Payments

After complaints from merchants and an update from the Federal Reserve, Visa on Nov. 22 clarified and modified debit routing rules, noting that merchants can route U.S. EMV debit transactions through any of more than a dozen available networks, and not just Visa's.

See Also: 2016 IAM Research: Where Financial Institutions' PAM Programs Are Falling Short

Visa's action could help support merchants' push for more widespread use of chip-and-PIN, even if only for EMV debit.

In its statement, Visa notes that it "modified and clarified existing debit network routing rules to help merchants and acquirers better understand implementation options related to the adoption of EMV."

With Visa chip cards, debit routing and processing are enabled by two payment application identifiers (AIDs) on the chip - the U.S. Common Debit AID or the Visa Debit AID, Visa notes. "The Common Debit AID can support any of the more than one dozen domestic debit networks that issuers can choose to offer in addition to Visa Debit. This provides merchants with the ability to select the network over which a debit transaction is processed or routed. ... Merchants can continue to automatically ask, or prompt, a Visa cardholder to enter a PIN on in-person transactions, provided the cardholder can still use their card without a PIN if they prefer."

The announcement comes just days after retail groups sent a letter to Visa, criticizing the card brand for taking steps to "circumvent merchants' legal right" to choose the network over which a debit transaction can be routed.

The Merchant Advisory Group and other retailer associations claimed that Visa's policies before Nov. 22 violated the Federal Reserve's rule on how debit transactions can and should be routed. In essence, MAG contended Visa was breaking the law (see Why Merchants Object to Visa's EMV Debit Routing Rules).

On Nov. 2, the Fed clarified that no card network can inhibit merchant routing choices, even by requiring technical specifications - such as those needed for EMV deployment - that could inhibit merchant routing options.

The PIN Debate

Since the onset of EMV in the U.S., merchants have argued that requiring PIN entry for all EMV chip payments, whether credit or debit - as has long been the practice in established EMV markets such as the U.K. - is the best way to prevent fraud.

Issuers and the card brands, in an effort to deploy EMV more quickly, pushed back on that idea, claiming requiring PINs for credit payments would only confuse customers and complicate EMV rollouts.

On the debit side, the argument for signature over PIN has been more challenging to make, because U.S. cardholders are accustomed to entering PINs for debit purchases, especially when using the cash-back option.

But the EMV debit rollout in the U.S. has been much more complicated than the credit rollout because of the sheer number of debit routing options available in the U.S. - a complication that doesn't exist in other EMV markets.

To route an EMV transaction through a domestic debit network, that network has to be certified by the card brands and equipped to process EMV transactions. And because the U.S. has more than a dozen debit card networks, getting all of those networks prepped and certified has been a long, drawn-out process.

To speed EMV adoption, merchants claim Visa limited merchants' options to run debit transactions through the Common Debit AID and was challenging merchants' right to require PIN entry on debit purchases.

Visa declined to comment beyond what was included in its statement about its debit routing modifications.

In light of Visa's modifications and the Fed's recent guidance, it's clear that merchants can require PIN entry for EMV debit purchases, contends Liz Garner, vice president of the Merchant Advisory Group, which represents 108 of the largest U.S. merchants, says. "But I think that's going to be contentious," she adds.

That's because, while Visa points out in its modifications statement that merchants can discourage the use of signature verification for debit purchases, they cannot completely eliminate signature as an option. "Where merchants automatically prompt for PIN on card-present transactions, they must minimally ensure that a cardholder presenting a Visa Debit card for payment can originate a transaction using a signature," Visa says.

The language is still "loose," Garner points out. But in the coming days, we may receive clarification from Visa or the Fed.

Data Breach

A group composed of computer scientists and activists has proposed that U.S. election results be audited in three key states in which President-elect Donald Trump won by a razor-thin margin. The group's goal is to definitively disprove that hackers may have influenced the contentious election.

See Also: How to Identify and Mitigate Threats on Your Network by Using a CASB

The group's fears are rooted in the gross inaccuracy of pre-election polls, which almost universally predicted a victory by Democratic nominee Hillary Clinton. The campaign was also marred by data leaks allegedly perpetrated by Russians in an apparent attempt to influence election results, during what many commentators characterized as one of the most bitter and unconventional elections in memory (see Did Russia - or Russian-Built Malware - Hack the DNC?).

Backing for the election-results auditing comes in part via Ron Rivest, a cryptographer who in part developed the RSA algorithm, as well as Philip Stark, an associate dean of mathematical and physical sciences at the University of California. They co-authored an editorial published Nov. 18 in USA Today calling for election results to be audited by default.

Further support for suchg an effort comes via J. Alex Halderman, a professor of computer science and engineering at the University of Michigan, who has done extensive research into the security vulnerabilities of electronic voting machines.

When it comes to detailing their reasons for wanting an audit, the academics appear to be erring on the side of caution, and noting that they have not seen any evidence of direct hacker interference.

"Were this year's deviations from pre-election polls the results of a cyber attack? Probably not," Halderman writes in a post on Medium. "I believe the most likely explanation is that the polls were systematically wrong, rather than that the election was hacked."

New York Magazine reported that Clinton performed worse in counties in Wisconsin that used electronic voting machines rather than those that use paper ballots, which are counted by optical scanners. Halderman has disputed the accuracy of the article, but other analysts have tried to see if it might reveal an anomaly with hacking implications.

FiveThirtyEight, the statistical analysis service owned by ESPN, says it so far hasn't found clear evidence that the type of voting system in a particular state or county affected the outcome. The seeming disparity in Michigan, Pennsylvania and Wisconsin disappears when adjusted for voters' race and education, writes Nate Silver, FiveThirtyEight's editor in chief.

...the effect COMPLETELY DISAPPEARS once you control for race and education levels, the key factors in predicting vote shifts this year. pic.twitter.com/NYOINx9lEz

"Maybe a more complicated analysis would reveal something, but usually [it's] bad news when a finding can't survive a basic sanity check like this," he writes on Twitter.

A Clinton Challenge?

Hillary Clinton's window to challenge the election results is rapidly closing. Halderman writes that deadlines to file recount petitions are Nov. 25 in Wisconsin, Nov. 28 in Pennsylvania and Dec. 1 in Michigan, which hasn't finished counting its votes.

Computers counted nearly all of the 129 million votes cast in the election. Some states would be easier than others to recount. Michigan and Wisconsin predominantly use paper ballots that are counted by optical scanners. An audit there would mean verifying that the optical scanners return the accurate result as selected by voters.

Pennsylvania, though, is problematic. Less than one-third of the state's counties use paper ballots counted by optical scanners. The rest have direct-recording electronic (DRE) voting machines, which experts have long warned are troublesome because they generate no paper record that can be audited. Many states, such as Nevada and California, have mandated that DRE machines also generate a paper record or receipt.

An audit of paperless DRE machines would thus require extensive testing of machines. If evidence emerged that malicious software may have tampered with vote results, a digital forensic analysis might then be the only way to verify the integrity - or lack thereof - of the machines.

The computer scientists contend that a full recount in particular states wouldn't be needed, at least at first. Instead, they say that a risk-limiting audit, which relies on a small sampling, could be used. If that audit turned up any irregularities, then a broader audit could be conducted.

Voting machines typically aren't connected to the internet, which limits hackers' options. But Halderman writes that the procedures for loading voting machines with ballot selections is ripe for abuse.

Ballot designs are copied from a regular desktop computer and loaded onto a removable drive, he writes.

"That initial computer is almost certainly not well secured, and if an attacker infects it, vote-stealing malware can hitch a ride to every voting machine in the area," Halderman writes. "There's no question that this is possible for technically sophisticated attackers."

Looking Ahead

Even if the buzz around the audit idea fizzles, it may help publicize longstanding concerns over the voting security, says Pamela Smith, president of Verified Voting, which is a nonprofit, nonpartisan organization.

Election results should be audited even absent concerns of irregularities, she says. Verified Voting has launched a petition supporting a risk-limited audit of the presidential election.

"I think it's helping having this be on everyone's mind," Smith says. "At the end of the day, whether you voted for the losing candidate or the winning candidate, there's something very satisfying about being able to say, 'And we checked and it was what it was.' It helps erase any lingering doubt."

Anti-Malware , DDoS , DDoS Attacks

Some 900,000 Deutsche Telekom customers were knocked offline after their routers were infected with a version of Mirai, the malware that's designed to infect internet of things devices, which has been linked to recent, record-shattering distributed denial-of-service attacks.

See Also: Mitigate Risks and Protect Your Users from Cyberattacks, Avoid the Yahoo Data Breach

The router infections disrupted internet connections, as well as telephony and television services, starting around Nov. 27, according to an advisory issued by Deutsche Telekom. Germany's National Cyber Defense Center is investigating.

The code that infected the routers is a modified version of Mirai, which is malware designed to infect and harness a variety of different types of internet-connected devices, writes Johannes Ullrich, dean of research at the SANS Technology Institute, in a blog post.

A large network of Mirai-infected digital video recorders and closed-circuit TV cameras executed some of the largest DDoS attacks on record over the past two months. DDoS attacks involve directing a barrage of data traffic at a service with the goal of making it unresponsive (see Mirai Botnet Pummels Internet DNS in Unprecedented Attack).

A massive attack against domain name server provider Dyn last month disrupted access to numerous sites, including many of its outsourced DNS management clients, which include PayPal, Spotify and Twitter. The DDoS attacks disrupted Dyn's ability to deliver internet address information to computers seeking to browse to numerous websites (see Botnet Army of 'Up to 100,000' IoT Devices Disrupted Dyn).

Security experts have been warning for years that consumer routers are notoriously insecure, in part because manufacturers rarely patch the devices - particularly older models - even when researchers find serious security vulnerabilities in the devices.

The burgeoning internet of things has been compounding the problem. Now, millions of internet-connected consumer devices - with poor or missing security controls - are in the hands of consumers. Attackers have seized on this opportunity, infecting and harnessing these internet-connected devices and their processing power to serve as free attack launch pads. The power of these devices, en masse, has ben demonstrated by multiple, different Mirai botnets being used to execute record-breaking DDoS attacks.

Deutsche Telekom Issues Emergency Update

In the wake of the router exploits affecting its customers, Deutsche Telekom has issued a software update that gets automatically installed after infected routers get restarted. The models affected are the Speedport W 921V, W 723V Type B and W 921 Fiber.

Observers say such infections could affect other ISPs that have older routers with software vulnerabilities still in use by customers. And there are already indications of suspected malicious scanning activity in Poland and Austria.

"This issue ... may affect others as well given that the U.S. is just 'waking up' from a long weekend," Ullrich writes.

Attackers Stalk Open Ports

Mirai attackers are hunting for DSL routers that have port 7547 open to launch attacks against the Simple Online Access Protocol - a.k.a. SOAP - service, Ullrich writes.

That port is the entry point for strikes using the TR-069 or TR-064 protocols, which are used by network operators for remote management of devices such as routers and set-top boxes.

In some cases, ISPs or router manufacturers do not require authentication to connect to a router using those protocols, thus leaving them at risk of attackers accessing them remotely and then executing malicious code.

Attacks in Ireland

Earlier this month, an anonymous researcher - using the handle "kenzo2017" - penned a blog post warning of problems with Zyxel-made Eir D1000 modems, which at one time were distributed by the Irish telecoms operator Eir.

The TR-064 protocol "is not supposed to be accessed from the WAN side of the modem but in the D1000 modem, we can send TR-064 commands to port 7547 on the WAN side," the researcher wrote." This allows us to 'configure' the modem from the internet."

On older routers, Eir didn't allow access to port 7547 except for IP addresses it controlled. "Inexplicably, Eir do not do this for their newer modems," the researcher writes. "If they did, these bugs would not have been exploitable."

These concerns are not academic: A module for exploiting the flaw in Eir routers has already been developed for the free, open source vulnerability testing framework Metasploit, and as of Nov. 28, cybersecurity firm Fox-IT reports that Eir D1000 routers have been infected and used to spread a modified version of Mirai.

"I have just done a search on Shodan for port 7547 in the Irish internet space and nearly 200,000 devices are there, with 182,000 of them with Eir," Brian Honan, a Dublin-based information security consultant who also runs Ireland's Computer Security Incident Response Team, tells Information Security Media Group.

So far, it doesn't appear that the compromised routers have been used to conduct any DDoS attacks. Instead, infected routers try to find other vulnerable ones, displaying worm-like behavior as they attempt to enlarge the pool of compromised devices.

The blog BadCyber, which analyzed a sample of the attack code, has published an analysis of the module, concluding that "the author of the malware borrowed the Mirai code and mixed it with the Metasploit module to produce his worm."

Millions of Routers At Risk?

Beyond the Eir and Deutsche Telekom attacks, however, researchers are warning that millions of more devices could be vulnerable to these router-focused attacks. Using the Shodan search engine, which allows for searches of internet-connected devices based on specific criteria, for example, Ullrich at the SANS Institute found 41 million devices across the internet that have port 7547 open.

Darren Martyn of Insecurety Research writes on Twitter that he's so far identified about 50 routers models from several vendors that could be affected, including ones distributed by TalkTalk in the U.K. and VIVO in Brazil.

In the wake of these router attacks, Ullrich recommends that IT administrators immediately block port 7547 and install any patches - if available - to lock down potentially affected devices.

Breach Notification , Data Breach

The U.S. Navy is set to begin notifying more than 130,000 current and former sailors that their personal information was exposed in a data breach and "accessed by unknown individuals."

See Also: 2016 IAM Research: Where Financial Institutions' PAM Programs Are Falling Short

The Navy says it first learned of the breach on Oct. 27, when Hewlett Packard Enterprise Services warned that a laptop issued to one of its employees - supporting a contract between HPES and the Navy - "was reported as compromised."

Hewlett Packard Enterprise didn't immediately respond to a request to provide more information about the breach or the circumstances surrounding the loss of the laptop.

But the Navy says that an investigation conducted by HPES and the Naval Criminal Investigative Service concluded Nov. 22 that "sensitive information, including the names and Social Security numbers (SSNs) of 134,386 current and former sailors, were accessed by unknown individuals."

The NCIS investigation is continuing.

"The Navy takes this incident extremely seriously - this is a matter of trust for our sailors," Chief of Naval Personnel Vice Adm. Robert Burke says in a statement. "We are in the early stages of investigating and are working quickly to identify and take care of those affected by this breach."

Compromised: Career Database

The lost data related to the Career Waypoints database, known as C-WAY, which sailors use to submit requests to reenlist as well as requests relating to the Navy Occupational Specialty, which catalogs skills and primary jobs, Navy Times reports.

In what may have been an attempt to downplay the incident, the Navy first announced the news of the breach just after 5 p.m. Eastern Time on Nov. 23, the day before Thanksgiving.

Despite the information having been accessed by "unknown individuals," to date the NCIS investigation has found "no evidence to suggest misuse of the information that was compromised," the Navy says.

Identity Theft Concerns

But stolen Social Security numbers are often fodder for identity thieves. On that front, the Navy says it's "reviewing credit monitoring service options for affected sailors" and that it plans to alert breach victims "in the coming weeks by multiple means including phone, letter and email."

Many security experts, however, advise breached organizations to avoid sending data breach notifications to breach victims via email, given the ease with which attackers can imitate such notifications to launch social engineering attacks, thus potentially compounding breach victims' problems.

Redux: Navy Breach Tied to HP

This isn't the first Navy database breach to involve Hewlett Packard, which in October 2014 split into Hewlett Packard Enterprise, a technology infrastructure, software and services company; and HP Inc., a personal systems and printing company.

In March 2014, the Navy reported that after discovering that the Navy Marine Corps Intranet network - its unclassified administrative network - had been breached, it took four months to eliminate attackers' access to systems and lock them down, at a cost of $10 million. The intranet was maintained by HP, as part of a contract that was awarded to HP in 2000 and renewed in 2010, The Wall Street Journal reported.

HP had referred to the Navy Marine Corps Intranet as "the world's largest and most secure intranet."

U.S. officials blamed the intranet intrusion on Iran.

But multiple security experts said the real breach culprit was poor contract oversight by the Navy, noting that no provision was in place to ensure that HP not only administered the intranet, but kept it secure, The Wall Street Journal reported. Due to that oversight failure, it reported, no one was ensuring that Microsoft SQL databases were being kept updated, which allowed attackers to launch a SQL injection attack via the Navy's public-facing website and then gain access to the unprotected databases.

Anti-Malware , Application Security , Social Media

Facebook is disputing recent reports that the file-encrypting ransomware known as Locky spread through its instant messaging platform.

See Also: 12 Top Cloud Threats of 2016

The company's response comes as security firm Check Point alleges that LinkedIn is vulnerable to the same kind of attack that hit Facebook, causing worry that ransomware distributors may have tapped two extremely large pools of potential victims.

Ransomware is malware that encrypts files on a computer and demands money in exchange for the decryption key, usually payable in bitcoin (see Ransomware Result: Free Ticket to Ride in San Francisco).

The story kicked off with a blog post on Nov. 20 from Bart P., a PwC threat intelligence researcher, who spotted a campaign spreading malicious image files through Facebook's Messenger. The files had a ".svg" suffix, which stands for scalable vector graphics.

The XML-based format allows images to retain their quality regardless of how they're manipulated. But it also allows for other embedded active content including JavaScript, which holds the potential for trouble.

If someone clicked on the .svg file received through Facebook, it's downloaded to a computer. If opened, the file launches a browser window that shows a fake YouTube website, Bart P. writes. That site shows a message that encourages victims to download a codec that is supposedly needed to view a video.

Actually, the file leads to a bogus Chrome extension that acted as a worm, harvesting data from someone's Facebook contacts and spreading through Messenger.

But there are indications that the .svg file didn't always try to get people to run a dodgy extension. Peter Kruse, founder of CSIS Security Group in Denmark, wrote that one test showed the .svg file was actually Nemucod, which is a malicious downloader. If Nemucod was downloaded, it would then deliver the Locky ransomware.

Some observers took issue with Kruse's analysis, writing their tests showed only the malicious Chrome extensions were delivered. But Kruse wrote on Twitter that the .svg files actually had varied payloads. Sometimes the payload was the questionable Chrome extension, called Udo, while others delivered Locky.

Locky is one of the top ransomware families, named after its behavior of adding .locky to files it encrypts. Users are typically asked to pay between .5 to 1 bitcoin (US$315 to $730) to decrypt their files (see Retooled Locky Ransomware Pummels Healthcare Sector).

Check Point Weighs In

A few days after Bart P.'s blog post, Check Point claimed to have discovered the attack vector used against Facebook, saying it also affects LinkedIn.

Check Point dubbed the attack ImageGate, claiming that attackers had "built a new capability to embed malicious code into an image file and successfully upload it to the social media website."

"In the past week, the entire security industry is closely following the massive spread of the Locky ransomware via social media, particularly in its Facebook-based campaign," Check Point writes.

The company writes that it's waiting for Facebook and LinkedIn to adjust their defenses before providing more technical detail. But Check Point did publish a video demonstration showing what it says is a successful ransomware attack conducted via Facebook. However, the method differs somewhat from what is described by Bart P.

The attack is launched over Facebook's Messenger. But instead of sending a .svg file, it uses a .hta one, which is a file extension designating an HTML application. The video shows that user would have to click on the file and save it before ransomware runs.

Facebook says Check Point's blog post doesn't describe the issue posed by Bart P., even though the company portrays it as the same.

"This analysis is incorrect," Facebook says in a statement. "There is no connection to Locky or any other ransomware, and this is not appearing on Messenger or Facebook."

Check Point contends it is using essentially the same method as spotted by Bart P. in order to infect someone with ransomware. However, Facebook is investigating the issue raised by Check Point, which would only appear to affect people using Firefox.

It's unclear from Check Point's blog post how the attack affected LinkedIn. Officials with LinkedIn, which is owned by Microsoft, couldn't be reached.

A Locky Break?

Since the posts from Bart P. and Check Point, Facebook analysts have found no evidence that ransomware has been successfully spread. Following Bart P.'s post, Facebook blocked and reported the bad Chrome extensions to Google.

Facebook has defenses in place to prevent the distribution of malicious code through Messenger. But attackers are always testing new methods to try and get past the filters. A large-scale outbreak of ransomware on either Facebook or LinkedIn would be notable but unlikely to last very long, as both companies would move quickly to shore up their systems.

Also, the attacks as described rely on heavy user interaction. In Bart P.'s example, users would have to click several times before the malicious code extension is installed. Check Point's demo has victims clicking twice: once to view a file sent over Messenger and then a second time to save it to a computer.

Of course, the benefit of abusing Facebook and LinkedIn is that users usually blindly trust whatever is sent to them, particularly if it appears to come from a trusted contact.

ATM Fraud , Fraud

Local police are investigating ATM skimming attacks at four New York hospitals. Security experts warn that fraudsters will likely continue to target locations, including hospitals, where ATMs are not closely monitored and around-the-clock access to the terminals is available.

See Also: Secrets to a Simpler Security Incident Response

"These skimming attacks are actually a major problem at ATMs in many locations," says financial fraud expert Shirley Inscoe, analyst for the consultancy Aite. "Skimming is currently the No. 1 threat at ATMs in the U.S. The problem is even growing at many financial institution locations, because they have outsourced ATM servicing, and staff no longer perform daily inspections as they did when the machines were serviced internally."

But when ATMs are placed in remote locations, the risk of skimming is even greater, Inscoe adds. Fraudsters often disguise themselves as service technicians or armored car personnel, fooling passersby into thinking they have a reason to be tampering with the ATM, she says.

"ATMs that are out of the way and not monitored are obviously at risk," Inscoe says. "But frankly, any machine can be compromised, since thieves work 24x7 and people don't really question anyone working on a machine. If they are wearing some type of official-looking uniform, people assume what they are doing is legitimate."

The New York Police Department has not yet revealed how it believes fraudsters successfully compromised ATMs in this most recent attack. For now, the department is focused on finding two individuals it believes are behind the attacks, according to a media alert sent to Information Security Media Group.

"It was reported to police that skimming devices were installed in hospital ATM machines between Wednesday, Aug. 24, 2016, and Tuesday, Nov. 1, 2016," the alert states. "The individuals used victim's personal information to make duplicate cards to make several unauthorized cash withdrawals."

So far, skimming devices have been found at ATMs located in Memorial Sloan-Kettering and New York Presbyterian Hospital in Manhattan, New York Methodist Hospital in Brooklyn, and Jamaica Hospital Medical Center in Queens, according to police. The theft of more than $40,000 has been linked to the attacks, reports CBS New York.

Back in 2012, eight hospitals in Toronto were targeted as part of a similar ATM skimming scheme (see ATM Attacks Exploit Lax Security).

Hospitals Are Easy Targets

Financial fraud expert Avivah Litan, an analyst at the consultancy Gartner, says ATM fraudsters gravitate to the points of least resistance - which often includes hospitals.

"Hospital staff can barely keep up with the ER waiting rooms, let alone worry about ATM security," she says. "Hospitals make perfect targets for ATM skimmers, and I'm sure we will see more of these ATM skimming attacks at hospitals and other understaffed, undersecured healthcare facilities in the coming year or two."

The best solution, Litan says: Install tamper-resistant ATMs. "I expect that will also start happening in the next year or two," she says.

Al Pascual, head of fraud and security at Javelin Strategy & Research, says it's unlikely that only four hospitals were targeted in this scheme. "Hospitals and ATM operators throughout the New York metro area should be inspecting ATMs installed at hospitals, as this is likely to be a far more pervasive crime than has been reported," he says.

ATM Skimming: Growing Worry

Banking executives see ATM skimming as a growing problem, with 68 percent of executives recently surveyed by Aite ranking ATM skimming as a "severe" or "very severe" threat, Inscoe says.

John Buzzard, fraud specialist at CO-OP Financial Services, a credit union network that provides ATM, card payment and mobile services, says detection of skimming at off-premises ATMs remains challenging.

"When skimming crews use fraudulent cards sporadically over a long period, it makes detection harder," Buzzard says. "This may explain the two-month distance from exposure to fraud. Keep in mind that circa 1999 it took an average of three months from skim to fraud, so we are sort of tone deaf to just how rapid these skimming cases blossom in today's world. Two months seems long, but I'm sure they were staggering their unauthorized withdrawals to evade detection."

Pascual says that's why ATMs managed and operated by third parties, outside the bank or credit union, are a top area of fraud concern. These ATMs are less likely to be inspected on a regular basis for skimming devices and/or other tampering relative to their bank-branch counterparts, he says.

"I wouldn't say that the security of hospital ATMs, in particular, is a significant concern for our issuer and bank clients but, rather, third-party ATMs in general," Pascual explains. "These ATMs are much more likely to suffer from physical and logical security issues, when compared to bank ATMs."

The continued use of magnetic-stripe debit cards, which can be easily skimmed, is a cause for concern, says William Murray, an independent financial fraud consultant. "While ATMs are being upgraded to EMV [chip] and a few banks are implementing "cardless/mobile, they continue to accept [information] on mag-stripes," he says. "There is no (U.S.) end-of-life plan for mag-stripe," because all EMV chip cards still retain magnetic-stripes, Murray adds.

"There is not even a plan for EMV-only cards," he says. "This vulnerability is likely to be around for a long time."