Penetration Testing of Payment Devices

Ensuring robust security for payment systems and devices

THE CHALLENGES

Maintaining Compliance with Security Standards
Keeping up with evolving PCI DSS and other security standards is complex and time-consuming, causing fintech companies to struggle with compliance amidst emerging threats.

Uncovering Hidden Vulnerabilities
Even certified devices can harbor hidden vulnerabilities that companies might not have the expertise to identify and mitigate, leaving them susceptible to attacks.

Balancing Security with Operational Efficiency
Implementing robust security measures can disrupt payment processing systems, necessitating solutions that enhance security without compromising operational efficiency.

HOW PCAUTOMOTIVE CAN HELP YOU?

PCAutomotive, recognized for its specialized penetration testing of embedded systems, delivers tailored expertise to the fintech sector, offering sophisticated device analysis to enhance security and operational efficiency.

Our service thoroughly evaluates POS terminals, peripheral devices, PIN pads and ATMs. We conduct in-depth analyses of these systems, including those already certified under PCI DSS standards. Based on our experience, even certified devices often possess critical vulnerabilities and financial risks. Our rigorous testing methodology uncovers these hidden vulnerabilities, demonstrating that certification alone does not guarantee security.

001

The Service

OUR TARGETS

• Point of Sale (PoS) terminals

• Peripheral devices

• PIN pads

• ATMs

SERVICE GOAL

The PCAutomotive team simulates real-world attack scenarios to expose weaknesses in both hardware and software. This in-depth analysis identifies critical security gaps that require remediation, ultimately strengthening the integrity of transaction systems.

The objective of this service is to uncover and address security vulnerabilities, ensuring that these essential payment processing devices are robust against attacks. It confirms compliance with standards such as PCI DSS, reinforcing security measures and maintaining customer trust. Additionally, it minimizes the risk of financial fraud, damage to brand reputation, and financial losses for device manufacturers, businesses, and financial institutions.

BUSINESS BENEFITS

Enhanced Security and Risk Mitigation
Our service identifies and addresses security vulnerabilities, ensuring payment processing devices are robust against attacks. This minimizes the risk of financial fraud, preventing damage to brand reputation and reducing potential financial losses for device manufacturers, businesses, and financial institutions.

Regulatory Compliance and Customer Trust
By confirming compliance with standards such as PCI DSS, our service reinforces security measures, helping businesses meet necessary regulatory requirements. Strengthened security measures also help maintain and boost customer trust, ensuring clients feel confident in the safety of their transactions.

Cost Efficiency
Proactively addressing security issues can save significant costs associated with breaches, including legal fees, compensations, and system downtimes.

REAL-WORLD PENETRATION TESTING vs PCI DSS

Real-world penetration testing plays a crucial role in supplementing the Payment Card Industry Data Security Standard (PCI DSS) for several reasons. While PCI DSS provides a robust framework for securing card data and includes specifications for regular security assessments, it often focuses on compliance rather than thorough real-world security efficacy. Here's why real-world security testing is essential:

Beyond Compliance
Real-world testing challenges systems under actual attack scenarios, uncovering vulnerabilities that standard compliance checks may miss, providing a comprehensive understanding of security weaknesses.

Adaptability to Evolving Threats
Unlike static compliance standards, real-world testing is dynamic and adjusts to new threats, helping organizations stay ahead of attackers by regularly improving security measures.

Holistic Security View
Real-world testing includes a broader range of tests, such as social engineering and physical security breaches, ensuring organizations are secure in all aspects, not just on paper.

002

Our References

OUR CUSTOMERS

"As a financial service provider, security is a top priority at Adyen. Partners like PCAutomotive help us test the robustness of our payments platform."

About Adyen
Adyen (AMS: ADYEN) is the financial technology platform of choice for leading companies. By providing end-to-end payments capabilities, data-driven insights, and financial products in a single global solution, Adyen helps businesses achieve their ambitions faster. With offices around the world, Adyen works with the likes of Facebook, Uber, H&M, eBay, and Microsoft.

Proven experience of our team

Affected Products	CVEs
NCR S2 Dispenser controller	CVE-2018-5717
NCR S1 Dispenser controller	CVE-2017-17668
Verifone PoS terminals and peripherals	CVE-2019-14711 CVE-2019-14713 CVE-2019-14715 CVE-2019-14716 CVE-2019-14718 CVE-2019-14719
Ingenico PoS terminals and peripherals	CVE-2018-17766 - CVE-2018-17768 CVE-2018-17771 - CVE-2018-17774
PAX PoS terminals and peripherals	CVE-2020-28891 CVE-2020-28892 CVE-2020-29044

WHY PCAUTOMOTIVE?

Expertise
Our team possesses deep expertise, with proven records in penetration testing and security audits of embedded devices, including PoS terminals, ATMs, PIN pads, and peripherals.

Proven record of success

100+ security evaluations conducted.
50+ vulnerabilities found in 2023.

On-site center of expertise
Our CyberLab offers top-tier execution and privacy, specializing in identifying and mitigating security vulnerabilities in hardware devices. We provide services such as firmware extraction and reverse engineering, discovery of debugging interfaces, cryptographic key extraction and bypassing memory protections.

Contact us today to receive a non-binding offer for security testing of your payment device.

003

Fintech

Cybersecurity assessment services for payment providers, vendors of payment devices and their suppliers

Fintech