Visa warns that hackers are scraping card details from gas pumps

Cybercrime groups are actively exploiting a weakness in gas station point-of-sale (POS) networks to steal credit card data, Visa has revealed. The company's fraud disruption teams are investigating several incidents in which a hacking group known as Fin8 defrauded fuel dispenser merchants. In each case, the attackers gained access to the POS networks via malicious emails and other unknown means. They then installed POS scraping software that exploited the lack of security with old-school mag stripes in card readers that can't read chips. The hack doesn't appear to affect more secure chip cards, but many of the service stations haven't replaced card readers at the pumps yet. The data is apparently sent in an unencrypted form to the vendor's main network, where the thieves have figured out how to intercept it. The other problem is that the POS systems aren't firewalled off from other, less critical parts of the network, allowing thieves to gain lateral access once the network is breached. -- More...