Digital wallets enable users to securely store their financial information on smart devices and perform financial transactions without any hassle.
These wallets offer enhanced security compared to traditional payment methods, as these wallets encrypt payment data.
Since smartphone adoption has grown significantly, digital wallets are becoming increasingly popular for their convenience.
Cybersecurity analysts at Usenix recently discovered that digital wallets were bypassed to allow purchases with stolen cards.
Free Webinar on Detecting & Blocking Supply Chain Attack -> Book your Spot
Vulnerabilities are introduced by decentralized authority delegation in the digital payment ecosystem.
Adding victims’ wallet bank cards to their own wallets, bypassing payment authorization with implicit trust between wallets and banks, and using different payment types to get round access controls.
Such security flaws in system design and trust relationships open up several possibilities for fraud and unauthorized acts.
Threat actors exploit vulnerabilities in payment systems by creating backdoors across various transaction types, circumventing established access control policies.
This sophisticated attack enables unauthorized users to make purchases of any amount using victims’ bank cards, even when those cards have been reported stolen and locked by their owners.
The severity of this exploit lies in its ability to override standard security protocols, potentially leading to significant financial losses for victims and undermining trust in banking systems.
Researchers have conducted a thorough study that confirms serious security lapses in major US financial institutions and digital payment platforms.
Researchers focused on discovering and testing vulnerabilities in big banks such as Chase, American Express, and Bank of America, as well as widely used e-wallet applications such as Apple Pay, Google Pay, and PayPal.
These discoveries show how risky the current fintech systems may be. Due to this, they have shared their findings with all affected persons following responsible disclosure practices.
Additionally, security analysts have designed and advocated for a number of specific mitigation plans aimed at addressing these security flaws.
While as a recommendation they urged users to not only seek to fix security flaws identified but also to strengthen the system from such potential attacks in the future which will result in increased financial safety for millions of users.
Are you from SOC and DFIR Teams? Analyse Malware Incidents & get live Access with ANY.RUN -> Get 14 Days Free Acces
A critical command injection vulnerability in the popular systeminformation npm package has recently been disclosed, exposing millions…
Researchers discovered a malware campaign targeting the npm ecosystem, distributing the Skuld info stealer through…
An investigation revealed an intrusion in Asia involving the BellaCiao .NET malware, as the initial…
A seemingly benign health app, "BMI CalculationVsn," was found on the Amazon App Store, which…
The Lazarus Group has recently employed a sophisticated attack, dubbed "Operation DreamJob," to target employees…
NodeStealer, initially a JavaScript-based malware, has evolved into a more sophisticated Python-based threat that targets…