logo.png
Guided Website Threat Review

Foregenix Blog

Duncan Slater

Alert: Major UK Payment Service Provider iFrame Man-In-The-Middle Breach

The Foregenix Digital Forensics and Incident Response Team recently reported a man-in-the-middle attack that we had seen executed against an iFrame redirected payment method.  The attack specifically targeted the iFrame of a popular UK Payment Service Provider (PSP). We have received numerous requests for more detailed information around how the attack was orchestrated – principally as outsourced payment models were considered largely secure – and in that light we present the details of how the attack was accomplished.

Read More
Benjamin Hosack

TeamViewer Used to Attack Leading Footwear Retailer

Indicators of compromise

,10/06/16 09:26

TeamViewer has been all over the news in the last few days with “significant” numbers of  TeamViewer clients expressing/venting on Reddit, Twitter and other social media channels.  TeamViewer has denied that there has been a breach of their systems and instead has pointed to “mega-breaches” of social networks and users using the same account credentials across multiple platforms.  Coincidentally, Foregenix has recently completed a case study involving compromised TeamViewer credentials.

Read More
Kirsty Trainer

Malware Alert: iFrame Interception attack affecting websites with outsourced payment models

For those unfamiliar with the concept of outsourced payment models, it is essentially the adoption and implementation of eCommerce payment services from commercial Payment Service Providers (PSP) rather than merchants handling the payments themselves. You have probably experienced the concept when you suddenly get whisked off to a different site to present your payment details and then revert back to the eCommerce website once payment has been made. The idea of this being to make sure payment details pass directly from the consumer to the payment service provider who has had their operational security reviewed and certified as PCI DSS compliant. 

Read More

Data Compromise and PCI Compliance


The South African fast food industry experienced a massive data compromise back in 2013 – as a result Foregenix was called in to investigate and find out exactly how the hackers managed to get in, how much they stole, when they stole the data and how did they go undetected for so long.

Read More
Richard Jones

Space Tourism: What Can The Payment Industry learn?


Space Tourism and Payments

The loss of the Virgin Galactic Space Capsule will go down in history as one of many tragic accidents that have resulted from man’s desire to push the boundaries of flight. If any industry possesses ‘bounce-back-ability’ then it’s aerospace. Indeed there is a lot that the Payments industry can learn from aviation when it comes avoiding the same mistakes being made twice.

Read More
Duncan Slater

Alert: Major UK Payment Service Provider iFrame Man-In-The-Middle Breach

The Foregenix Digital Forensics and Incident Response Team recently reported a man-in-the-middle attack that we had seen executed against an iFrame redirected payment method.  The attack specifically targeted the iFrame of a popular UK Payment Service Provider (PSP). We have received numerous requests for more detailed information around how the attack was orchestrated – principally as outsourced payment models were considered largely secure – and in that light we present the details of how the attack was accomplished.

Read More
Benjamin Hosack

TeamViewer Used to Attack Leading Footwear Retailer

Indicators of compromise

,10/06/16 09:26

TeamViewer has been all over the news in the last few days with “significant” numbers of  TeamViewer clients expressing/venting on Reddit, Twitter and other social media channels.  TeamViewer has denied that there has been a breach of their systems and instead has pointed to “mega-breaches” of social networks and users using the same account credentials across multiple platforms.  Coincidentally, Foregenix has recently completed a case study involving compromised TeamViewer credentials.

Read More
Kirsty Trainer

Malware Alert: iFrame Interception attack affecting websites with outsourced payment models

For those unfamiliar with the concept of outsourced payment models, it is essentially the adoption and implementation of eCommerce payment services from commercial Payment Service Providers (PSP) rather than merchants handling the payments themselves. You have probably experienced the concept when you suddenly get whisked off to a different site to present your payment details and then revert back to the eCommerce website once payment has been made. The idea of this being to make sure payment details pass directly from the consumer to the payment service provider who has had their operational security reviewed and certified as PCI DSS compliant. 

Read More

Data Compromise and PCI Compliance


The South African fast food industry experienced a massive data compromise back in 2013 – as a result Foregenix was called in to investigate and find out exactly how the hackers managed to get in, how much they stole, when they stole the data and how did they go undetected for so long.

Read More
Richard Jones

Space Tourism: What Can The Payment Industry learn?


Space Tourism and Payments

The loss of the Virgin Galactic Space Capsule will go down in history as one of many tragic accidents that have resulted from man’s desire to push the boundaries of flight. If any industry possesses ‘bounce-back-ability’ then it’s aerospace. Indeed there is a lot that the Payments industry can learn from aviation when it comes avoiding the same mistakes being made twice.

Read More

Cyber Security Insights

Duncan Slater
21/07/17 10:15

Foregenix Review of the Office for National Statistics Crime Survey

Today [July 20th 2017] the Office for National Statistics in the UK released their annual Crime Survey for England and Wales (CSEW), for the twelve ...

Read More

Benjamin Hosack
10/07/17 16:40

Magento Websites: How is the security health of your website?

Cyber security is a hot topic, with articles appearing most days within the mainstream media.  As consumers, we’re all becoming more cyber-aware as ...

Read More

Kirsty Trainer
07/07/17 16:41

Take the Guesswork Out of Your Website Security

Let’s say that someone approaches you on the street one day. They point to a busy shop across the street, and they say to you, “That’s my store, and ...

Read More

Andrew McKenna
06/07/17 16:21

Why You Need To Defend Against Nation State Attacks

A few months ago, I was working on a risk assessment with a business and one of the most extreme threats, beyond targeted malware, was an attack by a ...

Read More

David Kirkpatrick
05/07/17 10:57

Penetration Testing: The Quest For Fully UnDetectable Malware

Malware continues to be one of the main attack vectors used by criminals to compromise user and corporate data. Using phishing or social engineering ...

Read More