A total of 32 lakh (3.2 million) debit cards across 19 banks could have been compromised on account of a purported fraud, the National Payment Corporation of India said in a statement. BloombergQuint adds: “The genesis of the problem was receipt of complaints from few banks that their customer’s cards were used fraudulently mainly in China and USA while customers were in India, ” the NPCI said. “The complaints of fraudulent withdrawal are limited to cards of 19 banks and 641 customers. The total amount involved is Rs 1.3 crore as reported by various affected banks to NPCI.” SISA Security, a Bengaluru-based company is currently undertaking a forensic study to identify the extent of the problem and will submit a final report in November. Initial reports had suggested that ATMs operated by Hitachi Payment Services had been attacked by malware and were the source of the breach. However, the company has said in a statement that an interim report by the audit agency does not suggest any breach or compromise in its systems. Read more of this story at Slashdot.
Read the article:
India’s Biggest ATM Breach? 3.2 Million Debit Cards Across 19 Banks May Have Been Compromised
An anonymous reader quotes a report from Ars Technica: For the better part of a day, KrebsOnSecurity, arguably the world’s most intrepid source of security news, has been silenced, presumably by a handful of individuals who didn’t like a recent series of exposes reporter Brian Krebs wrote. The incident, and the record-breaking data assault that brought it on, open a troubling new chapter in the short history of the Internet. The crippling distributed denial-of-service attacks started shortly after Krebs published stories stemming from the hack of a DDoS-for-hire service known as vDOS. The first article analyzed leaked data that identified some of the previously anonymous people closely tied to vDOS. It documented how they took in more than $600, 000 in two years by knocking other sites offline. A few days later, Krebs ran a follow-up piece detailing the arrests of two men who allegedly ran the service. A third post in the series is here. On Thursday morning, exactly two weeks after Krebs published his first post, he reported that a sustained attack was bombarding his site with as much as 620 gigabits per second of junk data. That staggering amount of data is among the biggest ever recorded. Krebs was able to stay online thanks to the generosity of Akamai, a network provider that supplied DDoS mitigation services to him for free. The attack showed no signs of waning as the day wore on. Some indications suggest it may have grown stronger. At 4 pm, Akamai gave Krebs two hours’ notice that it would no longer assume the considerable cost of defending KrebsOnSecurity. Krebs opted to shut down the site to prevent collateral damage hitting his service provider and its customers. The assault against KrebsOnSecurity represents a much greater threat for at least two reasons. First, it’s twice the size. Second and more significant, unlike the Spamhaus attacks, the staggering volume of bandwidth doesn’t rely on misconfigured domain name system servers which, in the big picture, can be remedied with relative ease. The attackers used Internet-of-things devices since they’re always-connected and easy to “remotely commandeer by people who turn them into digital cannons that spray the internet with shrapnel.” “The biggest threats as far as I’m concerned in terms of censorship come from these ginormous weapons these guys are building, ” Krebs said. “The idea that tools that used to be exclusively in the hands of nation states are now in the hands of individual actors, it’s kind of like the specter of a James Bond movie.” While Krebs could retain a DDoS mitigation service, it would cost him between $100, 000 and $200, 000 per year for the type of protection he needs, which is more than he can afford. What’s especially troubling is that this attack can happen to many other websites, not just KrebsOnSecurity. Read more of this story at Slashdot.