What does this mean? Well, according to the researchers, it has put millions cash registers at risk since 1990. Although they did decline to explicitly state who the company was, fingers have been pointed to Verifone.
Verifone did respond to the report and stated that even if the default password is known, it just allows someone to perform some configurations on the terminal but that "all executables have to be file signed, and it is not possible to enter malware just by knowing passwords." In any case, the company did say that it strongly encourages customers to change the default password and that is echoed by security professionals everywhere.
However, last year warnings from other security companies came out stating that skilled hackers can potentially compromise PoS terminals on a large scale and get to the credit card numbers of thousands of customers at once; and that may be a result of someone getting a password to a terminal through a connected network. And there is no denying that are several PoS malware packages floating around in the wild that have already allowed hackers to compromise systems at retailers such as Staples, Goodwill Industries, and Chick-fil-A within the past year.
Any time a device is put into a network, the default password should be changed and that password should follow strong passphrase guidelines. This means that it should be at least eight characters, but more is better. It should not be something that can be found in a dictionary or is easily guessed and preferably, it should be randomized. It should also contain a combination of letters in both upper and lower cases, as well as numbers, and at least one (more is better) special character.
As cyber criminals are getting more sophisticated at cracking passwords, using phrases makes for even stronger pass codes. Charles Henderson, a researcher at the RSA convention said that in 90% of the cases, the default password remains in use after the devices are put into production.
No matter who you believe, it should be a habit to change default passwords for any new devices. In addition, as soon as they are installed, they should be updated with the latest patches. Sometime, they may sit in a store for quite some time before being sold and many updates may have been released since.
It is reported that Verifone has shipped somewhere around 27 million devices to over 150 countries.
For banks and credit unions
Share this article with your members
Copy a ready-made summary and link for your newsletter, website or social posts.
