Thursday, August 11, 2022
Home Deals Hackers stole passwords for accessing 140,000 payment terminals

Hackers stole passwords for accessing 140,000 payment terminals

Hackers had access to dashboards used to remotely manage and control thousands of credit card payment terminals manufactured by digital payments giant Wiseasy, a cybersecurity startup told TechCrunch.

Wiseasy is a brand you might not have heard of, but it’s a popular Android-based payment terminal maker used in restaurants, hotels, retail outlets and schools across the Asia-Pacific region. Through its Wisecloud cloud service, Wiseeasy can remotely manage, configure and update customer terminals over the internet.

But Wiseasy employee passwords used for accessing Wiseasy’s cloud dashboards — including an “admin” account — were found on a dark web marketplace actively used by cybercriminals, according to the startup.

Youssef Mohamed, chief technology officer at pen-testing and dark web monitoring startup Buguard, told TechCrunch that the passwords were stolen by malware on the employee’s computers. Mohamed said two cloud dashboards were exposed, but neither were protected with basic security features, like two-factor authentication, and allowed hackers to access nearly 140,000 Wiseasy payment terminals around the world.

Payment systems are frequently targeted by financially driven hackers with the aim of skimming credit card numbers for committing fraud.

Buguard said it first contacted Wiseasy about the compromised dashboards in early July, but efforts to disclose the compromise were met with meetings with executives that were later canceled without warning, and according to Mohamed, the company declined to say if or when the cloud dashboards would be secured.

Screenshots of the dashboards seen by TechCrunch show an “admin” user with remote access to Wiseasy payment terminals, including the ability to lock the device and remotely install and remove apps. The dashboard also allowed anyone to view names, phone numbers, email addresses and access permissions for Wiseasy dashboard users, including the ability to add new users.

Another dashboard view also shows the Wi-Fi name and plaintext password of the network that payment terminals are connected to.

Mohamed said anyone with access to the dashboards could control Wiseasy payment terminals and make configuration changes.

When reached by TechCrunch, Wiseasy chief executive Jason Wang would not comment. In a separate email from Wiseasy spokesperson Ocean An, the company confirmed that the issues were remediated and that it had added two-factor authentication to the dashboards.

It’s not clear if the company plans to notify its customers of the security lapse.

- Advertisment -

Most Popular

Osborne Village pilot project using de-escalation tactics to help struggling, marginalized people

A new pilot project from the Osborne Village BIZ will be hitting neighbourhood streets beginning Wednesday evening to help people in marginalized situations. The SABE...

How Donald Trump changed Facebook

At one point in time, Facebook’s relationship with politicians was relatively uncontroversial. But after the 2016 US elections, everything changed. Early in the campaign, then-presidential candidate...

Microsoft claims Sony pays for ‘blocking rights’ to keep games off Xbox Game Pass

Microsoft has claimed Sony pays for “blocking rights” to stop developers from adding their content to Xbox Game Pass. The explosive claims are part...

New report takes deep dive into Canada’s growing PropTech sector

A recent report recommending massive change for the homebuilding industry reveals that upwards of C$1.5 billion has been invested in Canadian property technology (PropTech)...