Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

9/15/2009
03:27 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Smart Card Alliance: End-To-End Encryption Won't Stop Credit-Card Fraud

Industry association proposes contactless chip cards, says end-to-end encryption isn't enough

The Smart Card Alliance has taken a stand against pure end-to-end encryption as a way to protect credit-card transactions, publishing a position paper this week calling instead for contactless chip cards with dynamic cryptograms.

Merchants and payment processors are under pressure to make changes in how customer card data is protected in the wake of major data breaches over the past two years, such as that of Heartland Payment Systems, which have exposed millions of customer credit and debit cards. The electronic payment industry is considering the adoption of a new ANSI standard, and Heartland is pushing for it to embrace end-to-end encryption of cardholder data.

"End-to-end encryption is designed to protect static data. As long as the transaction data is static, this is another way of combating fraud," says Randy Vanderhoof, executive director of the Smart Card Alliance. But when card data is being entered into a point-of-sale system (POS), for instance, it's still at risk, he says.

"It's like putting a steel door on a grass hut," he says. "Fraudsters will find other ways to get at that static data before it gets there, with things like skimming [the card data] as it's entered into the point of sale system, or cloning cards that are lost or stolen."

The alliance, whose members include Bank of America, MasterCard, Visa, HID Global Corporation, and the State Department, argues in its position paper that contactless chip cards with dynamic cryptograms for each transaction are a better solution than end-to-end encryption.

And if the industry does decide to adopt end-to-end encryption, the alliance recommends the standard allow for "globally-interoperable secure payment transactions using chip card technology in the future," the paper says.

The Smart Card Alliance's Vanderhoof says his organization's proposal is different from pure chip and PIN technology. "We're not advocating that the U.S. needs to go all the way to a full chip and PIN implementation, but chips with dynamic data like contactless payment cards that are on the market today," he says.

He says the proposal basically builds on existing "express" payment card programs from Visa, MasterCard, and American Express that provide more convenient and faster payment than traditional cards. These express cards use contactless card technology.

"The U.S. could see a significant change in fraud by introducing more dynamic data versus magnetic stripe data," Vanderhoof says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Commentary
How SolarWinds Busted Up Our Assumptions About Code Signing
Dr. Jethro Beekman, Technical Director,  3/3/2021
News
'ObliqueRAT' Now Hides Behind Images on Compromised Websites
Jai Vijayan, Contributing Writer,  3/2/2021
News
Attackers Turn Struggling Software Projects Into Trojan Horses
Robert Lemos, Contributing Writer,  2/26/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: George has not accepted that the technology age has come to an end.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-23351
PUBLISHED: 2021-03-08
The package github.com/pires/go-proxyproto before 0.5.0 are vulnerable to Denial of Service (DoS) via the parseVersion1() function. The reader in this package is a default bufio.Reader wrapping a net.Conn. It will read from the connection until it finds a newline. Since no limits are implemented in ...
CVE-2009-20001
PUBLISHED: 2021-03-07
An issue was discovered in MantisBT before 2.24.5. It associates a unique cookie string with each user. This string is not reset upon logout (i.e., the user session is still considered valid and active), allowing an attacker who somehow gained access to a user's cookie to login as them.
CVE-2020-28466
PUBLISHED: 2021-03-07
This affects all versions of package github.com/nats-io/nats-server/server. Untrusted accounts are able to crash the server using configs that represent a service export/import cycles. Disclaimer from the maintainers: Running a NATS service which is exposed to untrusted users presents a heightened r...
CVE-2021-27364
PUBLISHED: 2021-03-07
An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is adversely affected by the ability of an unprivileged user to craft Netlink messages.
CVE-2021-27365
PUBLISHED: 2021-03-07
An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data structures do not have appropriate length constraints or checks, and can exceed the PAGE_SIZE value. An unprivileged user can send a Netlink message that is associated with iSCSI, and has a length up to the maximum length...