Slashdot Mirror
PIN Scandal 'Worst Hack Ever'
QuietLagoon writes "The evolving Citibank PIN scandal is getting worse with each passing day. Gregg Keizer of TechWeb News writes: 'The unfolding debit card scam that rocked Citibank this week is far from over, an analyst said Thursday as she called this first-time-ever mass theft of PINs 'the worst consumer scam to date.' ... The problem...is that retailers improperly store PIN numbers after they've been entered, rather than erase them at the PIN-entering pad. Worse, the keys to decrypt the PIN blocks are often stored on the same network as the PINs themselves, making a single successful hack a potential goldmine for criminals: they get the PIN data and the key to read it.'"
... Change your fucking PIN right now. Don't be fooled by the Visa logo... Debit card fraud is not like credit card fraud, where the companies will almost always clear the charges at no (or minimal) cost to you. If a criminal steals your money through debit card theft you probably won't get it back.
I was the victim of debit card abuse (from a different bank), I believe (from talking to other people in my neighborhood) that a gas station was logging debit #'s and PINs customers used at the pump, manufacturing cards and taking cash from ATM's. I was hit for about $2000 and it would have been more if I didn't catch it. The bank would not clear the charges, the police of course took a report but did nothing to follow up. I fought tooth and nail to get the bank to reimburse me, but they basically said it was my word against theirs. I demanded to see the ATM camera photos but they said they would only release them to the police, and of course the police refused to help with my request.
Your mileage may differ, of course. But take this seriously.
Well, since Diebold probably made the ATMs which were hacked, you could probably look in the same place. Interestingly, the story was broken by a blog. http://www.boingboing.net/2006/03/05/citibank_unde r_fraud.html
"I've got more toys than Teruhisa Kitahara."
Yes. Yes, they really do make that kind of mistake. I've seen people make quiz-type webpages with just a client-side javascript that checked the answers (which were, of course, plain-text in the html source). Granted, that was not as important as PIN numbers, but a lot of mediocre programmers just don't step back to reflect on what they've written. As far as they're concerned, it works, and they don't even contemplate ways how malicious users might try to break it.
The quiz was for a job application where someone smart enough to look at the html source would be qualified enough for the job, but still.
Be wary of any facts that confirm your opinion.
Citibank is handling this just like you'd expect a credit card company would, with horrid customer service.
If you're out of the country? Tough shit. Virtually all usage outside the USA will result in your card being automatically killed and the only way (apparantly) for to continue using your card is to have a new card shipped to your home address, activate the card from your home phone, and even then, their CSRs say that if you use it outside the usa, it may get automatically killed again.
See one such story here.
You know, if this was bigger, it could be a good thing for everyone. Maybe then people would start taking things seriously. And although I usually don't think that we need new legislation, maybe in this case, it would be a good idea.
I'd like to to see criminal penalties applied against the directors of companies for losing customer information in the same way people can go to the pokey for screwing up under SOX.
Then again, this breach isn't the worst we've heard about this week. 17 million records (names, phone numbers, addresses, e-mail addresses, IP addresses, logins, passwords, credit-card types and purchase amounts - everything except credit-card numbers) were discovered floating around the net.
See here for details.
Oh, and if your card was used, good luck with trying to fix your credit
The credit sytstem could use an overhaul.
1q2w3e4r5t6y7u8i9o0pqawsedrftgthyjukilo;p'azsxdcf
It all changed over on Feb 14th here in London with the I 3 my PIN campaign. You can't not use the pin anywhere now
"In a time of universal deceit - telling the truth is a revolutionary act." - George Orwell
I work in a small local convenience store in the UK, and as such our machine for doing debit/credit cards is completely seperate to the EPoS system. The PIN never leaves the terminal that the customers use to enter the pin, and is wiped after it has been entered. There is physically no way for us to retrieve the PIN. We used to be able to over-ride PIN entry with a supervisor card, before it became mandatory to use Chip and PIN. Now we can't do that anymore.
It appears theres a clause for Debit cards used at ATM's... http://usa.visa.com/personal/security/visa_securit y_program/zero_liability.html
Extract from above Link:
The Zero Liability policy covers all Visa credit and debit card transactions processed over the Visa network--online or off. The only transactions not covered under the Zero Liability policy are commercial card, ATM, and non-Visa-branded PIN transactions.
How American.
Here in the Netherlands, getting a credit card isn't even considered 'normal', and 99% of stores only accept debit cards -- where YOU swipe the card, and YOU enter the pin.
And of course, stores can't accept debit cards without the official tamper-resistant hardware provided by the banks (who have all agreed on a common system for transferring money).
There was a card-cloning scam a few years a go, and all ATMs have been retrofitted with special 'things' in front of the card slot to prevent cloning devices being put on them (and people have been told to not give away their cards to anyone).
It can be done properly, it's just that the proper way isn't always the cheapest way..
I don't think that the supermarket has your PIN, more like the one way encrypted PIn information is passed from the point of sale terminal to the PIN pad. The PIN pad checks that the PIN entered is valid then the till will request authorisation from the acquirer.
The full system is validated by the acquirers, if the retailer was found to be holding PIN information or modifying the certified PINpad hardware the retailer would be stopped from using the credit card authorisation facility.
I think a better question is when ATMs will start using two factor authentication.
ATMs are already using two-factor: something you have (ATM card) and something you know (PIN). What is it that you want them to be doing instead?
---- Just another spud server.
In order to pass accreditation there were many many security requirements, the most important of which is that the PIN never leaves the EMV hardware. There is a secure link between the little pad there and the swipe/park reader on the side of the PoS display. The PIN is hashed on the pin pad and the hash sent to the reader. It does not go any further. Ever. All the till software I wrote gets is a (secure) result code for whether verification was succesful.
The sotre does not get your PIN.
As for the rest, The store gets all the info from the stripe ANYWAY. The chip has all the same info encoded on it, and a lot more. They don't need to swipe your card (and I must admit it mystified me why they would for a while) precisely because they have that data from the chip!
The reason for the swipe is simple -
You appear to be worked up about very little.
If you have any more questions I'd be more than pleased to answer them.
However there is a code on there to say that it should be a chip card, however the strip is still there in case the chip or the reader breaks. This is the only real exploit I know of (and I coded the tesco system and I think my software runs sainsbury's now too), that you can break (or cover in something like nail varnish) the chip and then it is at the merchant's discretion as to whether they accept the transaction or not. In the case of fraud the liability is then with the merchant and not the card issuer/scheme.
Conceivably then, you could clone the stripe and put a dummy chip on a card and get away with it at some places, but not all. The chip itself cannot (at present) be cloned with anything other than an electron microscope, AFAICT.
Visa Usa Notice. If Sams Club and OfficeMax are saving Citi Visa pins, they're saving other pins as well.
Hear that thumping? It's the hearts of a thousand excited product liability lawyers.
See my article here on this. Bottom line, I don't think it's necessarily a problem with retailers storing PINs, it's a fundamental implementation problem.
a rd-fraud-and-bank-negligence
http://www.signal15.com/articles/2006/03/09/atm-c
Need Free Juniper/NetScreen Support? JuniperForum
The preferred solution is to not have a problem.
Not always though...I've got a good friend who works in the collections department for A Big City(i) credit card company, what she's see happen over and over is someone who has never been late on their payment will pay their card off but keep it open for future use, because they have a $0 balance when the statement comes they'll just throw it away without looking at it (yes, a mistake on the customer's part). So what happens is, the Big City(i) credit card company sometimes adds on an "opt-out card protection" plan that costs a few dollars a month and the customer thinking they have a $0 balance because they haven't made any purchases lately doesn't look at the statement. When the few dollar cost of the protection plan doesn't get paid the customer is hit with a $30+ late fee and their interest rate shoots up. Now, here is where it gets really good. Because the customer has never been late before, the Big City(i) credit card company won't call them about the late payment until the third month the account is behind. So the for each of the next two months the customer gets another card protection charge and a $30+ late fee, plus interest (at the new higher rate) on the previous balance. When the customer finally does get a call, they owe $150+ to the Big City(i) credit card company and are on the verge of having their credit score affected. If you complain about it or try to have it resolved, the person doing the collecting doesn't have the authority to credit the charges, so they have to contact the crediting department, who will almost always either flat refuse it, or pass you on to another person (or back to collections). Reminds me a bit about the insurance company in The Rain Maker, no one has the power(or desire) to fix anything, and even someone who may want to fix the problem, AND works for the Big City(i) credit card company (such as my friend in collections) is at a loss as to how resolve the situation. Now, you can always try and contact the BBB or your attorney general (which some people rightly do) but really, for $150 who wants to spend all that time So yes, the customer made a mistake by not looking at their statements, but it's just an example of how credit cards (even unused) can spin out of control in a hurry.
h _cg.gif)
Just as an addendum, you'd be surprised to see how many people are working at the Big City(i) credit card company and putting a huge portion of their paycheck towards paying off credit card debt. Now, that's really living under the Umbrella. (http://www.citigroup.com/citigroup/domain/image/
If you get the PIN wrong a set number of times (usually three) the card locks itself. The hash is seeded with transaction dependant data. Also, you don't get to see the hash, the link I told you about, between the PIN Pad and the card reader is a direct link and is encrypted itself (think SSL, I think they use certificates for authentication and then key exchange, then an encrypted link much like SSL though I'm not sure of the details.)
1 - the swipe data alone is no where near enough to make cloned card. You need a lot more data AND access to the master keys used by the card issuer.
2 - The link between the PIN Pad and the reader is direct and encrypted.
3 - With EMV (the UK scheme) no PIN is used in a magnetic transaction. Signature is used and the fraud liability is with the merchant. There is NO way to do a stripe'n'PIN transaction.
4 - The scenario would not be prevented if there was no strip because there is no scenario.