Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

9/11/2014
01:00 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

Apple Pay: A Necessary Push To Transform Consumer Payments

Apple Pay is a strategic move that will rival PayPal and other contenders in the mobile wallet marketplace. The big question is whether consumers and businesses are ready to ditch the plastic.

On Tuesday, Apple announced an exciting new feature, Apple Pay, a mobile wallet payment system available on the new iPhone 6 and Apple Watch devices. My initial reaction to the announcement was "Not another mobile wallet option!" After researching implementation details, my attitude quickly changed and I became intrigued.

Apple Pay enables a safe and secure transaction between Apple devices and a retailer’s contactless payment reader or online storefront. The consumer avoids the tedious step of swiping or entering credit card numbers or passwords since it's already stored in Passbook, an application first introduced in iOS 6.

What’s important is how Apple Pay transforms traditional theft-prone credit cards into a unique Device Account Number stored securely on a special chip in the device. It then pairs that number with transaction-specific dynamic security codes. This ensures that intercepted transactions cannot be used to conduct fraud, because each security code is only good for the one transaction. This is the most obvious benefit, similar to the protections in place with EMV: to prevent the chips from being copied.

Another less obvious security benefit Apple Pay has over EMV is that sensitive card data is never handled by the merchant. As demonstrated in my recent Black Hat USA presentation, EMV passes plain-text card data to point-of-sale systems, which can later be stolen by RAM scrapers and used to commit fraud. With Apple Pay, the physical phone becomes the sole point for potential exploitation. Hopefully, Apple has implemented significant and sophisticated measures into protecting card data stored in the iPhones' Passbook from theft or unauthorized use. Regardless, removing sensitive payment data from the merchants’ hands is a necessary step to solve the increased breach epidemic retailers have been facing.

What’s especially bold is Apple’s move to bypass the payment processors that have been used for decades. POS and online ordering systems integrated to support Apple Pay can send the Device Account Number and the dynamic transaction security code directly to the card issuer for approval. In essence, Apple is creating its own secure payment network to facilitate its proprietary payment technology.

Long history of failure
Unfortunately, adoption will be a significant challenge. If you look at past attempts to change consumer payment behavior, there’s a long list of failures. For example, contactless payments were rolled out on a limited basis by inserting a rice-sized RFID chip in credit cards a purchaser waves in front of the terminal instead of swiping the magnetic stripe. Adoption in the United States was abysmal. More recently, mobile wallet offerings such as Visa payWave used NFC for contactless payments in stores, but gained little traction beyond pilot implementations.

Apple Pay is a strategic move to expand further into the major mobile wallet marketplace to rival PayPal and other contenders. The big question is whether Apple can succeed in convincing consumers and businesses to ditch the plastic. They both need compelling benefits to justify the behavioral changes. For example, Starbucks successfully leveraged its mobile application with payment capabilities to enhance the customer experience and drive its loyalty program.

One way Apple could incentivize adoption is by providing loyalty points for purchases made using Apple Pay, redeemable in the form of Apple Store purchases. Consumers would get rewarded for making the switch while driving increased traffic to the Apple stores. This in turn would generate demand for merchants to support Apple Pay. Finally, by eliminating the payment processors from the transaction flow, retailers would reap greater benefits with lower processing fees and increased cost savings that yield higher profits.

If successful, Apple Pay would cement Apple’s dominance across the user experience and extend its domain to mobile payments where the biggest potential is in the rapid adoption of m-commerce, defined as shopping online from handheld devices. Forrester Research projects m-commerce in the United States to top $293 billion by 2018.

Lucas Zaichkowsky is the Enterprise Defense Architect at AccessData, responsible for providing expert guidance on the topic of cyber security. Prior to joining AccessData, Lucas was a technical engineer at Mandiant where he worked with Fortune 500 organizations, the Defense ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Page 1 / 2   >   >>
dkoobfhlbc
100%
0%
dkoobfhlbc,
User Rank: Apprentice
9/11/2014 | 1:52:20 PM
The entire article falls apart at "Hopefully"
From the article:

"Hopefully, Apple has implemented significant and sophisticated measures into protecting card data stored in the iPhones' Passbook from theft or unauthorized use. Regardless, removing sensitive payment data from the merchants' hands is a necessary step to solve the increased breach epidemic retailers have been facing."

 

If Apple cant keep private data (pictures and backups safe) what makes you think they can keep your personal finance information safe?

Lets all jump on the Apple bandwagon as quick as humanly possible because Apple can do no wrong, or when they do - its no big deal.

I understand this puts progress in a crux and I don't have a perfect answer - but I fear for the sheeple that will blindly follow and potentially expose themselves to risk of giving up their credit card information. 
anon7578423912
50%
50%
anon7578423912,
User Rank: Apprentice
9/11/2014 | 4:41:51 PM
Re: The entire article falls apart at "Hopefully"
We're already at risk of credit card data theft. I have an iPhone, and I'd rather pay via Apple Pay or similar service than hand out my card to all kinds of merchants out there. I have actually being carrying more cash on hand lately with all the security breaches going on.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
9/11/2014 | 8:47:17 PM
Two-factor
I like the article, thanks for sharing it. I will most likely use Apple Pay simply because it is convenient. However we should not assume that the solution is secure enough that we feel comfortable. Keep in mind that the credit card itself provides two-factor authentication and unconnected, our iPhones may not provide the same capabilities because it is connected.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
9/11/2014 | 8:49:36 PM
Re: The entire article falls apart at "Hopefully"
I agree, handing over the credit card would more risky than using NFC with your iPhone.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
9/11/2014 | 8:53:35 PM
Re: The entire article falls apart at "Hopefully"
I hear you, I would think they would either hash or encrypt data at rest. They would not be able take a risk of credit card numbers being compromised. This is more regulated than the pictures we uploaded to iCloud which nobody really cares unless you are a celebrity.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
9/12/2014 | 7:46:20 AM
Device Account Number
Lucas, I really like this concept and it sounds very promising, but I'm not sure I totally understand how it works. So, for each transaction, Apple Pay creates a unique "Device Account Number" that is stored in the SIM card in your iPhone. But where does the Device Account Number come from? From the card company?
LucasZa
50%
50%
LucasZa,
User Rank: Moderator
9/12/2014 | 3:52:06 PM
Re: Device Account Number
Marilyn, the Device Account Number is a permanent unique identifier for the mobile device. I'm not sure if it's randomly generated or derived from seed data. Either way, that Device Account Number gets stored on the "Secure Element" chip they've added to the iPhone 6. This is their way of implementing the Secured Element part of the NFC specification. More info at www.smartcardalliance.org/publications-nfc-frequently-asked-questions/#7

When it comes time to pay, the iPhone 6 will use NFC to transmit the Device Account Number and a a unique transaction identifier to the POS using those contactless readers that nobody in America currently cares about. This is where it gets a little vague. Prior reports talked about the elimination of the payment processor middleman. The merchant POS has to send the transaction data somewhere though. So I'd assume they're sending it through Apple servers which then authenticate the transaction with the card issuing bank before processing it through the appropriate card brand network such as Visa. Think of the transaction identifier as being an out of band mechanism so criminals can't leverage stolen data from Apple Pay transactions since they'd need another transaction identifier. I'm guessing the transaction identifiers are generated similar to how Google Authenticator and RSA two-factor have a rolling code that's constantly in sync with the server.

My guess that Apple is in the middle relaying transaction data stems from their careful choice in wording when they state they "don't save" your transaction data. They're choosing their words carefully to hide the complex inner workings behind a simpler message that doesn't require niche payment processing knowledge.
LucasZa
50%
50%
LucasZa,
User Rank: Moderator
9/12/2014 | 4:02:08 PM
Speaking of security...
I agree with those concerned about security flaws. It is possible that someone could figure out a way to retrieve the stored card data from the Secure Element chip. Passbook uses an iOS API to access that chip. If there's a weakness in protecting that API, then that could lead to apps being deployed to the Apple store that steal stored cards or malicious websites that use another vulnerability to gain initial access (e.g. jailbreaking techniques), then exploit the API flaw to steal card data. Or perhaps there's a way criminals could conduct fraud if they get on Apple's servers relaying transaction data. What if they managed to get the seed data used to generate the unique transaction identifiers? Lots of possibilities.

I also agree with those that state it's still more secure than using magstripe or EMV. Nothing is perfectly secure, so choosing the option with the least attack surface area makes sense. Unfortunately, most people don't care enough about security to ditch the plastic. They need some sort of gratification to change behavior.
SDiver
100%
0%
SDiver,
User Rank: Strategist
9/15/2014 | 12:21:13 PM
Re: The entire article falls apart at "Hopefully"
dkoobfhlbc, your comments provide no useful insight.

Yes, Apple's iCloud was breached but so has Android and Google Wallet.  In fact, name any system that is 100% foolproof so what's your beef with Apple?  Are Android users "sheeple" too or should Google be solely responsible for determining our security needs?

We have yet to see the reliability of Apple's new payment system.  Obviously, this new system will have flaws just like any other system but if you're so concerned about the "sheeple" putting their credit card numbers at risk then I invite you to:  1) please provide detailed information WHY Apple Pay is so weak; and 2) name the perfect payment system that you have obviously discovered which the rest of us have missed.
dkoobfhlbc
50%
50%
dkoobfhlbc,
User Rank: Apprentice
9/15/2014 | 12:36:57 PM
Re: The entire article falls apart at "Hopefully"
I'm not trying to nitpick at why Apple Pay is completely insecure. What really irks me is that NFC payment has been around for YEARS. Yes its constantly evolving and becoming better and stronger and faster and more secure. What really makes me groan is when Apple 'creates' a feature that the masses think is brand new and 'revolutionary' when they're merely taking a technology they did not invent slapping a pretty face on it and calling it their own. While this is great for the recognition of the technology a wider attack vector means it'll just be the next big thing that is hacked.

 

Furthermore - I was initially upset that the author of this article chose to use the word 'hopefully' when describing the 'greatest technology company in the world's approach to payment security. I would have much rather the author done a little more investigation and added some substance to the article to describe why Apple Pay should be adopted and why it's more secure than other NFC payment vendors.

 

Finally - nowhere in my original comment did I mention I was pro Android/ Goole or Microsoft or Blackberry or any other vendor for that matter. I did not say any other vendor is more secure or has fewer flaws than Apple - I'm just upset that Apple's wrongdoings are so quickly forgotten when they introduce something new and shiny. Why the specific Google hate? Defensive much?

Last I checked - nobody's had their identity stolen, been asked for an ID or had their credit ruined when paying in cash.
Page 1 / 2   >   >>
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/10/2020
Pen Testers Who Got Arrested Doing Their Jobs Tell All
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/5/2020
Researcher Finds New Office Macro Attacks for MacOS
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/7/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-7029
PUBLISHED: 2020-08-11
A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the System Management Interface Web component of Avaya Aura Communication Manager and Avaya Aura Messaging. This vulnerability could allow an unauthenticated remote attacker to perform Web administration actions with the privileged ...
CVE-2020-17489
PUBLISHED: 2020-08-11
An issue was discovered in certain configurations of GNOME gnome-shell through 3.36.4. When logging out of an account, the password box from the login dialog reappears with the password still visible. If the user had decided to have the password shown in cleartext at login time, it is then visible f...
CVE-2020-17495
PUBLISHED: 2020-08-11
django-celery-results through 1.2.1 stores task results in the database. Among the data it stores are the variables passed into the tasks. The variables may contain sensitive cleartext information that does not belong unencrypted in the database.
CVE-2020-0260
PUBLISHED: 2020-08-11
There is a possible out of bounds read due to an incorrect bounds check.Product: AndroidVersions: Android SoCAndroid ID: A-152225183
CVE-2020-16170
PUBLISHED: 2020-08-11
The Temi application 1.3.3 through 1.3.7931 for Android has hard-coded credentials.