Foregenix Blog

The Foregenix Digital Forensics and Incident Response Team recently reported a man-in-the-middle attack that we had seen executed against an iFrame redirected payment method.  The attack specifically targeted the iFrame of a popular UK Payment Service Provider (PSP). We have received numerous requests for more detailed information around how the attack was orchestrated – principally as outsourced payment models were considered largely secure – and in that light we present the details of how the attack was accomplished.

TeamViewer has been all over the news in the last few days with “significant” numbers of  TeamViewer clients expressing/venting on Reddit, Twitter and other social media channels.  TeamViewer has denied that there has been a breach of their systems and instead has pointed to “mega-breaches” of social networks and users using the same account credentials across multiple platforms.  Coincidentally, Foregenix has recently completed a case study involving compromised TeamViewer credentials.

For those unfamiliar with the concept of outsourced payment models, it is essentially the adoption and implementation of eCommerce payment services from commercial Payment Service Providers (PSP) rather than merchants handling the payments themselves. You have probably experienced the concept when you suddenly get whisked off to a different site to present your payment details and then revert back to the eCommerce website once payment has been made. The idea of this being to make sure payment details pass directly from the consumer to the payment service provider who has had their operational security reviewed and certified as PCI DSS compliant. 

The South African fast food industry experienced a massive data compromise back in 2013 – as a result Foregenix was called in to investigate and find out exactly how the hackers managed to get in, how much they stole, when they stole the data and how did they go undetected for so long.

Space Tourism and Payments

The loss of the Virgin Galactic Space Capsule will go down in history as one of many tragic accidents that have resulted from man’s desire to push the boundaries of flight. If any industry possesses ‘bounce-back-ability’ then it’s aerospace. Indeed there is a lot that the Payments industry can learn from aviation when it comes avoiding the same mistakes being made twice.