Five Sneaky Credit Card Scams

#1 Phone Fraud

The phone rings, a scammer poses as your bank's fraud department. They may have your entire card number stolen from another source.

They ask about a charge made and you deny the charge, but in order for the charge to be removed, they need your 3-4 digits CVV number off the front or back of the card.

A variation may be they only have the last 4 digits found on a receipt or statement you threw away. They can also use the same ruse to get the full 16 digits from you.

#2 Clever Clerk

You hand your card to a sales clerk, waiter or waitress and they have a card reading wedge device that looks like this.

The device may be wrapped around a band on their ankle. They bend over and make it look like they are fixing a sock, once they swipe the card through, they can make charges on your card.

#3 The Loop

You’re at an ATM that isn’t cooperating. Some nice guy injects himself into the scene to help you. During the process he watches you enter your pin.

After another attempt the ATM eats your card. After you leave all upset, he pulls the card from the ATMs card slot using a loop of VHS tape he jammed inside the machine.

#4 Risky Retailer

When searching for something on the web you come across a website with a great deal.

In the process of ordering they inform you a discount is available along with a free trial of another product. Thinking you just made out on the deal you take the bait.

Next thing you know your card is charged every month and the company makes it very difficult to cancel the charges.

#5 Cell Snap

While buying something at a store you swipe your card through the point of sale terminal.

If you are using a debit card you also need to punch your PIN into the keypad. The guy one or two people behind you filmed the entire transaction including your PIN on his mobile phone.

Robert Siciliano personal security expert to Home Security Source discussing Home Invasions on Montel Williams. Disclosures

Note: the views expressed in this post are the opinions of the Infosec Island member that posted this content. Infosec Island is not responsible for the content or messaging of this post. Infosec Island reserves the right to remove or edit the content of all material submitted by our members.

View the original article here

Five Sneaky Credit Card Scams

#1 Phone Fraud

The phone rings, a scammer poses as your bank's fraud department. They may have your entire card number stolen from another source.

They ask about a charge made and you deny the charge, but in order for the charge to be removed, they need your 3-4 digits CVV number off the front or back of the card.

A variation may be they only have the last 4 digits found on a receipt or statement you threw away. They can also use the same ruse to get the full 16 digits from you.

#2 Clever Clerk

You hand your card to a sales clerk, waiter or waitress and they have a card reading wedge device that looks like this.

The device may be wrapped around a band on their ankle. They bend over and make it look like they are fixing a sock, once they swipe the card through, they can make charges on your card.

#3 The Loop

You’re at an ATM that isn’t cooperating. Some nice guy injects himself into the scene to help you. During the process he watches you enter your pin.

After another attempt the ATM eats your card. After you leave all upset, he pulls the card from the ATMs card slot using a loop of VHS tape he jammed inside the machine.

#4 Risky Retailer

When searching for something on the web you come across a website with a great deal.

In the process of ordering they inform you a discount is available along with a free trial of another product. Thinking you just made out on the deal you take the bait.

Next thing you know your card is charged every month and the company makes it very difficult to cancel the charges.

#5 Cell Snap

While buying something at a store you swipe your card through the point of sale terminal.

If you are using a debit card you also need to punch your PIN into the keypad. The guy one or two people behind you filmed the entire transaction including your PIN on his mobile phone.

Robert Siciliano personal security expert to Home Security Source discussing Home Invasions on Montel Williams. Disclosures

Note: the views expressed in this post are the opinions of the Infosec Island member that posted this content. Infosec Island is not responsible for the content or messaging of this post. Infosec Island reserves the right to remove or edit the content of all material submitted by our members.

View the original article here

Microsoft to fix PowerPoint, Forefront vulnerabilities

Microsoft will issue three bulletins next week, repairing 11 vulnerabilities in Office and the Forefront Unified Access Gateway.

In the software giant's Advance Notification released Thursday, Microsoft said one bulletin addressing Office vulnerabilities is rated "critical." The critical bulletin affects Microsoft Office 2007 and 2010.

A bulletin addressing a flaw that could enable an elevation of privileges in the Forefront UAG 2010 is rated "Important." A third update, rated "important" will repair errors in Microsoft PowerPoint that could be exploited remotely by an attacker.

The updates will be issued Tuesday as part of Microsoft's regularly scheduled monthly patching process.

Engineers are still working on a fix for a zero-day vulnerability in Internet Explorer being actively targeted in drive-by attacks. Microsoft issued an advisory on Tuesday warning of a memory allocation error, present in Internet Explorer 6, 7, and 8 could enable an attacker to execute code and gain access to a victim's machine.

View the original article here

Microsoft to fix PowerPoint, Forefront vulnerabilities

Microsoft will issue three bulletins next week, repairing 11 vulnerabilities in Office and the Forefront Unified Access Gateway.

In the software giant's Advance Notification released Thursday, Microsoft said one bulletin addressing Office vulnerabilities is rated "critical." The critical bulletin affects Microsoft Office 2007 and 2010.

A bulletin addressing a flaw that could enable an elevation of privileges in the Forefront UAG 2010 is rated "Important." A third update, rated "important" will repair errors in Microsoft PowerPoint that could be exploited remotely by an attacker.

The updates will be issued Tuesday as part of Microsoft's regularly scheduled monthly patching process.

Engineers are still working on a fix for a zero-day vulnerability in Internet Explorer being actively targeted in drive-by attacks. Microsoft issued an advisory on Tuesday warning of a memory allocation error, present in Internet Explorer 6, 7, and 8 could enable an attacker to execute code and gain access to a victim's machine.

View the original article here

Domino Security Vulnerabilities and How to Maximize Risk

How secure is your Domino environment? Although there are few resources available for Domino security, it is important to protect your systems from threats and minimize risks by identifying weaknesses. In this expert e-guide from SearchDomino.com, learn how to monitor areas that put Domino at risk including, operating system patches and passwords. Find out about Web-centric vulnerabilities and why it is essential to perform manual analysis to ensure optimal security.

View the original article here

Domino Security Vulnerabilities and How to Maximize Risk

How secure is your Domino environment? Although there are few resources available for Domino security, it is important to protect your systems from threats and minimize risks by identifying weaknesses. In this expert e-guide from SearchDomino.com, learn how to monitor areas that put Domino at risk including, operating system patches and passwords. Find out about Web-centric vulnerabilities and why it is essential to perform manual analysis to ensure optimal security.

View the original article here

Bankrate Releases 2010 Gift Card Study

Tags » Gift Cards  » Comments (0)

Bankrate has announced key findings from a new study on gift cards. "Bankrate surveyed 54 gift card issuers to determine fees that come from major gift card providers as well as where consumers can get the most value for their money." The full 2010 Gift Card Study is available here.

View the original article here

Bankrate Releases 2010 Gift Card Study

Tags » Gift Cards  » Comments (0)

Bankrate has announced key findings from a new study on gift cards. "Bankrate surveyed 54 gift card issuers to determine fees that come from major gift card providers as well as where consumers can get the most value for their money." The full 2010 Gift Card Study is available here.

View the original article here

More PCI encryption, tokenization options emerge for compliance

The use of tokens to mask sensitive data is taking hold in the payment industry, with merchants now having the option to use third-party service providers or install their own tokenization server to protect credit card data.

The market for a combined tokenization and encryption package has been simmering, buoyed by merchants trying to find ways to simplify the payment process and meet PCI encryption requirements. The latest guidance from the PCI Security Standards Council suggests that the market for tokenization and point-to-point encryption for PCI compliance is still in its infancy.

"I think it will be a little time before we know whether the current batch of solutions can address all the potential problems," said Ramon Krikken, an analyst at Stamford, Conn.-based Gartner Inc. "The Wal-Marts and Targets of the world, or even large ecommerce retailers, are the ones that may be hesitant to jump in right now."

Krikken said vendors are slowly working toward creating standards so merchants don't get locked into a single vendor. System integration issues also need to be ironed out, Krikken said. Not all software packages can integrate with various databases used for data warehousing, analytical systems and point-of-sale applications. The PCI council is also working on tokenization guidance documents and validation standards so qualified security assessors can evaluate tokenization and encryption systems for compliance with PCI DSS.

Gary Palgon, leader of the PCI SSC Tokenization Working Group and vice president of product management at Atlanta-based tokenization vendor nuBridges Inc., said the push for standards is beginning with PCI DSS, but other requirements for a tokenization standard are needed to address other types of data. For example, many merchants use a 16-digit token when masking credit card data to ensure analytical systems function properly, but a company using tokens for personally identifiable information, such as salary data, may not need that 1:1 relationship, Palgon said.

"We've reached out to our competitors and said we need to be a little more aggressive on standards from a tokenization standpoint," he said. "There will be areas in which we will compete and there will be areas which are commoditized."

RSA is the latest vendor to offer a software package that combines encryption and tokenization capabilities. The security division of EMC Corp. released the Data Protection Manager tool this week. The tool can eliminate credit card data in payment and analytical systems by replacing them with a token. It can also be used in the medical field or other industries that deal with sensitive data.

RSA isn't the only encryption vendor offering off-the-shelf tokenization/encryption software. Protegrity Corp. and Voltage Security Inc. offer format-preserving encryption, something RSA does not. Format-preserving encryption can keep the same format of the unencrypted data, such as a credit card number string. RSA said its server enables companies to keep part of the format (several digits of a customer's credit card number). nuBridges partnered with PGP Corp., now part of Symantec, to offer encryption integration.

"You shrink the scope to applications that really need card numbers plus your tokenization server," Krikken said. "The gain with solutions like this is that you'll have the entire infrastructure under your control."

RSA Data Protection Manager is a server-side management tool and token database. It includes an interface for setup and management of the technology. The console is used to manage keys and tokens, enabling IT to set key rotation policies -- monthly or annually -- for different parts of the infrastructure. "In addition, the same server is used to manage the application environment as well as the back-end disk and storage encryption, so customers avoid the overhead of key management silos," RSA said in a statement.

RSA said the Data Protection Manager targets larger merchants who don't want to use a third-party provider for tokenization services. DPM does not require a professional services team to implement, but RSA said it frequently gets requests to tune the DPM server for performance. "A hardware appliance is also available for enterprise key management use cases, which makes for easier deployment with customer resources," RSA said.

RSA also offers a point-to-point encryption and tokenization service with payment processor First Data Corp., an option that may be popular with small and midsized merchants attempting to reduce the scope of PCI DSS by moving all payment data out of company systems. RSA has a similar arrangement with San Jose, Calif-based point-of-sale systems vendor, VeriFone Systems Inc., incorporating tokenization and encryption into VeriFone's secure payment systems software.

View the original article here

More PCI encryption, tokenization options emerge for compliance

The use of tokens to mask sensitive data is taking hold in the payment industry, with merchants now having the option to use third-party service providers or install their own tokenization server to protect credit card data.

The market for a combined tokenization and encryption package has been simmering, buoyed by merchants trying to find ways to simplify the payment process and meet PCI encryption requirements. The latest guidance from the PCI Security Standards Council suggests that the market for tokenization and point-to-point encryption for PCI compliance is still in its infancy.

"I think it will be a little time before we know whether the current batch of solutions can address all the potential problems," said Ramon Krikken, an analyst at Stamford, Conn.-based Gartner Inc. "The Wal-Marts and Targets of the world, or even large ecommerce retailers, are the ones that may be hesitant to jump in right now."

Krikken said vendors are slowly working toward creating standards so merchants don't get locked into a single vendor. System integration issues also need to be ironed out, Krikken said. Not all software packages can integrate with various databases used for data warehousing, analytical systems and point-of-sale applications. The PCI council is also working on tokenization guidance documents and validation standards so qualified security assessors can evaluate tokenization and encryption systems for compliance with PCI DSS.

Gary Palgon, leader of the PCI SSC Tokenization Working Group and vice president of product management at Atlanta-based tokenization vendor nuBridges Inc., said the push for standards is beginning with PCI DSS, but other requirements for a tokenization standard are needed to address other types of data. For example, many merchants use a 16-digit token when masking credit card data to ensure analytical systems function properly, but a company using tokens for personally identifiable information, such as salary data, may not need that 1:1 relationship, Palgon said.

"We've reached out to our competitors and said we need to be a little more aggressive on standards from a tokenization standpoint," he said. "There will be areas in which we will compete and there will be areas which are commoditized."

RSA is the latest vendor to offer a software package that combines encryption and tokenization capabilities. The security division of EMC Corp. released the Data Protection Manager tool this week. The tool can eliminate credit card data in payment and analytical systems by replacing them with a token. It can also be used in the medical field or other industries that deal with sensitive data.

RSA isn't the only encryption vendor offering off-the-shelf tokenization/encryption software. Protegrity Corp. and Voltage Security Inc. offer format-preserving encryption, something RSA does not. Format-preserving encryption can keep the same format of the unencrypted data, such as a credit card number string. RSA said its server enables companies to keep part of the format (several digits of a customer's credit card number). nuBridges partnered with PGP Corp., now part of Symantec, to offer encryption integration.

"You shrink the scope to applications that really need card numbers plus your tokenization server," Krikken said. "The gain with solutions like this is that you'll have the entire infrastructure under your control."

RSA Data Protection Manager is a server-side management tool and token database. It includes an interface for setup and management of the technology. The console is used to manage keys and tokens, enabling IT to set key rotation policies -- monthly or annually -- for different parts of the infrastructure. "In addition, the same server is used to manage the application environment as well as the back-end disk and storage encryption, so customers avoid the overhead of key management silos," RSA said in a statement.

RSA said the Data Protection Manager targets larger merchants who don't want to use a third-party provider for tokenization services. DPM does not require a professional services team to implement, but RSA said it frequently gets requests to tune the DPM server for performance. "A hardware appliance is also available for enterprise key management use cases, which makes for easier deployment with customer resources," RSA said.

RSA also offers a point-to-point encryption and tokenization service with payment processor First Data Corp., an option that may be popular with small and midsized merchants attempting to reduce the scope of PCI DSS by moving all payment data out of company systems. RSA has a similar arrangement with San Jose, Calif-based point-of-sale systems vendor, VeriFone Systems Inc., incorporating tokenization and encryption into VeriFone's secure payment systems software.

View the original article here

E-Guide: Technical Guide on Web Application Firewalls

Web application firewalls are becoming critical data protection and compliance tools that any security decision maker must understand. SearchSecurity.com presents a comprehensive guide to Web Application Firewalls in which experts examine evaluation criteria, deployment considerations and management issues.

In this guide you will learn about:

Choosing the right Web application firewallHow to choose between source code reviews or Web application firewallsHow Web application security mandates burden smaller companiesBuilding application firewall rule basesHow application security expertise is a plus when offering WAF servicesAnd more!

Sponsored by:

WatchGuardIBMImperva, Inc.GeoTrust

View the original article here

E-Guide: Technical Guide on Web Application Firewalls

Web application firewalls are becoming critical data protection and compliance tools that any security decision maker must understand. SearchSecurity.com presents a comprehensive guide to Web Application Firewalls in which experts examine evaluation criteria, deployment considerations and management issues.

In this guide you will learn about:

Choosing the right Web application firewallHow to choose between source code reviews or Web application firewallsHow Web application security mandates burden smaller companiesBuilding application firewall rule basesHow application security expertise is a plus when offering WAF servicesAnd more!

Sponsored by:

WatchGuardIBMImperva, Inc.GeoTrust

View the original article here

Tape Drive Comparison

With the Spectra Logic launch of the LTO-5, the fifth generation of the successful LTO program, examining the range of the latest tape technologies helps customers select the right tape for their backup environment. Read this informative white paper comparing backup technologies to help make your backup decision.

View the original article here

Tape Drive Comparison

With the Spectra Logic launch of the LTO-5, the fifth generation of the successful LTO program, examining the range of the latest tape technologies helps customers select the right tape for their backup environment. Read this informative white paper comparing backup technologies to help make your backup decision.

View the original article here

Windows 7 and Desktop Lockdown with Privilege Management

With the Windows XP sunset date fast approaching, plans for Windows 7 migrations are in full swing. This has prompted most organizations to also re-assess their approach to PC lockdown.  With the advanced privilege management capabilities offered by Viewfinity, enterprises have an alternative to the “all or nothing” approach to least privileges – because an “all or nothing” methodology prohibits organizations from meeting compliance, security and desktop operations goals.  This white paper discusses how Viewfinity Privilege Management allows IT professionals to reach these objectives, without sacrificing user productivity or increasing support call volume. We offer granular, multi-level user permission control, including support for endpoints that are not part of the Active Directory domain or do not regularly connect to the corporate network.

View the original article here

Windows 7 and Desktop Lockdown with Privilege Management

With the Windows XP sunset date fast approaching, plans for Windows 7 migrations are in full swing. This has prompted most organizations to also re-assess their approach to PC lockdown.  With the advanced privilege management capabilities offered by Viewfinity, enterprises have an alternative to the “all or nothing” approach to least privileges – because an “all or nothing” methodology prohibits organizations from meeting compliance, security and desktop operations goals.  This white paper discusses how Viewfinity Privilege Management allows IT professionals to reach these objectives, without sacrificing user productivity or increasing support call volume. We offer granular, multi-level user permission control, including support for endpoints that are not part of the Active Directory domain or do not regularly connect to the corporate network.

View the original article here

The Benefits of WAN Optimization – Part 2

TechTarget provides enterprise IT professionals with the information they need to perform their jobs - from developing strategy, to making cost-effective IT purchase decisions and managing their organizations' IT projects - with its network of   |     

All Rights Reserved, Copyright 2000 - 2010, TechTarget | 

View the original article here

The Benefits of WAN Optimization – Part 2

TechTarget provides enterprise IT professionals with the information they need to perform their jobs - from developing strategy, to making cost-effective IT purchase decisions and managing their organizations' IT projects - with its network of   |     

All Rights Reserved, Copyright 2000 - 2010, TechTarget | 

View the original article here