Mobile POS is just one of the many attack vectors hackers use to access sensitive customer data, but recent news suggests merchants may be ill-prepared to protect these systems.
"Many of the risks associated with mPOS revolve around the processes those devices initiate."
Given that mPOS is gaining popularity among merchants, POS developers must not only understand the security risks specific to this technology but also implement solutions to mitigate those dangers.
mPOS security vulnerabilities
Many of the risks associated with mPOS revolve around the processes those devices initiate. Thales e-Security explained that encryption key loading and management actually poses a threat to merchants.
For example, many payment service providers deliver encryption key management at their own gateways to obfuscate debit and credit card information because mobile devices do not possess the cryptographic functions necessary to protect data independently. The problem is, if a hacker manages to compromise a PSP gateway, he could possibly steal encryption keys and decrypt payment information.
The dangers go beyond smartphones and tablets. Infosecurity Magazine Reporter Fahmida Rashid cited research from white hat hacker Nils and Jon Butler, head of research at MWR InfoSecurity, who discovered they could execute commands through mPOS devices' USB interfaces. In addition, the investigators developed a malicious EMV card capable of modifying mPOS terminals to discretely copy the PINs and card details of cards the devices process.
Which security measures can protect mPOS systems?
More mPOS terminals support EMV technology. While it isn't the be-all, end-all to protecting mobile payments, EMV provides two functions that reduce transactions risks, as outlined by the Smart Card Alliance:
- Card authentication verifies whether a credit or debit card is legitimate, thereby preventing fraud.
- Cardholder verification ensures the person using the card is the actual owner (PIN-preferring cards).
Furthermore, point-to-point encryption is crucial technology that decreases dependency on PSP key management. P2PE encrypts payment data the minute a customer uses a chip-enabled or magnetic stripe card. It supplements EMV's security capabilities by ensuring the data is unreadable until it reaches the merchant's processor. Beware of gateway solutions that decrypt data via a standardized key before routing the transaction to the processor. This creates an unnecessary breach point for all connected merchants and solution providers.
Still, hackers especially skilled in decryption may be able to unmask payment information. To address this issue, many companies are implementing technology that removes payment data from transactions through a process known as tokenization. This replaces card data with a token - a placeholder that represents a customer's credit card number. Once a merchant generates a random token, it uses that token to support subsequent transactions. Meanwhile, the actual card data is stored in a highly secure offsite location.
When establishing security for mPOS, developers must assess how different stages of the payment transaction introduce risk. Then, they can implement technologies or adjust protocols to reduce or even eliminate those vulnerabilities.