logo.png
Guided Website Threat Review

Foregenix Blog

Duncan Slater

Alert: Major UK Payment Service Provider iFrame Man-In-The-Middle Breach

The Foregenix Digital Forensics and Incident Response Team recently reported a man-in-the-middle attack that we had seen executed against an iFrame redirected payment method.  The attack specifically targeted the iFrame of a popular UK Payment Service Provider (PSP). We have received numerous requests for more detailed information around how the attack was orchestrated – principally as outsourced payment models were considered largely secure – and in that light we present the details of how the attack was accomplished.

Read More
Benjamin Hosack

TeamViewer Used to Attack Leading Footwear Retailer

Indicators of compromise

,10/06/16 09:26

TeamViewer has been all over the news in the last few days with “significant” numbers of  TeamViewer clients expressing/venting on Reddit, Twitter and other social media channels.  TeamViewer has denied that there has been a breach of their systems and instead has pointed to “mega-breaches” of social networks and users using the same account credentials across multiple platforms.  Coincidentally, Foregenix has recently completed a case study involving compromised TeamViewer credentials.

Read More
Kirsty Trainer

Malware Alert: iFrame Interception attack affecting websites with outsourced payment models

For those unfamiliar with the concept of outsourced payment models, it is essentially the adoption and implementation of eCommerce payment services from commercial Payment Service Providers (PSP) rather than merchants handling the payments themselves. You have probably experienced the concept when you suddenly get whisked off to a different site to present your payment details and then revert back to the eCommerce website once payment has been made. The idea of this being to make sure payment details pass directly from the consumer to the payment service provider who has had their operational security reviewed and certified as PCI DSS compliant. 

Read More

Data Compromise and PCI Compliance


The South African fast food industry experienced a massive data compromise back in 2013 – as a result Foregenix was called in to investigate and find out exactly how the hackers managed to get in, how much they stole, when they stole the data and how did they go undetected for so long.

Read More
Richard Jones

Space Tourism: What Can The Payment Industry learn?


Space Tourism and Payments

The loss of the Virgin Galactic Space Capsule will go down in history as one of many tragic accidents that have resulted from man’s desire to push the boundaries of flight. If any industry possesses ‘bounce-back-ability’ then it’s aerospace. Indeed there is a lot that the Payments industry can learn from aviation when it comes avoiding the same mistakes being made twice.

Read More
Duncan Slater

Alert: Major UK Payment Service Provider iFrame Man-In-The-Middle Breach

The Foregenix Digital Forensics and Incident Response Team recently reported a man-in-the-middle attack that we had seen executed against an iFrame redirected payment method.  The attack specifically targeted the iFrame of a popular UK Payment Service Provider (PSP). We have received numerous requests for more detailed information around how the attack was orchestrated – principally as outsourced payment models were considered largely secure – and in that light we present the details of how the attack was accomplished.

Read More
Benjamin Hosack

TeamViewer Used to Attack Leading Footwear Retailer

Indicators of compromise

,10/06/16 09:26

TeamViewer has been all over the news in the last few days with “significant” numbers of  TeamViewer clients expressing/venting on Reddit, Twitter and other social media channels.  TeamViewer has denied that there has been a breach of their systems and instead has pointed to “mega-breaches” of social networks and users using the same account credentials across multiple platforms.  Coincidentally, Foregenix has recently completed a case study involving compromised TeamViewer credentials.

Read More
Kirsty Trainer

Malware Alert: iFrame Interception attack affecting websites with outsourced payment models

For those unfamiliar with the concept of outsourced payment models, it is essentially the adoption and implementation of eCommerce payment services from commercial Payment Service Providers (PSP) rather than merchants handling the payments themselves. You have probably experienced the concept when you suddenly get whisked off to a different site to present your payment details and then revert back to the eCommerce website once payment has been made. The idea of this being to make sure payment details pass directly from the consumer to the payment service provider who has had their operational security reviewed and certified as PCI DSS compliant. 

Read More

Data Compromise and PCI Compliance


The South African fast food industry experienced a massive data compromise back in 2013 – as a result Foregenix was called in to investigate and find out exactly how the hackers managed to get in, how much they stole, when they stole the data and how did they go undetected for so long.

Read More
Richard Jones

Space Tourism: What Can The Payment Industry learn?


Space Tourism and Payments

The loss of the Virgin Galactic Space Capsule will go down in history as one of many tragic accidents that have resulted from man’s desire to push the boundaries of flight. If any industry possesses ‘bounce-back-ability’ then it’s aerospace. Indeed there is a lot that the Payments industry can learn from aviation when it comes avoiding the same mistakes being made twice.

Read More

Cyber Security Insights

Andrew McKenna
14/09/17 11:50

Containers: Keeping You Secure

Given there’s a lot of talk about containerisation in the applications marketplace at the moment, this post is intended to provide a light ...

Read More

Jake Dennys
11/09/17 13:04

Foregenix Achieve 11 Award Nominations in 6 Months

As a UK-based cybersecurity firm, our employees and clients touch every continent on the globe. Despite the company’s small size, with only 91 ...

Read More

Zacharias Pigadas
08/09/17 15:45

Getting The Most Out Of Your Web Application Penetration Test

The purpose of this post is to help clients better prepare, digest and act upon the results of a web application penetration test. A large amount of ...

Read More

Andrew McKenna
06/09/17 09:54

An Introduction to DevOps

We’ll start at the beginning and ramp up really quickly. DevOps is a portmanteau of development and operations. We can consider it to mean automation ...

Read More

Ewan Gardner
07/08/17 14:51

Anatomy Of A Magento Attack: Froghopper

  Magento is the most popular eCommerce web application in the world, with an estimated 236,000 live web sites using the Content Management System ...

Read More