Forest Global Training Partners

Cyber Risks · Krebs on Security

‘Security by Antiquity’ Bricks Payment Terminals

Summary: Several thousand Hypercom L4250 payment terminals at U.S. retailers stopped working on Dec. 7, 2014, when a cryptographic certificate created in 2004 with a 10-year expiry date lapsed, according to Equinox Payments, which owns the Hypercom brand. Equinox's Stuart Taylor said the security mechanism was triggered by the date rollover and not by any attack or breach, and that some terminals cannot be fixed in the field and must be sent to a repair facility.

Why it matters: Merchants who power-cycled terminals overnight found them blank and inoperative, and one retailer reported technicians spent three days trying to restore devices, with no advance warning from the vendor. A certificate with a known expiry date took out payment acceptance across the country without a single attacker involved.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related