Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Target Breach: Why Smartcards Wont Stop Hackers
Newest First  |  Oldest First  |  Threaded View
<<   <   Page 2 / 3   >   >>
jagibbons
50%
50%
jagibbons,
User Rank: Strategist
1/26/2014 | 8:55:37 AM
Re: Smart cards won't stop hackers - but they remove the incentive
Online fraud typically only includes the primary account number and the CVV code. However, one-time use credit cards can resolve that issue. Moving to EMV for card-present payments and bank-supported disposable one-time use card numbers for online purchases may combine to be the safest solution.
moarsauce123
50%
50%
moarsauce123,
User Rank: Ninja
1/25/2014 | 8:38:14 AM
Re: Exempted from PCI Compliance?
It doesn't, but that was the outcome of a court case with a settlement approved by a judge. Judges are experts in law, but understandably lack the knowledge of many areas they have to decide on. My guess it was the same in this case. Just look at the many tech patent cases, the verdicts often lack any common sense and typically do not take long term impact into account. It is difficult for a court to find the fine line between acting upon law versus making new laws and political policy decisions.
moarsauce123
50%
50%
moarsauce123,
User Rank: Ninja
1/25/2014 | 8:34:07 AM
Re: When can we expect better online use of chipped cards?
As with many things, it is a matter of price but even more so the US typical "not invented here" syndrome. Something that works great in Europe and Asia can by no chance work in the US. For that reason we still endure Never The Same Color TV broadcasts, wall outlets that by design are an electrocution hazard, expensive consumer satellite TV service (no extra charge for Europe on the Astra and Eutelsat systems), slow broadband at twice the price, frequent power outages, new roads that need fixing one year later....the list is long and for every issue there is already an established and proven solution that may cost a bit more upfront, but saves everyone tons of money in the long run. But since it is not invented here or no longer hip with the conservative crowd (e.g. high speed rail and favroing rail freight over trucks) it will never get introduced in the US unless there are constantly high price failures. Another example? Sure, rail cars for oil transport! Since decades much safer rail cars are available and proven to be effective protection in derailments. But I guess for the US it is cheaper to have the few dozen people die and half a town get burned down than spend the money on safety. And in regards to payment security, just look how great TJX is doing. They survived the biggest credit card data breach in history and it was nothing more than a footnote in an annual report. It seems as if one is looking for common sense they need to move away from the US.
moarsauce123
50%
50%
moarsauce123,
User Rank: Ninja
1/25/2014 | 8:24:11 AM
Re: Smart cards won't stop hackers - but they remove the incentive
Actually, the chip data can be counterfeited, but at a tremendously larger effort than coding a 1 cent mag stripe card. That might just be sufficient to make it not worth while the effort at least for in person purchases. Online fraud would be the preferred option as the numbers clearly show. The alternative approval process as some advertise now would be one option, but even that could be compromised as long as hackers accummulate enough intel on a person. And it puts the burden on the consumer who not only has to do more without getting any more protection (with or without the consumer is only liable for 50$ of a fraudulent transaction) and it requires expensive smartphones with as expensive data plans.
moarsauce123
50%
50%
moarsauce123,
User Rank: Ninja
1/25/2014 | 8:16:46 AM
It all comes down to money
As soon as a breach of the Target scale will be generating so many damage claims and fines that it would even put a big retailer out of business the EMV systems are in place within months. Both the card industry and retailers consider it cheaper to pay the damages and some petty fines in these cases, but otherwise not care if it ruined the lives of thousands of families.

The discussion is a bit misguided if the EMV systems are not as secure as they seem. The card industry and retailers should seek cases like Target as the opportunity for a positiive campaign and design and implement the most secure payment system ever. But I guess Target will be flip flopping on that as well, Target just sucks.
pabbott782
50%
50%
pabbott782,
User Rank: Apprentice
1/24/2014 | 7:45:35 PM
The cynical perspective
This is America, and as I understand it, everything is driven by money. This technology reduces fraud/theft, and thereby saves money. Sounds to me like this could justify reduced charges to retailers which should be all it takes to convince them to get on board. Of course I'm ignoring one detail, the bannks will consider the better security to be a benefit and therefore charges will be increased since, as banks have demonstrated on many occasions, the only thing that interests them is more profits. No wonder it's not been adopted yet.
psengupta411
50%
50%
psengupta411,
User Rank: Apprentice
1/24/2014 | 6:21:52 PM
Target Breach: Smartcards
If the perpetratrors had hacked the Target servers, then of course, EMV cards could not have saved the situation. However, a PCI compliant POS terminal with an EPP, would have helped to avoid PIN compromise for EMV cards even if the card numbers were illegally captured. It seems that the obduracy of the US retailers has been the prime cause for the perpetratrors to succeed in this massive onslaught. No wonder, we keep reading about the impending 'death' of retail
rvanderhoof085
50%
50%
rvanderhoof085,
User Rank: Apprentice
1/24/2014 | 1:08:40 PM
Smart cards won't stop hackers - but they remove the incentive
Stopping the hackers is not the purpose of EMV chip cards.  PCI security compliance is supposed to do that, and everyone knows that applying network security only against hackers is an arms race that merchants can't win.  EMV chip card data behind the firewalls erected by merchants to prevent hackers from getting in makes those merchants less of a target.  Remove the magnetic stripe data and replace it with chip data, which can't be counterfeited and lacks all the elements neccesary for online fraud, and you eliminate the incentive to break in.  EMV chip cards is the best defense merchants have to avoid being the next target.
mdelince
50%
50%
mdelince,
User Rank: Apprentice
1/24/2014 | 12:36:00 PM
When can we expect better online use of chipped cards?
There are many banks in Europe (all the one I deal with) who provide a device which can be used to login to the online banking web site and also to confirm any online transaction on these sites.

So it seems to me that if "the world" adopted such simple technology we could get way better security around online financial transaction (and possibly even for non-financial ones).

The main problem is that there does not seem to be an agreed upon standard for such device and my experience with the banks I refer to above is that each has got its own device and apparently they are not fully compatible.

Another problem is price: someone will have to pay for the device and even if they are not very expensive (I pay a fee of about 50$ to obtain such device and they last 5 years) this cost may be difficult to justify for infrequent use. If "the world" was adopting a standard for such a device, I am sure 3rd party would be building and selling such devices and pricce would drop to a more acceptable 2-5$.
Lorna Garey
50%
50%
Lorna Garey,
User Rank: Ninja
1/24/2014 | 11:19:01 AM
Transactions without the card?
These chipped cards do nothing for online or phone purchases either, right?

In terms of PCI, seems like the carrot part of the carrot/stick duo. PCI audits are costly and of questionable value. So, let retailers spend that money to upgrade their devices.
<<   <   Page 2 / 3   >   >>


COVID-19: Latest Security News & Commentary
Dark Reading Staff 10/23/2020
7 Tips for Choosing Security Metrics That Matter
Ericka Chickowski, Contributing Writer,  10/19/2020
Russian Military Officers Unmasked, Indicted for High-Profile Cyberattack Campaigns
Kelly Jackson Higgins, Executive Editor at Dark Reading,  10/19/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-13100
PUBLISHED: 2020-10-26
Arista&acirc;&euro;&trade;s CloudVision eXchange (CVX) server before 4.21.12M, 4.22.x before 4.22.7M, 4.23.x before 4.23.5M, and 4.24.x before 4.24.2F allows remote attackers to cause a denial of service (crash and restart) in the ControllerOob agent via a malformed control-plane packet.
CVE-2020-25470
PUBLISHED: 2020-10-26
AntSword 2.1.8.1 contains a cross-site scripting (XSS) vulnerability in the View Site funtion. When viewing an added site, an XSS payload can be injected in cookies view which can lead to remote code execution.
CVE-2020-7751
PUBLISHED: 2020-10-26
This affects all versions of package pathval.
CVE-2020-27678
PUBLISHED: 2020-10-26
An issue was discovered in illumos before 2020-10-22, as used in OmniOS before r151030by, r151032ay, and r151034y and SmartOS before 20201022. There is a buffer overflow in parse_user_name in lib/libpam/pam_framework.c.
CVE-2020-27388
PUBLISHED: 2020-10-23
Multiple Stored Cross Site Scripting (XSS) vulnerabilities exist in the YOURLS Admin Panel, Versions 1.5 - 1.7.10. An authenticated user must modify a PHP plugin with a malicious payload and upload it, resulting in multiple stored XSS issues.