Cybercriminals Scouting for Vulnerabilities in Apple Pay: Trend Micro

Even though no actual attacks on Apple Pay have been reported yet, Trend Micro's 'Security Prediction for 2015 and Beyond' warned that cybercriminals will increase attacks on mobile payment systems.

"It's safe to assume that as early as now, the bad guys are already looking for vulnerabilities to exploit in Apple Pay. They will continue to scrutinise NFC (Near Field Communications) as well," Trend Micro said.

Apple Pay is a mobile payment and digital wallet service by Apple Inc. It lets certain Apple mobile devices make payments at retail and online checkout.

Trend Micro said though it is yet to see actual attacks and attempts to breach Apple Pay ecosystem comprising of NFC and Passbook (which holds users' card information), cybercriminals used the latest iPhones as social engineering bait two months before they were even launched.

"We will see new threats specifically target mobile payment platforms in the next few months akin to the Android FakeID vulnerability, which allowed cybercriminals to steal affected users' Google Wallet credentials," it said.

According to Apple website, Apple Pay is "more secure" than using a traditional credit or debit card as card number and identity aren't shared with the merchant, and actual card numbers aren't stored on Apple device or on Apple servers.

Trend Micro VP (Technology and Solutions) JD Sherry said the payment ecosystem will continue to evolve.

"Massive transformation is upon us and we will continue to see threat actors trying to manipulate NFC as certain platforms gain momentum due to their significant following and user's penchant for adopting the latest and greatest technology," Sherry added.

The report also added that targeted attack campaigns will continue to multiply in 2015, after cybercriminals had noteworthy breaches via targeted attacks in the US and China.

"Trend Micro's threat defence experts predict hackers within countries such as Vietnam, the UK and India will pursue the use of targeted attacks and we will see attacks against non-traditional countries like we've seen recently against Malaysia and Indonesia based organisations," it added.

Besides, threats around banking will continue to become more severe as more unique cybercrime attacks against financial institutions emerge, the report said.