Square's Vulnerability Revealed

Researchers at a security conference demonstrated how the card payment gadget could be used to hack or accept stolen credit card data.

August 08, 2011

NEW YORK - Researchers at a security conference last week demonstrated two ways that Square, a mobile gadget that enables Android, iPhone, iPad and iPod touch users to accept credit card payments, can be hacked to accept stolen credit card data, "with very little technical hardware required and 'no technical skills at all,€™" writes Mashable.com.

Adam Laurie and Zac Franken, directors of Aperture Labs, showed how a lack of encryption in the current Square app and the free dongle (a hardware device that allows access to wireless broadband or use of protected software) for swiping cards allows the mobile payment system to be used to steal credit card information, "without even having the physical credit card," writes the news source.

Square converts credit card data into an audio file that is transmitted to the credit card issuer for authorization. The duo also pulled money from a Visa gift card, in which cashing out is not officially permissible.

Franken noted that Square is due for an update and that the company is planning to release new software that will encrypt credit card data, notes the news source.

Advertisement
Advertisement
Advertisement