Slashdot Mirror
Top Five Causes of Data Compromise
Steve writes, "In a key step to help businesses better understand and protect themselves against the risks of fraud, Visa USA and the U.S. Chamber of Commerce announced the five leading causes of data breaches and offered specific prevention strategies. The report states that the most common cause of data compromise is a merchant's or a service provider's encoding of sensitive information on the card's magnetic stripe in violation of the PCI Data Security Standard. The other four are related to IT security, which can be improved simply by following common-sense guidelines." Here is the report on the U.S. Chamber of Commerce site (PDF).
Don't post it on Slashdot
Those are so obvious. I would have thought maybe ninja hackers using top secret super processors would have at least been in the top 5.
Users! Users! Users!
Wait, five reasons? Add a 'Users! Users!' to the end of that.
"Use of Vendor Supplied Default Settings and Passwords - In many cases, merchants receive POS hardware or software from outside vendors who install them using default settings and passwords that are often widely known to hackers and easy to guess." Incredible.
1. Storage of Magnetic Stripe Data
2. Missing or Outdated Security patches
3. Use of Vendor Supplied Default Settings and Passwords
4. SQL Injection
5. Unncessary and Vulnerable Services on Server
Honestly, could my post be any more useful?
no comments and it's already slashdotted...
upon the advice of my lawyer, i have no sig at this time
Whatever happened to the old saying that your credit card would more likely be ripped off by a waiter than someone off of the internet? Or are waiters taking hacking jobs these days?
https://youramazingbank.amalgamatedservices.com/7j 2jcd_30smdkdfor*usersget/gimmethefarkingsocialsand 4427snow.jsp??/
Nah. Couldn't be.
---- Teach Peace. It's Cheaper Than War.
Perhaps slightly OT, but the article is slashdotted and the header mentioned VISA and breaches.
I think one of the greatest mistakes the credit/debit card companies/banks (certainly here in the UK) made was the compulsary PIN entering (as opposed to a signature) at point-of-sale. Now all you need to do is stand behind me and see my PIN, or if you work at the store - have the security camera trained at the keypad then either lift my wallet or clone my card. All you need is that four digit number, and you've pretty much got my bank account.
My point is, companies make fundamental security errors, and will continue to do so.
Basically: 1. Storage of Magnetic Stripe Data 2. Missing or Outdated Security patches 3. Use of Vendor Supplied Default Settings and Passwords 4. SQL Injection 5. Unncessary and Vulnerable Services on Server Also: 6. Use of insecure "operating system" and poor software.
1. Having your sensitive information recorded in any medium.
That's it.
Really, there's no such thing as perfect security. If you have any information that you want to keep secure and you tell it to even one other person, it will eventually be accessible to anyone who has enough interest in it.
Hell, if we don't rule out torture, you yourself aren't a reliable repository for your own sensitive information.
But you have to share certain information with others if you want to do business, don't you? Well, it seems to me that the only way to avoid all the mess and hassle is to either:
1. Develop a system of doing business where I don't have to be able to identify a person and keep track of that person and/or their assets (goodbye credit-based economy!)
OR
2. Make it so that even if the information used to idenitfy me is made public, it doesn't matter in the slightest.
The second choice means that the information a business uses to establish my identity has to be enough to authenticate me in some manner to that business, but is otherwise useless to identify my person (age, gender, race, etc.), my place of residence, my bank account, my credit rating, or anything else about me.
Hmm... I think it's possible, but not likely. The banks and corporations very much enjoy knowing all this about you, and it will be a mighty struggle indeed to wrest control of your "personal information" away from them.
Insisting on "correct" English is like saying that there is only one, definitive recipe for chili.
Whatever happened to the old saying that your credit card would more likely be ripped off by a waiter than someone off of the internet? Or are waiters taking hacking jobs these days?
That would be part of number 1, putting all the information on the magnetic stripe. Waiters might know how to do this too.
Then again, this is a paper about data security not fraud in general. If you want advice about that, visit the FTC site where crooked clerks are front and center.
Friends don't help friends install M$ junk.
Or something :)
That's one of the reasons I love PHP's newer PDO library. It uses the native data binding for the DBMSes that support it, but will emulate it for those that don't. Thus, no need to worry about manually quoting/escaping the input.
POS meant point-of-sale... guess I was mistaken.
Be who you are and say what you feel, because those who mind don't matter and those who matter don't mind. - Dr. Seuss
No social engineering? Which is a superset of phishing? It's still a data breach even if it doesn't happen on the merchant side.
BTW the PCI/DSS is much more practical than, say, HIPAA. They talk in straight lines instead of circles and give you directly actionable advice.
Actually, most of these "data compromises" are probably engineered to cover crimimal activity by individials within the company. The data is likely sold to organized crime groups, and the crime is obscured behind claims of stolen laptops, the ever popular "hackers," or some other transparent excuse.
...that it requires a company with as much clout as Microsoft to stand up and say: "hey we should be doing this, here's the API, now get coding to it" in order to make anything useful happen anymore.
THIS THING CAN TURN ON A DIME, MACROSSZERO STYLE ALSO FUCK BETA, ~NYORON
I miss one item in that list:
"PDF documents with readable text under the black rectangles."
...for mismanagement of captured RFID information.
It figures magstripe is at the top of the list in a study done by VISA.
1. Storage of Magnetic Stripe Data
As opposed to non-magnetic stripe data - bar code, written material or a phone call to verify something, not to mention photographs, retinal scans or fingerprints?
2. Missing or Outdated Security patches
Like SP2?
3. Use of Vendor Supplied Default Settings and Passwords
Like SP2?
4. SQL Injection
Would that be intravenous or intramuscular?
5. Unncessary and Vulnerable Services on Server
Like SP2, Windows, Unix, Linux, Mac OSX, an internet connection, a card reader or having ANY human being, anywhere in the information loop, at all.
Insecurity is better than NO security and no matter HOW well encrypted a card is, some waiter with a pocket credit card scanner, somewhere, is going to get your information if he wants it.
There is NO defense against competence. And at least SOME cybercriminals are extremely competent.
Lee Darrow, C.H.
With the appropriate public key infrastructure, the necessary amount of information associated with a key pair can be made public, while the rest remains private so that it can be applied in cryptographically secure ways, for example to certify a transaction, without exposing the information itself.
Not many people understand how this works, so it's been historically hard to deploy, but it can be done.
Parity: What to do when the weekend comes.
I work for a major merchant in the US. We take just a ton of credit cards, and have ongoing Visa PCI/CISP discussions.
For those who don't know, the magnetic track on a credit card actually has three tracks worth of data. Tracks 1 and 2 both have the account number; track 1 also has your name and perhaps some other stuff. I'm more familiar with track 2.
Track 2 has the card number, the expiration date, and something called "discretionary data." The discretionary data, so far as I can ascertain, is defined by the issuing bank or organization, and has no (publicly documented) inherent meaning - except "we'll cut your balls off if you store this for any period of time."
You can get away with storing the entire track worth of data if you're doing offline approvals, but once you get the approval, you had better ditch the discretionary stuff.
We do some fraud detection in the POS system with a SHA-1 hash of the card data. As you all (should) know, this is a non-reversible hash. We're so paranoid about the discretionary data that we only even calculate the hash of the card number and expiration date - we don't even include the discretionary data in our hash calculations!
The preferred solution is to not have a problem.
Kinda like everything except PHP has done for a decade? Very impressive.
I work for a company that provides the back end for loyalty processing systems. One day in 1999, the front end company complained to us that our system was rejecting their new cards, saying they had an invalid expiry date.
Now, ISO specification for track-2 on a magnetic stripe card is: the card number, then a delimiter, then an expiry date in YYMM format, and then freeform data to a maximum of 37 characters. There are tens of thousands of installed systems that read these cards and parse the expiry date.
But, in anticipation of the upcoming Y2K bug, this enterprising front end company had decided to write an expiry date of CCYYMM, without bothering to consult anyone, or let anyone know about it.
So, an expiry date of 200006 got a processing error, although dates like 200106 got parsed as January 2020 (rather than June 2001) so they at least continued to work.
Well, you might think, let's just turn off expiry date checking in the devices. Oops... due to the extra 2 digits, the track-2 now has 39 characters, so some devices will refuse to read it at all!
Hey, I bill by the hour, so why not?
They don't grade fathers, but if your daughter's a stripper, you fucked up. --Chris Rock
So we have:
- signature
- PIN
- biometric? anywhere?
- ID card?
In Spain we check (really) peoples card name against their ID card (or passport or driving license).
Signatures are so easy to copy and even original ones are never identical. It isn't better to check the person's identity with something with picture,signature and flourescent security marks (at least)?
Of course, there is nothing as usefull as stealing your wallet after using an ATM.
Whether or not your waiter is more likely to rip off your card than someone on the internet, it's a hell of a lot easier for somebody to use it online. No checking ID, no checking a signature, it's just easier.
My grandmother recently had her Mastercard number ripped off. Somebody was using it to buy diet items and a few other things at online stores. With a little hackery to hide one's IP, and a fake dropbox for delivery, it's pretty hard to trace. In a lot of cases I doubt even that much is needed depending on how well the merchant logs transactions. However, in the case of her number being stolen, it would have had to be at a store (or more likely the one time she ordered videos from a support-this-channel promo offer from cable TV) as she doesn't even have an internet connection, much less shop on one.
Also, the statement that "the internet is safer" tended to focus more on the single transaction (possibilities of somebody sniffing) that the more current reality of card databases being infiltrated or stolen en-masse online.
Still, I have heard that in order to protect their reputations, the card companies do go after fraudsters. I wonder how big a fraud it has to be before they consider it worthwhile.
CC #s were stored in DB and logs using clear text. Client information could be attached to Orders so one could retrieve enough information to impersonate. One client yelled at the boss for printing the full CC # on the receipt, which was against the client's state law.
I yelled at the boss for numerous such transgressions. But he didn't care enough to use Foreign Keys in a 100+ table database; so why would he care that CCs were unencrypted? What could I really do? I left (for a long list of reasons).
Though I still ponder my own moral obligations about telling the clients that their system is weak. I'm still unclear about the legal repurcussions or even how I feel about who is truly reponsible. If the vendor doesn't care and the client doesn't know (or care) then where do I stand?
1. Do not store magnetic-stripe data after any transaction authorization. This is because the full contents of track data,which is read from the magnetic stripe, must not be retained on any other system after a transaction is authorized. 2.Evaluate your current or pending payment applications. Do a thorough review of all payment applications to ensure non-storage of magnetic-stripe data.Make your evaluations frequently to be in a safe mode. 3.Immediately report an account compromise. If you suspect an account compromise had happened, alert all necessary parties especially confirmed security breach immediately. Provide all compromised Visa account numbers to your acquirer bank within 24 hours.I should remind all of you that the sooner you report your account compromise, the sooner you avoid any counterfeit fraud. 4.Make sure you know your liability for data security problems. Many merchant or acquirer contracts explicitly hold merchants liable for losses resulting from compromised card data if the merchant or service provider lacked adequate data security. So what can i say is an ounce of prevention is far much better what we will wind up paying in total liability for account compromises.
user
no wonder my data always get breached.
Practical Computational Intelligence Techniques for Handling Large Data Risks (Is this transaction fraudulent? Will this customer pay their bills?) Opportunities - (What is the expected profit of this customer? What product is this customer most likely to buy next?) The World Wide Web is a huge, distributed data warehouse - Data Mining is a critical enabling technology for information retrieval and knowledge discovery on this emerging data web. So what we can do? Disruption of Existing Procedures The introduction of any new system causes disruption to staff and will be treated with scepticism initially. Where the introduction of a document management system has been preceded by a proper re-examination of manual procedures, so that an inefficient manual system is not perpetuated electronically, the job functions of staff may change dramatically. This needs careful management, with induction training and technical support for a long period. Again the initial costs of the system will be inflated because of this, compared with the longer term running costs when the system has been running for some time.
The merchants might have doing site business where they cause the users secret key spread among outsiders.
Its hard to make sure all transaction secure because cracker is the one who motivated with all new security features that claim to be secure. So, how to prevent it??
1) Strong password (length 100++) => Off course the user cannot open it because too long to remember.
2) Use new and secure swap device => the irresponsible merchant will modified it soon or the merchant will put a camera from every angle and record the password.
3) Use a sql injection proof script => the web server will still faced DDoS attack
4) Use a finger based authentication and retina scan card => it's tooo expensive to produce for gold card holder
5) Dont trust the waiter to take your card, go and check the swap machine and look for any hidden camera => of course your friend will think you want to runaway and try to find excuses
6) Prison all crackers in an isolated => quite a number of people will jobless
----
What about data breaching from the inside?
..http://www.prnewswire.com/cgi-bin/stories.pl?ACC T=104&STORY=/www/story/02-08-2005/0002986646&EDATE =/
"The most likely threat to information security is not the typical hacker, virus or worm, but rather the malicious or careless corporate insider."
A study reveals that sixty-nine percent of companies reporting serious data leaks responded that their data security breaches were the result of either malicious employee activities or non-malicious employee error. In fact, the number one leading cause of data security breaches resulted from non-malicious employee error."
Read more here
How to deal with this?
careful and always be cautious when using the credit card to prevent our credit card from being fraud. don't be careless and be sensitive with people surround you.
Am I the only one who had to read the headline twice, wondering what Chris White had to do with data compromise?
R David Francis
change the stripe into colors to make them confuse. :)
Set a new standard on the servise provider to avoid the information breach