Researchers Expose New Credit Card Fraud Risk

An anonymous reader writes "Researchers from the University of Cambridge have discovered flaws in the card payment systems used by millions of customers worldwide. Ross Anderson, Saar Drimer, and Steven Murdoch demonstrated how a simple paper clip can be used to capture account numbers and PINs from so-called 'tamper-proof' equipment. In their paper (PDF), they warn how with a little technical skill and off-the-shelf electronics, fraudsters could empty customers' accounts. British television featured a demonstration of the attack on BBC Newsnight."

Get rid of the damn things!

[seanadams.com (463190)]

The reason the security is so poor is because the banks don't give a s**t. It's the _merchants_ that are liable for fraud, even though it's almost entirely the fault of the banks! They banks only have to make it just good enough that it's easier for the merchants to take credit cards than cash - even after the exorbitant ($0.25 + 2.5%) processing fees that they charge just to move the bits around.

The powers that be LOVE us using credit cards. They can track us, and they can dupe the feeble-minded among us into spending our way into a lifetime of indentured servitude.

The failure of our government to (re-)introduce a $1000 bill, in spite of massive inflation, is a deliberate scheme to make it impractical for us to use untraceable funds for any substantial purchase. And it has nothing to do with tracking terrorists or drug money, it's just to keep tabs on and control over the law abiding populous.

Re:Get rid of the damn things!

[suso (153703)]

I believe this is called Security Theatre.

Re:Get rid of the damn things!

[ShadowsHawk (916454)]

There are plenty of merchants that will not accept a $50 let alone a $100.

Most will for large-ticket items

[davidwr (791652)]

While it's true they don't have to do business with you, most stores will accept a $50 rather than lose out on a $55 purchase. Ditto a $100 and lose out on a $101 purchase.

It boils down to risk:
Most people passing funny money will want to get change rather than goods they can only resell at diminished value.

Also, many merchants use basic anti-counterfeit measures when accepting $20s and higher. Granted these measures have a high miss rate but they do catch amateurs.

Re:Most will for large-ticket items

[Dogtanian (588974)]

While it's true they don't have to do business with you, most stores will accept a $50 rather than lose out on a $55 purchase. Ditto a $100 and lose out on a $101 purchase.

They're evidently not that keen. Last time I tried to make a $53 purchase with large-value bills, they refused.

The cheek of it- my $50 bills are as good as anyone else's! As was the $3 bill...

Re:Get rid of the damn things!

[the brown guy (1235418)]

I tried paying for my university tuition with cash (I have a cash based job) and the woman there said that I can only pay online with a credit card. After explaining that I am too young to have a credit card, and that I only had cash she relented. Even then, she said that they couldn't give me any change, so I had to go and get exact change. Its bullshit, not everybody can have a credit card, plus I like the anonymity that paying via cash provides.

Re:Get rid of the damn things!

[Raistlin77 (754120)]

Not everybody can have a checking account, especially if they are unfortunate or irresponsible. And which would you rather have, cash or an electronic transaction that can be reversed or check that can bounce?

Re:Get rid of the damn things!

[syzler (748241)]

In the case of university tuition, whether he can get a debit card or not is irrelevant. Legal U.S. tender must be accepted by a creditor (the University) from the debtor (the student) to pay off a debt within the U.S. If the University required payment before it allowed the student to register for classes, then the University could require payment by credit card. However since the University extended credit to the student for the classes, it is required to accept legal tender as payment for those classes.

See http://en.wikipedia.org/wiki/Legal_tender [wikipedia.org].

Re:Get rid of the damn things!

[by Anonymous Coward]

The data mining industry is so ingrained in our society that even if people started using $100 bills to pay for major purchases, the serial numbers on the bills would probably be scanned for tracking information. The only way you are going to get privacy in your monetary transactions is with a national privacy overhaul with penalties for data mining without permission. Since the government is one of the entities doing the data mining, this is probably not going to happen anytime soon.

Re:

[geekoid (135745)]

This is a manufacturing design problem.
These boxes can be made to make this attack nearly impossible.
But it would cost another 5 bucks to manufacture it.

Hell, if the designed them so the case was steel, and as thin as an iPhone this problem goes away because:
a) it would take serious effort even AFTER you knew what to do. Raises the risk.
b) You couldn't attach something to it without it being noticed.

As far as the software goes, encrypt the data.

Re:Get rid of the damn things!

[Raistlin77 (754120)]

The problem is not missing encryption between the merchant and bank, the problem is with missing encryption between the merchant and the card reader/pin entering pad. The same readers/pads are still unencrypted, even though the merchant may be encrypting the data for the transaction to/from the bank.

It's like entering your credit card information on a website for a purchase. The connection to the server may be encrypted, but the data sent from your keyboard to your pc is not, and this is the same as where the hack with the card readers/pads is occurring.

Re:Get rid of the damn things!

[Kalriath (849904)]

Really? Over here our terminals require triple-DES encryption between the PIN-pad and the terminal and then the connection from the terminal to the payment processor is encrypted again. Anything else will not be certified for connection to the EFTPOS network.

Wow you guys really do have it bad.

Re:Get rid of the damn things!

[John3 (85454)]

I'm pretty sure the connection between the card reader and all external devices (POS stations, authorization network) is always encrypted. That's one of the basics for certification by Visa and the rest of the industry. The vulnerability demonstrated (based on my reading of TFA) occurs totally in the card reader/pad.

Re:

[Mr. Underbridge (666784)]

he failure of our government to (re-)introduce a $1000 bill, in spite of massive inflation, is a deliberate scheme to make it impractical for us to use untraceable funds for any substantial purchase. And it has nothing to do with tracking terrorists or drug money, it's just to keep tabs on and control over the law abiding populous.

It might also have something to do with the fact that most people aren't crazy enough to walk around with thousands of dollars on them. In the end, it wouldn't matter, because

Is anyone here really surprised?

[suso (153703)]

Proprietary software AND hardware companies basically cannot be trusted. I've encountered countless amounts of commercial software, hardware products and services where the company states that they are very secure, but when investigating things myself, I find that its trivial to circumvent their security. You can read about some of the read about some of the poor security I've discovered recently with web hosting providers [suso.org]. Consumers deserve better than this and its all of our responsibilities to make all people aware of these problems. Ironically, this news program itself doesn't understand the value of open disclousure. I guess I can understand that as its human nature to want to hide things for fear of liability. But its not like they were doing something that's not so obvious that someone determined enough could figure out.

First rule of security in my book: Someone who wants something bad enough, they will be able to circumvent nearly anything in order to get it. So its a matter of how badly they want it. Since its money in question, I'd say that a variety of organizations and people want it pretty bad.

Re:Is anyone here really surprised?

[Pojut (1027544)]

First rule of security in my book: Someone who wants something bad enough, they will be able to circumvent nearly anything in order to get it. So its a matter of how badly they want it. Since its money in question, I'd say that a variety of organizations and people want it pretty bad.

This reminds me of a quote (the source eludes me at the moment):

"If it can be engineered by one human, it can be reverse-engineered by another human."

Re:Is anyone here really surprised?

[whyloginwhysubscribe (993688)]

My bank in the UK (Barclays) has issued me with a secure ID card, that I type my PIN into, and it then gives me a number to type into the online banking system.

I think it is only a matter of time before this gets transferred to shop terminals - if you need to bring something and remember something, then it makes life a lot harder for hackers.

Damn you Clippy!

[techpawn (969834)]

Damn you to hell!

You bastards shouldn't have insisted he be fired!

[StefanJ (88986)]

If Clippy had been allowed to hang around in Windows he would at least been kept off the streets.

In related news, the alternate Clippy, the advice dog, lost his job as a neuticles model and was sold to a company that tests military grade blood-clotting bandages. He's shot in the abdomen three days a week so trainees can learn how to apply the dressings. And all because you didn't want a friendly little animated help-mate watching after you.

You bastards.

I can build an atomic weapon with a paper clip

[wsanders (114993)]

>> "As described in some detail in our paper, the basic attack tool is a paper clip. In order to record and analyze transactions a couple hundred pounds' worth of equipment is required, in addition to some digital design experience."

OK, a paper clip. PLUS A BUNCH OF OTHER STUFF.

Well, shoot, I could probably build an atomic weapon with a paper clip. PLUS A BUNCH OF OTHER STUFF.

Re:

[Jarjarthejedi (996957)]

Macguyver wouldn't need the other stuff...just some gum. And you call yourself a nerd...shameful

Re:

[johnny maxwell (1050822)]

Well, you have to admit that that in this case the paper clip is quite important.
For those of you who haven't actually read the article (it is not unheard of!):
They use it to peel through a hole in the back of a owner-accessible compartment for some rarely used extra modules to insert it into an open via in the pcb which just happens to carry a serial data line transmitting PIN and card details...

You could even nicely mount your eavesdropper circuit in that compartment.

This is quite startling IMO, as the de

Re:

[holyspidoo (1195369)]

"It looks like you're entering your secret PIN. Would you like help?"

I never should have said yes...

They're looking in the wrong place

[blhack (921171)]

The huge security hole in the credit card system is the users. I flipped out at one of our vendors when they STORED my credit card number in their database, and just went ahead an charged it next time I was in the store.
People will gladly give their credit card number over the phone to a shady pizza shop, just to get a 15 dollar pizza delivered to their door.
We could build the most secure credit card system in the world, but the problem is that it has to be simple enough for idiots to use.

Re:They're looking in the wrong place

[zippthorne (748122)]

Which is not a problem if you use virtual account numbers (what Citibank calls it. I'm sure other banks have the same thing with different names) that are only authorized for one transaction for the amount you specify.

Re:They're looking in the wrong place

[Fnord666 (889225)]

but the problem is that it has to be simple enough for idiots to use.

Even then someone will just build a better idiot.

Paper clip?

[evil agent (918566)]

Ross Anderson, Saar Drimer, and Steven Murdoch demonstrated how a simple paper clip can be used to capture account numbers and PINs

Hmm, Macgyver must have tipped them off.

Tapping

[esocid (946821)]

From TFP

while a wire routed from the back of a mounted Dione PED to a recorder unit under the counter will not be detected unless the cardholder conducts a very close inspection - and knows what to look for.

At least I now know what to look for. The paper has pictures and examples of the exploits in the designs and lack of security. Either way I'll be carrying more cash from now on.

This is a UK/Europe card system issue...

[by Anonymous Coward]

What people are missing in this is that this pertains to certain card types mainly used in Europe. The type with RFID or embedded chips used for security. On standard US debit cards, there is no information sent to the card or from the card that ties to the PIN. The PIN is only seen by the pinpad component and immediately encrypted using a rotating DKPUT key algorithm before that, the card number and a sequence number are sent to be translated by a hardware security module. The pin pads themselves used by most US retailers are secure and do not pose a risk. If you tamper with most of those devices (example, the Welch Allyns used by best buy, lowe's and others) then the injected keys are erased and PIN translation fails. They normally don't remain out too long if they are tampered with since the stores will consider them broken and unusable when they don't work anymore. This is related to the system in place and used in the UK. The US system, while old, is only being updated currently to support the new double length key requirements and have not incorporated smart card support or RFID (except a few gas station chains). The most important thing in the US is to protect the card database since the data on the mag stripe can be used as a credit card. As for PIN security, don't tell others your pin, notice hidden cameras that look out of place and point at PIN pads and you should be safe. The way PIN numbers are stored at banks within a hardware security module is safe and those devices are very sensative to outside attack. They even employ motion sensors to prevent tampering in HSMs.

Why isn't it a PIN = SecurID + PIN

[apenzott (821513)]

The PIN needs to be a moving target and much longer than 4 digits. Note that stateside that most automatic car washes are using at least 5 digit numbers to authenticate the sale as sold by the gas pump. (Example: SecurID or one-time pad.)

(offtopic)
My biggest pet peeve is why are account numbers (on checks) in the clear while the same is basically true of PIN numbers (without any added "salt")

For checks I would like to see the account number + check number translated a 16 to 20 digit hash of which only the bank knows how to decipher to the correct account and check number?
(/offtopic)

Tough Interview

[Crazy Man on Fire (153457)]

Wow. The interview at the end of that piece has me floored. Imagine if industry people and politicians in the US were subjected to this sort of probing interview and actually responded. The interviewer had the representative from the credit card companies on the ropes the entire interview. Props to the BBC for doing some serious journalism.

Re:

[abigsmurf (919188)]

Jeremy Paxman is famed for being incredibly tough on his witnesses (and contestants on University Challenge)

Re:Tough Interview

[ettlz (639203)]

Jeremy Paxman is famed for being incredibly tough on his witnesses (and contestants on University Challenge)

Yes, but did you threaten to overrule him?

Re:Tough Interview

[hairykrishna (740240)]

For all you non-brits, this is a reference to a famous interview where Paxman famously asked Michael Howard exactly the same question 12 times in an attempt to get a straight answer: http://video.google.co.uk/videoplay?docid=5983432841587892898&q=paxman+howard&total=10&start=0&num=10&so=0&type=search&plindex=0 [google.co.uk] (3 minutes or so into the video).

It is one of the finest pieces of political TV ever.

Re:

[mapsjanhere (1130359)]

The big advantage of a publicly funded TV program - the producers are less likely to cave in to advertiser's interests.

Re:

[smurfsurf (892933)]

The BBC is not managed by the government.

Re:Tough Interview

[d3vi1 (710592)]

KUDOS to the BBC for being a leader in all fronts of the Mass-Media. This video proves that they can do serious journalism, something that most media companies have forgotten how to do.
Short, correct and difficult to answer questions. Ask the right questions, that's all it takes.

Bravo BBC

Re:

[BovineSpirit (247170)]

Jeremy Paxman is famous for being a tough questioner. His most notorious interview [youtube.com] was with a slimy politician who later led the Tories to defeat against Tony Blair's Labour. I'm not sure what Paxman's personal politics are, but he certainly doesn't appreciate being messed around. Michael Howard can be sure that if one of his political opponents had weaseled around like that he would have had equally short shrift.

Re:

[ayjay29 (144994)]

>>Imagine if industry people and politicians in the US were subjected to this sort of probing interview... It's worth wathing NewsNight in the US when they cover US items (the BBC makes every program available on the web after broadcast). Sometimes Jeramy Paxman will get his teath into American politician or representative who is completly un prepared for this type of interview. It happened to someone high up in the US (can't remember who) administration in the lat Iraq conflict and he was really kno

Jail Time?

[Frosty Piss (770223)]

British television featured a demonstration of the attack on BBC Newsnight."

I'll bet that would land you in jail over here (USA) ...

MacGyver

[j4s0n (1121943)]

How far you've fallen...

What not to do

[192939495969798999 (58312)]

Every time I see these stories, it reminds me of how they'd say not to do drugs in school, then show us exactly how not to do them...

And here's a link of exactly what you should NEVER do because it is illegal!

(posts to internet site frequented by absolutely everyone)

Clippy? Is that you?

[bryny (183816)]

It looks like you are trying to crack an account. Would you like help?

Another hole in the sieve?

[syousef (465911)]

Credit cards are so incredibly insecure that the only reason people use them is that the banks so far have been willing to cover the costs of fraud (in most cases and as long as the card holder hasn't contributed to it through negligence).

This is just one more flaw.

Re:Another hole in the sieve?

[|Cozmo| (20603)]

That's because the banks don't eat the cost of fraud, the merchants do. If I have an online store and someon uses a stolen card to buy something from me, I'm the one that gets screwed. The credit card companies reverse the charge, AND charge the merchant a fee for it happening. Then the merchant is out the money, a fee, AND the product they shipped to a thief. The lamest part is the credit card companies don't even provide you the tools to prove that a transaction is legitimate.

Where's the crypto?

[Junta (36770)]

I've been wanting something much more sophisticated than a 'shared secret' that you have to give to anyone to give money. If I let random restaurant a charge me 2 bucks for a drink, I have to give them potentially full access to my accounts.

Where's my private/public cryptography? I want to carry around my own damned device with keypad and display. The display would show me *exactly* what my financial institution will think I'm authorizing, and the keypad would be used to enter the passphrase to decrypt my private key, which is never ever ever transferred outside of the devices local filesystem. It's generated by the device and the public portion uploaded in a secure manner to my financial institution. The secure manner is a complicated issue, but there are degrees of inconvenience that can be induced to do it right, and allow me to opt to allow nothing more convenient than that.

I go to a damn store or online retailer.. When ready to purchase, it somehow gets the data to my device (maybe encrypt with my public key, maybe direct connect to my device, maybe through the financial institution, whatever, the security risk in this transaction being the nature of what I'm buying, not in any way risking the actual money being transfered). I enter my passphrase (which could be as simplistic as a 4-digit pin, but at my discretion, not theirs) to signify accepting the terms my display gives me (i.e. authorized wal-mart to take 5 dollars from my account this one time, or authorize phone company to withdraw no more than 25 dollars on a monthly basis, the transaction may have tolerances and periodic, but always show me the tolerances and period and *who* I'm really authorizing to get the mony). With my private key decrypted, use it to sign the payload, then my financial institution *must* receive that cryptographically signed authorization to transfer payment. The retailer *never* has anything more than data to confirm that one transaction (or reuse for repeat data if I declare that trust, within definable thresholds). To commit 'identity theft' (horrible phrase), they would either need to compromise the financial institutions database with *write* access to replace my public key with their own (by the way, invalidating my real key so I should notice it) or steal my device physically, which I should know. The device should overwrite memory contents where the key was with random bytes every time it completes an authorization, and therefore physical theft or tampering should lead to a dead end without my passphrase.

Re:Where's the crypto?

[Junta (36770)]

You forgot the step where your computer has a key logger installed and someone overseas now has all your data.

Someone steals my device or gains unauthorized access and *then* returns it to me unnoticed is *far* more likely to be noticed than taking my card, scribbling the number on the front and back, and putting it back. Or for random POS equipment to be instrumented that I interact with. Or for some old-fashioned place with the carbon copies or some stands to be set up. At least the security risk lies in the implementation of the device, *not* fundamental to the system. Sure, *the* most secure proposition is currency, but other than direct physical interaction, currency is *not* feasible for the same reasons its good for face to face. Mail currency and anyone can intercept and use it, as it's not traceable and not targeted.

That's not even getting into your other major flaw, and your incorrect assumption.

It would be much easier to discuss those points if you at least mentioned what they were.

Keypad on the card

[Alain Williams (2972)]

What is really needed is that the cards have an integral keypad - so that communication between the chip and the keypad cannot be intercepted, you entering your PIN would activate the card that could then talk over an encrypted link (eg SSL) directly to the bank's computer.

OK: this would make the cards somewhat bulky and since people tend to have several cards their pockets would bulge. So why not allow people to buy their own small keypads (which they trust to not have been tampered with) that they can plug their cards into and plug the whole lot into the retailer's machine.

Banks and Security

[Accersitus (971074)]

Banks seem to think a system is secure enough as long as the number of cases where customers are exploited, are few enough. This way the bank can repay the customers with little arguing, and prevent these stories from reaching the media. In Norway there is a story that has been running in the media where a Professor at the University of Bergen and a group of students have shown that the system used by Norwegian banks to offer Banking services on the internet have flaws that can be exploited. The banks take the same route and try to claim that the system is secure and have their PR people find technical terms like calling it a theoretical attack. (Actually the attack is far from theoretical). The interesting part is how the banks just keep trying to convince the media and people in general instead of sitting down with the researchers at the University and try to find a solution. After the first case in the media, the banks worked to fix the security holes, but the researchers didn't even need a day to find a way around the new protections. Since this system is considered for a national authentication standard the appropriate minister in the Norwegian government is involved, and is siding with the professor and not the banks.

banks should be liable

[nguy (1207026)]

When banks deploy inadequate security, they should be liable for the distress and costs they cause their customers.