Attacks/Breaches
7/21/2014
02:00 PM
Connect Directly
Twitter
Twitter
RSS
E-Mail
50%
50%

Don't Overestimate EMV Protections, Underestimate Card Thief Sophistication

At Black Hat, an AccessData researcher will offer up a crash course in card payment tech and protections to root out security community misconceptions

Even in the wake of massive breaches and losses from credit card merchants and processors, many security practitioners today still hold a lot of misconceptions about how credit card processing systems and protection mechanisms work. Next month at Black Hat, one researcher plans to hold a crash course for security professionals that debunks some commonly held fallacies and clears up why card thieves have been so successful even as card security awareness has risen in the era of PCI.

"I'd say the biggest misconceptions in the security community [are] an overestimation of the protection that EMV provides, an underestimation of the skill of the attackers and a lack of understanding about how many systems that card data passes through when they're processed that are vulnerable to interception of data," says Lucas Zaichkowsky, enterprise defense architect for the forensics and security firm AccessData, who will lead a talk on point-of-sale (POS) architecture and security.

In particular, Zaichkowsky will dedicate a significant chunk of time in his briefing discussing EMV chips, the successor to the traditional magnetic stripes; EMV was introduced in recent years to lower the rate of card fraud.

"Everyone talks about how EMV will save the day, but the truth is that the primary purpose of EMV is just to make it so that the card cannot be cloned. When you do an EMV read of a card on a POS terminal, it will pass your card number and expiration in plain text, your name in plain text," he says, "and even the track two data is almost exactly the same as a mag stripe card, with the only difference being that three-digit CVV code in the middle of the track data."

As he explains, that's not a flaw or an exploitation, it is just how it works by design. To demonstrate this, he'll plan on doing live demos during his talk of magnetic card swipes compared to EMV card swipes and how they look on the back end.

"This is not some kind of big vulnerability that no one knows about," he says. "The proponents of EMV either don't understand it or they're some special interest group that's pushing it through because that's their job and they just kind of skirt around telling people that by the way, you should encrypt this stuff because it has the card number and expiration data in plain text."

He'll also offer up some visual charts of how the data flow works, from USB-powered card reader to POS terminal, to back-end store servers, to processing company systems and HSM modules, to card company systems and finally to banks, and all the way back through the chain again that data must flow through in order for a card to be processed for any given transaction. Through that explanation, he'll point out the weakest points in the ecosystem and sometimes even some strong points that security professionals may not be aware of. For example security pros may not know that PIN pad devices are actually extremely secure on the merchant side because that data is strongly encrypted and the keys are not stored with the merchant but instead are in a hardware security module (HSM) held by the card processor.

However, if attackers can find a way to attack that card processor's HSM, they may hold keys for all of the merchant PIN data held by the processor.

And that's often the exact tack that many sophisticated card-thieving criminals will take, illustrating one of Zaichkowsky's other big points of the briefing. A good example of how this can happen is the breach at RBS Worldpay, where attackers brute-force attacked the HSM there to gain access to PINs processed for customers.

"These criminals understand all this stuff and how these payment system components interoperate," he says. "They get how these HSMs are designed, they'll get the manuals for these components, read them, program to them and they understand point-of-sale environments very well. They're highly skilled and they know what they're doing."

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
catvalencia
50%
50%
catvalencia,
User Rank: Apprentice
7/25/2014 | 2:05:52 AM
Re: correcting the point of sale terminal and system
Now that debit card and credit card spending is growing; the door is open for more fraud and consumers are warned to be careful with what locations they use to withdraw money and pay for items. To protect you from ATM skimming is to watch bank accounts vigilantly. Federal law limits liability for fraud on a debit-card to $50, but only if the lost card or theft is reported within two days of the problem. If you don't report it in time, unauthorized charges could be your responsibility.
macker490
50%
50%
macker490,
User Rank: Ninja
7/23/2014 | 7:44:02 AM
correcting the point of sale terminal and system
Fixing the Point of Sale Terminal (POST)

THINK: when you use your card: you are NOT authorizing ONE transaction: you are giving the merchant INDEFINITE UNRESTRICTED access to your account.

if the merchant is hacked the card numbers are then sold on the black market. hackers then prepare bogus cards -- with real customer numbers -- and then send "mules" out to purchase high value items -- that can be resold

it's a rough way to scam cash and the "mules" are most likely to get caught -- not the hackers who compromised the merchants' systems .


The POST will need to be re-designed to accept customer "Smart Cards"

The Customer Smart Card will need an on-board processor, -- with PGP

When the customer presents the card it DOES NOT send the customer's card number to the POST.  Instead, the POST will submit an INVOICE to the customer's card.  On customer approval the customer's card will encrypt the invoice together with authorization for payment to the PCI ( Payment Card Industry Card Service Center ) for processing and forward the cipher text to the POST

Neither the POST nor the merchant's computer can read the authorizing message because it is PGP encrypted for the PCI service.  Therefore the merchant's POST must forward the authorizing message cipher text to the PCI service center.

On approval the PCI Service Center will return an approval note to the POST and an EFT from the customer's account to the merchant's account.

The POST will then print the PAID invoice.  The customer picks up the merchandise and the transaction is complete.

The merchant never knows who the customer was: the merchant never has ANY of the customer's PII data.

Cards are NOT updated.  They are DISPOSABLE and are replaced at least once a year -- when the PGP signatures are set to expire.  Note that PGP signatures can also be REVOKED if the card is lost.

Transactions are Serialized using a Transaction Number ( like a check number ) plus date and time of origination.    This to prevent re-use of transactions.   A transaction authorizes one payment only not a cash flow.

~~~
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-4594
Published: 2014-10-25
The Payment for Webform module 7.x-1.x before 7.x-1.5 for Drupal does not restrict access by anonymous users, which allows remote anonymous users to use the payment of other anonymous users when submitting a form that requires payment.

CVE-2014-0476
Published: 2014-10-25
The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows local users to execute arbitrary code via a Trojan horse executable. NOTE: this is only a vulnerability when /tmp is not mounted with the noexec option.

CVE-2014-1927
Published: 2014-10-25
The shell_quote function in python-gnupg 0.3.5 does not properly quote strings, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "$(" command-substitution sequences, a different vulnerability than CVE-2014-1928....

CVE-2014-1928
Published: 2014-10-25
The shell_quote function in python-gnupg 0.3.5 does not properly escape characters, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "\" (backslash) characters to form multi-command sequences, a different vulner...

CVE-2014-1929
Published: 2014-10-25
python-gnupg 0.3.5 and 0.3.6 allows context-dependent attackers to have an unspecified impact via vectors related to "option injection through positional arguments." NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.