Feds execute search warrant on Chinese POS giant; PAX Technology issues response
KrebsOnSecurity reported that U.S. federal investigators on Oct. 26 raided the Florida offices of PAX Technology Inc., a Chinese provider of point-of-sale devices widely used on kiosk equipment globally.
Headquartered in Shenzhen, China, PAX has more than 60 million POS terminals in use in 120 countries. The raid at PAX’s Florida office was tied to reports that its systems might have been involved in cyberattacks on U.S. and EU organizations.
A post by the security investigative organization alleged: “KrebsOnSecurity heard from a trusted source that the FBI began investigating PAX after a major U.S. payment processor started asking questions about unusual network packets originating from the company’s payment terminals.
“According to that source," the report continued, "the payment processor found that the PAX terminals were being used both as a malware -dropper’ – a repository for malicious files - and as “command-and-control” locations for staging attacks and collecting information."
Go here to read the full Krebs report.
Responding to the Krebs report and another by Bloomberg, PAX Technology issued a press release on Oct. 29 stating that the KrebsOnSecurity article “did not provide particulars of any such ‘reports’. It only referred to a secondhand hearsay quote from the ‘source’ of the writer that referred to other unnamed sources that “there is tech proof of the way that the terminals were used in attack ops.”
The announcement continued:
"[PAX Technologies'] products and services are subject to, and are certified to be compliant with, the Payment Card Industry (PCI) compliance standards and all relevant laws and mandatory regulations of countries worldwide. They are therefore designed to achieve the requisite industry standards for certain cybersecurity (including online security in connection with malicious software). Similar to other reputable industry peers, the Group has always taken, and continues proactively to take, the initiative to enhance security standards of its products both generally and in collaboration with its customers and external third-party test laboratories to carry out product certifications, software penetration testing and other stringent security-related controls, where appropriate, carry out necessary fixing and mitigating measures in a timely manner."
PAX’s Florida office has resumed normal operations.
