Risky Bulletin: Expired cards can be used for new transactions
Researchers show expired Visa contactless cards can be revived via NFC man-in-the-middle relay to run fraudulent transactions; roundup also covers major breaches.
University of Massachusetts Amherst researchers built an NFC man-in-the-middle rig that updates a card's expiration date in transit and relays the modified payment to POS terminals, reviving expired contactless cards; Visa terminals and the backends of all five banks studied failed to catch the manipulation. The same roundup reports Iranian hackers shut down a small UK power plant for four days, Lazarus breached South Korea's Presidential Office as part of a campaign exceeding 100 victims, and French telecom SFR suffered a breach affecting over 2.1 million customers.
- NFC MITM attack modifies expiration dates on expired cards without breaking the card's digital hash or signature
- Attack succeeded on Visa terminals and evaded backend checks at all five banks studied
- Iranian hackers shut down a small UK power plant for four days
- Lazarus hacked South Korea's Presidential Office in February; broader campaign exceeded 100 victims by April
- SFR breach hit over 2.1 million customers; Apollo Global Management breached via social engineering
- Vendors
- VisaMastercard
- Threat actors
- LazarusShinyHunters
- Countries
- United KingdomSouth KoreaFrance
From the original article
11 min read at news.risky.biz
In other news: Iranian hackers shut down UK power plant; Lazarus hacks South Korea's Presidential Office; Android malware infects cars.
By Catalin Cimpanu · news.risky.biz
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.