Tags Archiveswireless

How to Make a Mobile Payment App Comply with PCI DSS standard

The PCI Security Standards Council recently made news when they announced that they would no longer be accepting mobile payment applications for PA-DSS compliance consideration. This means that vendors looking to certify new mobile applications or devices are now left in the lurch. But we have to dissect this rather knee-jerk reaction (see, there I go again) by the Council to understand exactly their intent. What they said was: “No mobile payment applications used by merchants to accept or process payment for goods and services would be approved or listed as validated PA-DSS applications unless all requirements can be satisfied as stated… Until it has completed a comprehensive examination of the mobile communications device and mobile payment application landscape, the ...

Continue Reading

No More WEP, Did You Make It? standard

Well, last week saw the passage of June 30, 2010.  Do you know where your WEP is? For those of you subject to PCI DSS, you are no longer allowed to use WEP to “protect” your in-scope networks (Requirement 4.1.1, in the italics).  Remember when PCI DSS 1.2 came out and you thought you had plenty of time?  Hopefully you planned well. I have not run into too much WEP on in-scope networks in the last year or so.  I still see it in retail locations for inventory control or other types of wireless networking, but those are usually firewalled off from the POS environment. Is anyone out there still using WEP?

Continue Reading

More Advice when using Public WiFi standard

Scott Carmichael from the great travel blog Gadling published a post yesterday with tips on keeping your data safe when connecting to public wireless hotspots.  There are some really good tips for everyone here, but I wanted to add to a few of the options. One of the recommendations is to get a 3G or 4G data card.  In working for a Telco for a few weeks, I did learn a thing or two about these networks and how laptops of employees can be locked down almost to be unusable.  This is definitely a fantastic recommendation but has two key drawbacks—cost and usability. While data cards can be obtained reasonably cheap, and depending on how you connect to the internet ...

Continue Reading

Think Blackberry is Safe? Think again! standard

Chris Eng at Veracode put together a pretty sweet little presentation based on a tool Tyler Shields created to infiltrate Blackberry Smartphones called BBSpy.  Blackberry’s seem to be viewed as a more secure mobile platform for a smartphone or PDA than any other, to the point of speculation about the existence and future of President Obama’s Blackberry. When I first got a Blackberry smartphone, not only did my ability to separate my personal and professional life change, but I remember as a security professional liking some of the features provided.  Remote wiping, encryption, and a password attempt bomb made me feel that should I lose my Blackberry, I would be able to prevent any sensitive data on it from falling ...

Continue Reading

Wireless On a Plane? standard

Go-go-gadget WI-FI ON A PLANE! I imagine that the next two weeks will see a significant amount of Wi-Fi trials or sales as parents and children alike take to the skies to visit loved ones over the holidays.  While I am sure it has happened already, you don’t find too many documented cases of wireless attacks happening on airplanes.  There are a couple of ways that attacks can happen. The first attack does not even require an internet connection, just a lazy passenger that does not follow their airline’s electronic device policy.  I’ve seen tons of weary road warriors working on their laptops without removing their 3G data card or with that little Wi-Fi light blinking furiously.  While going after ...

Continue Reading

Craking as a Service (Caas)? standard

This is not a new concept, and has even been discussed here before.  PC World is reporting that a new service is available for all of us.  Have a WPA PSK you want to crack?  It will cost you $34 and about 20 minutes. WPA Cracker is a new service launched by the same researcher that has spent time attacking SSL/TLS over the last few years.  While the price may be a little high, it certainly represents an interesting shift in activities typically reserved for botnets or universities with large computing resources.  Where else could we take this? Rainbow tables for most hash types are readily available through Bit Torrent, or can be generated with simple scripts and a chunk ...

Continue Reading

This is a unique website which will require a more modern browser to work!

Please upgrade today!