Maior vulnerabilidade do PIX é o usuário, alertam especialistas


O PIX, novo sistema de pagamentos instantâneos do Banco Central (BC), começou a dar seus primeiros passos no Brasil. No entanto, alguns usuários ainda questionam a segurança da plataforma. Segundo especialistas, o maior risco não está na tecnologia em si, e sim no usuário. É o fator humano.A etapa de testes do PIX vai até o próximo dia 15. A partir do dia 16 de novembro, o sistema já entrará em funcionamento completo. Alternativa ao DOC e TED, o PIX é um sistema de pagamentos instantâneo, que funcionará todos os dias do ano e 24 horas por dia. Quem deseja utilizar a plataforma pode cadastrar e-mail, CPF ou número de celular como chave. Também é possível usar um identificador numérico único ou dados de agência e conta. Até o início de novembro, o sistema já tinha 60,6 milhões de chaves cadastradas, sendo 2,4 milhões para pessoas jurídicas e 58,2 milhões para pessoas físicas, segundo levantamento do BC.Especialistas em cibersegurança da BugHunt, plataforma brasileira de Bug Bounty (programa de recompensa por identificação de erros) e da Compugraf, provedora de soluções de segurança da informação e privacidade de dados, afirmam que, por ser uma forma simplificada de identificação, o PIX conta com as mesmas soluções de segurança do Sistema Financeiro Nacional (que servem também para DOC e TED). Além disso, as transações contam com camadas de segurança para autenticação oferecidas pelos próprios bancos dos dispositivos móveis, como reconhecimento facial e biometria.ReproduçãoO elo mais fraco a ser explorado por criminosos é o lado do usuário, segundo especialistas. Imagem: Nattakorn Maneerat/Shutterstock“Essas transações atuais, assim como o PIX, possuem controles rigorosos de cibersegurança, porém, isso não impede golpes e fraudes, visto que ainda resta o fator humano", explica Caio Telles, engenheiro de Software e CEO da BugHunt. "Então, a tendência é que ocorram tentativas de golpes e fraudes explorando as pessoas, e, por ser um serviço novo para todos, existe um risco direto associado”.O chefe de Cibersegurança da Compugraf, Denis Riviello, concorda com essa visão, e afirma que a principal vulnerabilidade do PIX está no elo mais fraco - o usuário. Isso envolve desde fraudes no cadastro das credenciais até roubo dos dados após o sistema estar em funcionamento. “Os bancos têm investido muito na nova plataforma, em termos de segurança, uma vez que possuem anos de experiência nesse setor e sabem como a criatividade dos fraudadores é grande", diz Riviello. "Porém, os cibercriminosos podem se aproveitar dos dados desta chave (CPF, e-mail e celular) para ludibriar os usuários”.ReproduçãoUsuários devem se atentar ao QR Code para não cair em golpes. Imagem: Divina Epiphania/ ShutterstockEm outras palavras, as falhas do PIX podem atingir clientes e instituições da mesma forma que outros serviços atingem atualmente. Segundo os especialistas, a maior parte dos golpes explora o lado do usuário, como invadir o computador e coletar informações da conta de alguém, por exemplo. “Os sistemas das instituições financeiras seguem rígidas regras de segurança, que são testadas e aprimoradas constantemente, o que torna muito improvável uma invasão ou dano diretamente no ambiente tecnológico da instituição, aumentando a vulnerabilidade no lado do usuário”, resume Telles.Com tantos mecanismos de segurança, os ataques partem para o usuário, que pode ser enganado e levado a um site fraudulento, com um QR Code de pagamento falso via PIX. “O QR Code é um atalho para a chave que identifica o dono da conta que irá receber o valor. Caso seja alterado por um QR Code de outra conta, o valor será disponibilizado em conta diferente", explica Telles. "É preciso estar atento às confirmações das informações e, sempre que perceber qualquer inconsistência, o usuário não deverá efetivar e confirmar qualquer pagamento”.Outro tipo de fraude pode acontecer durante o cadastro das chaves por meio de emails falsos e da captura da identidade das pessoas por meio de golpes, aproveitando-se do fator instantâneo da negociação. É o que acontece com os golpes de engenharia social aplicados atualmente.Para Telles, os bancos devem cuidar de seu ambiente tecnológico para evitar ataques e manter sua reputação e a privacidade de seus clientes. Riviello, por sua vez, recomenda aos usuários finais muita atenção ao compartilhar sua chave PIX e seus dados bancários. “Vale lembrar que as transações por meio do Pix são protegidas pela Lei n° 105/2001, do Sigilo Bancário, e também a Lei Geral de Proteção de Dados (n° 13.709/2018)”, conclui ele.

from Olhar Digital :: Segurança https://ift.tt/36sCmo0

Comments

Post a Comment

Popular posts from this blog

AR18-312A: JexBoss – JBoss Verify and EXploitation Tool

Image
Original release date: November 08, 2018 Summary JBoss Verify and EXploitation tool (JexBoss) is an open-source tool used by cybersecurity hunt teams (sometimes referred to as “red teams”) and auditors to conduct authorized security assessments. Threat actors use this tool maliciously to test and exploit vulnerabilities in JBoss Application Server (JBoss AS)—now WildFly—and a variety of Java applications and platforms. JexBoss automates all the phases of a cyberattack, making it a powerful and easy-to-use weapon in a threat actor’s cyber arsenal. This report provides a detailed analysis of JexBoss’ functionality, along with detection, response, prevention, and mitigation recommendations. Description JexBoss JexBoss is a tool used to test and exploit vulnerabilities in Java applications and platforms, including the JBoss AS/WildFly web server framework. JexBoss is written in the Python programming language using standard Python libraries. JexBoss is run from the command-line inter...
Keep reading

SB18-141: Vulnerability Summary for the Week of May 14, 2018

Original release date: May 21, 2018 The US-CERT Cyber Security Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. The NVD is sponsored by the Department of Homeland Security (DHS) National Cybersecurity and Communications Integration Center (NCCIC) / United States Computer Emergency Readiness Team (US-CERT). For modified or updated entries, please visit the NVD , which contains historical vulnerability information. The vulnerabilities are based on the CVE vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores: High - Vulnerabilities will be labeled High severity if they have a CVSS base score of 7.0 - 10.0 Medium - Vulnerabilities will be labeled Medium severity ...
Keep reading

SB18-029: Vulnerability Summary for the Week of January 22, 2018

Original release date: January 29, 2018 The US-CERT Cyber Security Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. The NVD is sponsored by the Department of Homeland Security (DHS) National Cybersecurity and Communications Integration Center (NCCIC) / United States Computer Emergency Readiness Team (US-CERT). For modified or updated entries, please visit the NVD , which contains historical vulnerability information. The vulnerabilities are based on the CVE vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores: High - Vulnerabilities will be labeled High severity if they have a CVSS base score of 7.0 - 10.0 Medium - Vulnerabilities will be labeled Medium sever...
Keep reading

Learn Python Programming – 7 Courses Video Training Bundle

Image
It's no secret that learning how to code is one of the most important things you can do when it comes to the beginning or furthering practically any career in programming and technology. The only problem a beginner often faces is that there are seemingly countless programming languages to choose from, which makes it exceedingly difficult for aspiring or even seasoned programmers to know which from The Hacker News http://bit.ly/2Ug9eJ8
Keep reading

SB18-043: Vulnerability Summary for the Week of February 5, 2018

Original release date: February 12, 2018 The US-CERT Cyber Security Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. The NVD is sponsored by the Department of Homeland Security (DHS) National Cybersecurity and Communications Integration Center (NCCIC) / United States Computer Emergency Readiness Team (US-CERT). For modified or updated entries, please visit the NVD , which contains historical vulnerability information. The vulnerabilities are based on the CVE vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores: High - Vulnerabilities will be labeled High severity if they have a CVSS base score of 7.0 - 10.0 Medium - Vulnerabilities will be labeled Medium seve...
Keep reading

SB18-057: Vulnerability Summary for the Week of February 19, 2018

Original release date: February 26, 2018 The US-CERT Cyber Security Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. The NVD is sponsored by the Department of Homeland Security (DHS) National Cybersecurity and Communications Integration Center (NCCIC) / United States Computer Emergency Readiness Team (US-CERT). For modified or updated entries, please visit the NVD , which contains historical vulnerability information. The vulnerabilities are based on the CVE vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores: High - Vulnerabilities will be labeled High severity if they have a CVSS base score of 7.0 - 10.0 Medium - Vulnerabilities will be labeled Medium seve...
Keep reading

SB18-008: Vulnerability Summary for the Week of January 1, 2018

Original release date: January 08, 2018 The US-CERT Cyber Security Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. The NVD is sponsored by the Department of Homeland Security (DHS) National Cybersecurity and Communications Integration Center (NCCIC) / United States Computer Emergency Readiness Team (US-CERT). For modified or updated entries, please visit the NVD , which contains historical vulnerability information. The vulnerabilities are based on the CVE vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores: High - Vulnerabilities will be labeled High severity if they have a CVSS base score of 7.0 - 10.0 Medium - Vulnerabilities will be labeled Medium sever...
Keep reading

Vulnerability Summary for the Week of March 2, 2020

Original release date: March 9, 2020 The CISA Weekly Vulnerability Summary Bulletin is created using information from the NIST NVD . In some cases, the vulnerabilities in the Bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available.   High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info apple -- multiple_products   A denial of service issue was addressed with improved input validation. 2020-02-28 7.8 CVE-2019-8741 MISC MISC MISC MISC MISC MISC MISC centreon -- centreon   An issue was discovered in Centreon before 2.8.30, 18.10.8, 19.04.5, and 19.10.2. SQL Injection exists via the include/monitoring/status/Hosts/xml/hostXML.php instance parameter. 2020-03-05 7.5 CVE-2019-17647 CONFIRM CONFIRM CONFIRM MISC CONFIRM CONFIRM centreon -- centreon   Centreon 19.10 allows remote authen...
Keep reading

LibSSH Flaw Allows Hackers to Take Over Servers Without Password

Image
A four-year-old severe vulnerability has been discovered in the Secure Shell (SSH) implementation library known as Libssh that could allow anyone to completely bypass authentication and gain unfettered administrative control over a vulnerable server without requiring a password. The security vulnerability, tracked as CVE-2018-10933, is an authentication-bypass issue that was introduced in from The Hacker News https://ift.tt/2NJHOaM
Keep reading

Vulnerability Summary for the Week of October 19, 2020

Original release date: October 26, 2020 The CISA Weekly Vulnerability Summary Bulletin is created using information from the NIST NVD . In some cases, the vulnerabilities in the Bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available.   High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info acronis -- cyber_backup Acronis Cyber Backup 12.5 and Cyber Protect 15 include an OpenSSL component that specifies an OPENSSLDIR variable as a subdirectory within C:\jenkins_agent\. Acronis Cyber Backup and Cyber Protect contain a privileged service that uses this OpenSSL component. Because unprivileged Windows users can create subdirectories off of the system root, a user can create the appropriate path to a specially-crafted openssl.cnf file to achieve arbitrary code execution with SYSTEM privileges. 2020-10-21 7.2 CVE-2020-10138 ...
Keep reading