Data bank cards, which appeared in the public domain could be derived from sources other than the database processing center. In this case, representatives of companies Group IB and Elcomsoft, analyze "evidence of hacking, do not deny the possibility of theft of payment data through phishing. On Monday, December 27 on the main page www.chronopay.com was placed Paul's Wroblewski, founder ChronoPay, which said the loss of a significant number of payments data. Users to the processing center (one of the largest acquirers of online payments with bank cards in RuNet) are invited to contact the bank and block your card and inform your friends and acquaintances. As it turned out later, "treatment" - a fake, placed by stealing the password to the DNS servers to the site. Message, "we broke Chronopay Paul Vrublevsky" also appeared in one of the blogs "LiveJournal." As evidence of hacking blog authors have demonstrated links to the data of more than 800 card compromise and SSL-certificate processing center. After analyzing this information, employees are Group IB, dedicated to investigating computer crimes, said that provided clues and passwords do not provide access to the processing system, and the "stolen" Open SSL-certificate can be freely taken from the site ChronoPay. According to Andrei Malyshev, the technical director Elcomsoft (a company engaged in the restoration of passwords for access to data), even a successful theft of SSL-certificates and passwords can lead to cracking of a database containing credit card number. In this case, as reported by RIA Novosti news agency, the attackers could steal some billing due to the "stolen" domain www.chronopay.com, replacing the contents of the site.
No comments:
Post a Comment