Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

8/25/2009
03:51 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

PCI Council Releases Recommendations For Preventing Card-Skimming Attacks

New best practices are aimed at helping retailers -- especially small merchants -- but security experts say skimming risk runs deeper

The PCI Security Standards Council (PCI SSC) today unveiled best practices for retailers to defend themselves against the growing number of credit- and debit-card skimming scams.

Skimming credit- and debit-card data is becoming a popular way for cybercriminals to steal credit and debit card account numbers and execute financial fraud against grocery stores, gas stations, convenience stores, and other retailers and their customers, who are increasingly falling victim to hijacked card readers and ATM machines. Skimming occurs either by a malicious insider at the retail point-of-sale capturing the customer's card data, or more commonly by someone physically rigging a reader with a sniffer-type device to capture the data, which is then transmitted to the bad guys remotely.

"Skimming is becoming a widespread problem. These are guidelines for what retailers should be looking at" with their reader devices, says Bob Russo, general manager of the PCI SSC. "We discuss different techniques for protecting those point-of-sale devices."

But security experts say the council's skimmer protection guidelines are more a symptom of the already-broken system of credit and debit cards. "The concept of a 'credit card' as it exists today is the problem: If credit cards were cryptographic devices rather than just numbers, then none of these threats would be a problem," says Chris Paget, a security researcher. "The technology exists to implement this today and to completely eliminate credit card fraud, but it seems there's too much money being made from fraud for the card issuers to care."

Paget says the PCI guidelines are missing two key elements of this type of fraud: a malicious merchant stealing the data, and equipment tampered with at the factory. "If the person you give your card to at a restaurant has their own card skimmer, you're just as vulnerable," he says.

Legitimate card-reader equipment is also being compromised at the factory, so when merchants receive their new terminal, it could arrive rigged. "[The guidelines] do not address the case of legitimately purchased equipment that was tampered with at the factory, nor the case of a software-only addition to an ATM or card reader," says Paget, who himself fell victim to an ATM scam in Las Vegas during the Defcon17 conference.

Rob Enderle, principal analyst with The Enderle Group, says the PCI's guidelines illuminate how existing scanner technology can't protect consumers' data. "This document strongly showcases that the technology currently being used by merchants is inadequate for the task of protecting customer or the merchant. There are simply too many ways this can be relatively easily compromised," Enderle says.

Scanners should at least contain intrusion protection technology that disables the hardware if it gets opened, as well as a trusted platform module to encrypt the data and data stream, and a way to sound an alarm if a security event occurs on the devices, he says.

"This coupled with the requirement that the customer, not the service provider, scan the card to protect against illicit portable scanners," he says.

The PCI Council's "Skimming Prevention: Best Practices for Merchants" guidelines, meanwhile, include a risk assessment questionnaire and self-evaluation forms to help retailers gauge their susceptibility to these types of attacks and to determine where they need to shore up their defenses. The guidelines cover how to educate and protect employees who handle the PoS devices from being targeted, as well as ways to prevent and deter compromise of those devices. They also detail how to identify a rigged reader and what to do about it, and how physical location of the devices and stores can raise risk.

The guidelines are geared to be used in conjunction with the PCI's PIN Entry Device Security Requirements, which specifies how to secure PIN devices.

PCI's Russo says the guidelines are for all sizes of retailers, but are especially geared for helping mom-and-pop retailers: "A small merchant that makes pizza isn't going to know much when someone with a terminal shows up with a business card and says he's there to put in a replacement, but is doing something [malicious] with it and leaving it there," PCI's Russo says.

Among some of the information in the guidelines is how to look for signs of physical tampering and how to monitor the device for that. "Write down the serial number on your terminal and look at what the terminal looks like. Does it have seals on it? A label on the back? What color wires go to it?" he says. "Once a quarter, take a look at it and make sure it's intact."

"Most of this stuff is common sense, and that's where most of the fail happens," adds Michael Rothman, senior vice president of strategy at eIQnetworks. "But in reality, skimming defense is really more about process and education. People on the front lines need to know what to look for -- and that is a huge challenge. But it always has [been]."

But skimming is typically more about adding a layer to the existing device that can't be detected, he says, so the guidelines may not be effective in those cases.

Meanwhile, Paget says credit card companies need to wake up. "Credit cards as they exist today are the financial equivalent of a Telnet login session over the Internet. It's about time the dominant payment infrastructure upgraded to SSL [Secure Sockets Layer] and got rid of all of these attacks -- and more -- at once," he says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/10/2020
Researcher Finds New Office Macro Attacks for MacOS
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/7/2020
Lock-Pickers Face an Uncertain Future Online
Seth Rosenblatt, Contributing Writer,  8/10/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-13288
PUBLISHED: 2020-08-12
In GitLab before 13.0.12, 13.1.6, and 13.2.3, a stored XSS vulnerability exists in the CI/CD Jobs page
CVE-2020-13290
PUBLISHED: 2020-08-12
In GitLab before 13.0.12, 13.1.6, and 13.2.3, improper access control was used on the Applications page.
CVE-2020-13291
PUBLISHED: 2020-08-12
In GitLab before 13.2.3, project sharing could temporarily allow too permissive access.
CVE-2020-6294
PUBLISHED: 2020-08-12
Xvfb of SAP Business Objects Business Intelligence Platform, versions - 4.2, 4.3, platform on Unix does not perform any authentication checks for functionalities that require user identity.
CVE-2020-6295
PUBLISHED: 2020-08-12
Under certain conditions the SAP Adaptive Server Enterprise, version 16.0, allows an attacker to access encrypted sensitive and confidential information through publicly readable installation log files leading to a compromise of the installed Cockpit. This compromise could enable the attacker to vie...