SoylentNews is people
SoylentNews
Fuze card is wide open to data theft over Bluetooth. A fix is on the way.
The makers of the programmable Fuze smart card say it's powerful enough to be your wallet in one card yet secure enough to be used the same way as traditional payment cards—including trusting it to restaurant servers when paying the bill. But it turns out that convenience comes with a major catch. A flaw makes it possible for anyone with even brief physical control of the card to surreptitiously siphon all data stored on the device.
Fuze representatives said they're aware of the vulnerability and plan to fix it in an update scheduled for April 19. They also thanked the two researchers who, independent of one another, discovered the vulnerability and privately reported it. So far, however, Fuze officials have yet to fully inform users of the extent of the risk so they can prevent private data stored on the cards from being stolen or tampered with until the critical flaw is repaired.
Mike Ryan, one of the two researchers, said he created attack code that impersonated the Android app that uses a Bluetooth connection to load credit card data onto the smart cards. While the official Fuze app takes care to prevent pairing with cards that have already been set up with another device, Ryan's rogue app had no such restrictions. As a result, it allowed him to take complete control of a card, including reading, changing, or adding payment card numbers, expiration dates, and card-verification values.
https://arstechnica.com/?p=1290811
-- submitted from IRC
(Score: 2) by TheRaven on Thursday April 12 2018, @06:40AM (2 children)
I'm guessing none of the projects that you worked on enjoyed widespread commercial success. The very first thing to get right is the UI. That's what makes people adopt your system. You can then worry about security later because it's depressingly rare for a product to fail in the market as a result of poor security.
sudo mod me up
(Score: 0) by Anonymous Coward on Thursday April 12 2018, @11:45AM
Proprietary software dev 101.
(Score: 2) by leftover on Thursday April 12 2018, @11:52PM
My part of the UI was a gimme: Insert card in slot. The initiatives failed because each of the 'partners' wanted all of the gains. Had the projects gone on, the POS terminal UIs would have been a big problem due in part to extreme variations in hardware capabilities.
The security design was central to getting approval from the Feds, which it did. Not a Dev 101 software project at all.
Bent, folded, spindled, and mutilated.