notebook. Then, the smart card in ID-1(credit card) format is inserted into the reader to enable secureaccess to bank accounts, online payments, Web services or companyinformation systems. SCT3511: contact and contactless USB token The SCT3511 is a USB token with both contact and ISO 14443and MIFARE(TM) contactless capabilities. It acts as a contact readerfor ID-000 (SIM card format) smart cards, and has an antenna for usewith a dual interface contact/contactless smart card that supports anantenna connection. This device is ideal for contactless payment andticketing applications. Additionally, it is used for converged physicaland logical access control in the enterprise. At work, with the smartcard inserted, it is used for secure logon to networks or PCs using aPKI digital identity certificates. It can also be used for more securephysical access to the building instead of the usual employee badge. @MAXX lite: contact/contactless USB token with integrated Flash memory @MAXX lite is the newest addition to SCM's innovative @MAXX family of products. Like the SCT3511, @MAXX lite isa token with both contact and contactless smart card-basedfunctionalities. It adds on-board Flash memory for secure storage ofsensitive data. With a smart card in PC-connected mode, @MAXX lite encryptsdata on a hard disk and the onboard Flash memory, and protects accessby requiring a PIN entry. Other uses include contactless payment,ticketing applications, secure logon to PCs and networks with a digitalidentity certificate, storing encrypted and PIN protected logins andpasswords in the smart card or Flash, or filling Web forms usingsecurely stored personal information. About SCM Microsystems, Inc. SCM Microsystems (NASDAQ: SCMM;Prime Standard: SMY) is a global leader in security and identitysolutions for secure access, secure identity and secure exchange.Together with its Hirsch Electronics subsidiary, SCM provides complete,integrated solutions that secure digital assets, electronictransactions and facilities. The company offers the world's broadestrange of contact, contactless and mobile smart card reader technology;physical and logical access control systems; digital identitytransaction platforms; biometrics; and digital video. SCM's solutionsenable a wide variety of applications including enterprise security,identity management, contactless payment, e-health and electronicgovernment services. For more information please go to www.scmmicro.comand www.HirschElectronics.com. Note: MIFARE is a trademark of NXP Semiconductors. All other trademarks are the property of their respective owners.

SOURCE SCM Microsystems, Inc.

PayPal's Student Accounts Program

Back to School with the Walking ATM
Posted by: Alexandria Sage

Parents — ever feel like a walking ATM? Want to teach your kids about responsible financial management (and get them to stop pestering you for their allowance every week in the bargain?) Check out PayPal’s new program for students, launching today, in which a sub-account for your child is linked to your own PayPal account.

"Parents can transfer money to their kids’ accounts in “allowance mode”
or “on-demand.” Requests for money from kids can be sent by text on
cellphones and transfers are automatic performed once mom or dad
approves."

The program, Student Account, is designed to balance convenience for parents and their kids with financial responsibility, said Don Fotsch, vice president of customer experience and design at PayPal. It’s also a push by the fast-growing online payments company, which is eBay Inc’s growth engine, to expand in new directions. The program addresses a “clearly underserved” market of the estimated 17 million students headed to college in the United States this year, Fotsch said.

PayPal's Student Accounts Program

Back to School with the Walking ATM
Posted by: Alexandria Sage

Parents — ever feel like a walking ATM? Want to teach your kids about responsible financial management (and get them to stop pestering you for their allowance every week in the bargain?) Check out PayPal’s new program for students, launching today, in which a sub-account for your child is linked to your own PayPal account.

"Parents can transfer money to their kids’ accounts in “allowance mode”or “on-demand.” Requests for money from kids can be sent by text oncellphones and transfers are automatic performed once mom or dadapproves."

Microsoft: Attackers Can Steal Card Numbers from HTTPS Servers...

HomeATM isn't the only company telling you that Https = HttBS. Even Microsoft says so. And it's ALL browsers that are weak. That's why HomeATM and the PIN Payments Blog has spent such an inordinate amount of time trying to get across our point that no website is safe and that transactions MUST be done OUTSIDE the browser space.

In what would provide the perfect segue for yet another dissertation on the "Don't Type" vs. "Swipe" mantra, I bring you this from Microsoft's research department...

Security researchers at Microsoft have found a way to break the end-to-end security guarantees of HTTPS without breaking any cryptographic scheme.

During a research project "Pretty-Bad-Proxy: An Overlooked Adversary in Browsers’ HTTPS Deployments(.pdf) concluded earlier this year, the Microsoft Research team discovered a set of vulnerabilities exploitable by a malicious proxy targeting browsers’ rendering modules above the HTTP/HTTPS layer.

Here’s the gist of the problem, as explained by the research team:

In many realistic network environments where attackers can sniff the browser traffic, they can steal sensitive data from an HTTPS server, fake an HTTPS page and impersonate an authenticated user to access an HTTPS server. These vulnerabilities reflect the neglects in the design of modern browsers — they affect all major browsers and a large number of websites.

According to a SecurityFocus advisory, attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how sites are rendered to the user. Other attacks are also possible.

Affected browsers include Microsoft’s Internet Explorer 8, Mozilla Firefox, Google Chrome, Apple Safari and Opera.

Originally, it was believed that this issue only affected Mozilla’s browsers but the advisory was update to reflect that the issue affects multiple browsers, not just Mozilla products.

Microsoft: Attackers Can Steal Card Numbers from HTTPS Servers...

In many realistic network environments where attackers can sniff the browser traffic, they can steal sensitive data from an HTTPS server, fake an HTTPS page and impersonate an authenticated user to access an HTTPS server. These vulnerabilities reflect the neglects in the design of modern browsers — they affect all major browsers and a large number of websites.

According to a SecurityFocus advisory, attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how sites are rendered to the user. Other attacks are also possible.

Affected browsers include Microsoft’s Internet Explorer 8, Mozilla Firefox, Google Chrome, Apple Safari and Opera.

Originally, it was believed that this issue only affected Mozilla’s browsers but the advisory was update to reflect that the issue affects multiple browsers, not just Mozilla products.

US Banks Earn $38.5 Billion on Overdraft Charges

Financial Times:

US banks stand to collect a record $38.5 billion in fees for customer overdrafts this year, with the bulk of the revenue coming from the most financially stretched consumers amid the deepest recession since the 1930s, according to research. The fees are nearly double those reported in 2000.

The finding is likely to increase public hostility towards the financial sector, which has been under political pressure to ease the burden on consumers by increasing credit availability and lending more fairly after being bailed out by taxpayers.

Editor's Note: What would create even more hostility would be if consumers understood how banks actually set them up for these overdraft charges.

Assume a "financially stretched" consumer has $140.00 in their bank account. They go to the gas pump, swipe their debit card and because the total amount of the purchase has yet to be determined, the bank puts a $150 hold on their account in return for the authorization. But the "financially stretched" consumer don't have $150, they have $140...so there's $35 overdraft charge #1 right there. Now, they pump $25 worth of gas, but are already "in the hole" because of the $150 "hold", so chalk up another $35.00.

Now they make several purchases over the next 24-48 hours (the hold could last up to 72 hours) and each of those purchases comes with a $35 overdraft charge. Yes, even the .99 Whopper Jr. costs $35.99! Next thing you know, banks start earning $38.5 Billion dollars annually!

Solution? Use your PIN Debit card instead of your Signature Debit card. PIN Debit is real-time. Therefore a transaction that would result in an $35 overdraft charge would "declined." Still wonder why the "less secure" signature debit is being pushed over PIN debit?
I can give you 38.5 billion reasons!

Read the whole story: Financial Times

Tuesday, August 11, 2009

Disqus for ePayment News