The payment terminals known as PIN pads are putting hundreds of millions of consumers worldwide at risk everyday a UK IT security company is warning.
The terminals, which are used by retailers, handled more than 852-million card payments in the UK alone in April 2012 according to the UK Cards Association.
Researchers at MWR InfoSecurity have found that the terminals are not secure and codes can be introduced by malicious smartcards that will then allow criminals to have access not only to a customer’s PIN and PAN (Primary Account Number shown on the front of a plastic card) numbers but also gain access to the merchant’s network.
“Our research shows security of PIN Pads is below that which consumers should expect for transactions of this nature. The security employed in the software is not up to the job for such sensitive transactions, leaving the devices open to many forms of attack,” says Ian Shaw, MD of MWR InfoSecurity.
“As a result of this, a sophisticated attacker may be able to compromise these terminals to the extent that it would be very difficult to identify if they had been breached.
“Our investigations have shown that the range of vulnerabilities found in these devices, now part of the everyday shopping experience, could compromise consumers’ card details and PIN numbers. It may also leave merchants unprotected and cause serious disruption to their businesses, potentially exposing both of them to serious fraud,” he adds.
For example, a customer at a restaurant could pretend to be making a payment with a “Trojan card” but instead has gained access to the payment terminal. From that point onwards, all pin numbers and other card holder information that passes through that terminal can be gathered by the criminal. They can then take advantage of a number of existing communication channels, such as Internet connection –Wireless, Bluetooth, mobile networks– or phone lines to retrieve that information. Alternatively, the criminal could return and insert again the malicious smartcard to collect the recorded data from the payment device.
“Generally, efforts are being directed to securing the PIN Pads physically but the software installed in the terminals remains highly vulnerable. Even the typical consumer smartphone deploys more security features than the technology used in these devices,” says Shaw.