Kiosks Public Service Announcement – POS Terminals and PAX
Pax Cyber Heist
Originally from Krebs Oct 26
Updates:
-
- Statement from PAX Oct 27th (see below)
- PAX Security Executive Resigns a Day After FBI Raids on Offices
- American Banker
- “The Bloomberg Article” –Worldpay Switches to Verifone and Ingenico due to “unsatisfactory answers”. Worth noting fewer than 5% of Worldpay clients currently use PAX point-of-sale devices. – link
- 10/29 — PAX Technology announcement and resumption of trading — a bit of refutation of two articles: Krebs and “the bloomberg article”.
In Brief
- #1 it is still to be determined what has happened.
- PAX terminals are used widely in kiosk machines and all types of Point-Of-Sale
- Couple of financial providers in US and UK have started pulling the terminals
- Cyberheists are common. Think back to Target, Home Depot and Heartland
- Comes at a bad time with holiday season already in swing
- Additional speculation that PAX is a victim
Excerpt
U.S. federal investigators today raided the Florida offices of PAX Technology, a Chinese provider of point-of-sale devices used by millions of businesses and retailers globally. KrebsOnSecurity has learned the raid is tied to reports that PAX’s systems may have been involved in cyberattacks on U.S. and E.U. organizations.
Headquartered in Shenzhen, China, PAX Technology Inc. has more than 60 million point-of-sale terminals in use throughout 120 countries. Earlier today, Jacksonville, Fla. based WOKV.com reported that agents with the FBI and Department of Homeland Security (DHS) had raided a local PAX Technology warehouse.
In an official statement, investigators told WOKV only that they were executing a court-authorized search at the warehouse as a part of a federal investigation, and that the inquiry included the Department of Customs and Border Protection and the Naval Criminal Investigative Services (NCIS). The FBI has not responded to requests for comment.
Several days ago, KrebsOnSecurity heard from a trusted source that the FBI began investigating PAX after a major U.S. payment processor started asking questions about unusual network packets originating from the company’s payment terminals.
Other Speculation
- I believe we will find out that PAX was the victim of a cyber attack that leveraged vulnerabilities in the PAXSTORE to exploit the app marketplace and a subset of Android terminals. Vulnerabilities that PAX has at least made a concerted effort to patch long before the FBI ever started to investigate. Other than possible negligence, I believe PAX will be found to have not acted maliciously. Not only should PAX survive this ordeal, but it will cause them to strengthen the security of their Android platform and associated security protocols, and ultimately they and their partners and customers will be better off.
- May have something to do with geo-location. Perhaps a cloud connection fetching/providing to a non-standard cloud connection. With temperature detection devices using facial recog, it was documented that calls to Dahua server in China were in fact being performed. That sort of thing typically becomes action trigger for people like FBI.
Statement by PAX
Good evening,
Please see statement below from PAX Technology, Inc. regarding recent events:
On Tuesday, October 26, 2021, PAX Technology, Inc. in the United States was subject to an unexpected visit from the Federal Bureau of Investigation (FBI) and other government agencies relating to an apparent investigation.
PAX Technology is not aware of any illegal conduct by it or its employees and is in the process of engaging counsel to assist in learning more about the events that led to the investigation.
Separately, we are aware of media reports regarding the security of PAX Technology’s devices and services. PAX Technology takes security very seriously. As always, PAX Technology is actively monitoring its environment for possible threats. We remain committed to providing secure and quality software systems and solutions.
We intend to keep our team and customers apprised of the situation.
In the meantime, it is business as usual at our locations and operations are continuing as normal. The PAX Jacksonville office and warehouse are both open at this time.
-PAX Technology, Inc.
If you have any questions, please email me directly.
Thank you,
Related