While retailers battle breaches that have resulted in tens of millions of credit card numbers stolen, word comes from the RSA Conference in San Francisco that a major vendor of payment terminals has been shipping devices for over two decades with the same default password. The vendor wasn’t named by the researchers, David Byrne and Charles Henderson, but they did disclose the password: 166816. A Google search reveals that’s the default password for several models of credit card terminal sold by Verifone, a Silicon Valley-based vendor that says it connects 27 million payment devices and has operations in 150 countries. The researchers said that the password remains in use on nine out of 10 terminals they see from the vendor, in part because customers mistakenly assume it is unique to them. In a statement on Thursday, Verifone acknowledged that all its devices in the field came with the same default password, which the company said was Z66831. Over the years, the password has become known and can be found on the Internet along with instructions for programming terminals, Verifone said. “The important fact to point out is that even knowing this password, sensitive payment information or PII (personally identifiable information) cannot be captured,” Verifone said. “What the password allows someone to do is to configure some settings on the terminal; all executables have to be file signed, and it is not possible to enter malware just by knowing passwords.” The company said it strongly encourages customers to change the password and that new products come with a “pre-expired” password, which requires users to change it during installation and setup. The RSA Conference is a major annual event for the security industry and the comments of the two researchers were reported by The Register and SC Magazine. Such conferences are often used to highlight poor security practices or disclose how hackers are targeting systems. The hope is that by making such information more widely known, companies and users will be more alert to cybersecurity and change bad habits. Cybercriminals have been increasingly targeting vulnerabilities in point-of-sale terminals. The largest and best known of these was the hack of Target, which affected up to 70 million customers. A breach at Home Depot compromised the payment cards of up to 56 million customers, while systems have also been hacked at Neiman Marcus, White Lodging, Michaels and The UPS Store. In part because of these breaches, the payments industry in the U.S. is moving to chip-based cards, but researchers note the security on the cards isn’t bullet-proof and in part depends on the payment terminals and other systems at retailers. Martyn Williams covers mobile telecoms, Silicon Valley and general technology breaking news for The IDG News Service. Related content news North Korean hackers mix code from proven malware campaigns to avoid detection Threat actors are combining RustBucket loader with KandyKorn payload to effect an evasive and persistent RAT attack. By Shweta Sharma Nov 28, 2023 3 mins Malware feature How a digital design firm navigated its SOC 2 audit L+R's pursuit of SOC 2 certification was complicated by hardware inadequacies and its early adoption of AI, but a successful audit has provided security and business benefits. By Alex Levin Nov 28, 2023 11 mins Certifications Compliance news GE investigates alleged data breach into confidential projects: Report General Electric has confirmed that it has started an investigation into the data breach claims made by IntelBroker. By Shweta Sharma Nov 27, 2023 3 mins Data Breach opinion A year after ChatGPT’s debut, is GenAI a boon or the bane of the CISO’s existence? You can try to keep the flood of generative AI at bay but embracing it with proper vigilance is likely the best hope to maintain control and prevent the scourge of it becoming shadow AI. By Christopher Burgess Nov 27, 2023 6 mins Generative AI Data and Information Security Security Practices Podcasts Videos Resources Events SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe