Why "Verified By Visa" System Is Insecure

angry tapir writes "A widely deployed system intended to reduce on-line payment card fraud is fraught with security problems, according to University of Cambridge researchers. The system is called 3-D Secure (3DS) but is better known under the names Verified by Visa and MasterCard SecureCode. Steven J. Murdoch, a security researcher at the University of Cambridge, and security engineering professor Ross Anderson contend there are several flaws with 3DS. One of their main points is how 3DS is integrated into Web sites during a transaction — e-Commerce Web sites display 3DS in an iframe."

Comments

Welcome to 3 years ago

[rnicey]

I'm in the high risk card not present industry and if it wasn't so painful it'd be funny how bad it is.

3DS solves problems for Visa and nobody else. It transfers the liability from the merchant to the customer. No more 'it wasn't me'.

Only problem is, it's crap.

Bit like the chip and pin problem in the UK which is a similar joke. If I can get your card and your pin I can go shopping as you and good luck trying to explain that to the bank.

If I can fool you into giving me your 3DS password somehow, I can shop online as you with great false trust, and the merchants don't care because they're protected. Kind of.

Most merchants refuse to deploy it anyhow unless forced. It causes a 5-8% immediate drop in throughput. I wouldn't use a site that used it either.

Re:Welcome to 3 years ago

[Ken D]

Exactly.
By claiming that it's more secure all they have done is made it that much harder for you, the customer, to be protected when you do get defrauded. I don't trust that its secure so I won't use it.

Pseudo-security => All Pain, No Gain.

Re:Welcome to 3 years ago

[Threni]

My Visa card was declined constantly when I was over in the States (from the UK) on business. I phoned my bank and they said it was declined because a chip and pin device wasn't used. Of course it wasn't - they don't have chip and pin in the states. So my Visa card is useless abroad? No matter - I had a Mastercard, which worked perfectly. No prizes for guessing which I'll be using in future.

Re:Welcome to 3 years ago

[Qzukk]

As a customer, the worst part is when the merchant doesn't bother to tell you "oh hey we're going to redirect you to this other site now" and first anti-XSS blocks the page transfer, then the page fails to work anyway thanks to noscript blocking the JS.

Even after I added all the appropriate whitelists, when I buy from a site that uses it, all it does is flash the logo up on the screen then take me back to the merchant's site where I finish the transaction.

Re:Welcome to 3 years ago

[zonky]

I was visiting the UK last month as a tourist. I have lived there, and moved away about 5 years ago, around the time Chip & PIN was first appearing.

Frankly, I was treated like some kind of crinimal subversive for presenting a credit card that didn't have a CHIP on it. I was told by some retailers (a Mobile phone co) that they could not except my card as ALL card HAD to be Chip & PIN. It took a bit of experimenting with other retailers for them to work out that if you inserted a non C&P card into the chip slot, it asked you to swipe it. Although, some terminals didn't have swipe-y bits.

It seemed to be a shock to many that not all countries have cars with chip and pin on them.

Many retailers refused to believe, or be able to sell to me if i didn't have a postcode. (i'm visiting. Why do you need a postcode? I don't have one!).

This was outside the main tourists bits perhaps- (West Midlands), but still...

Re:Welcome to 3 years ago

[thetoadwarrior]

Always call your bank / credit card company before going abroad. It will save you hassle especially if you don't travel. Anything that appears to be out of the ordinary will get questioned.

Re:Welcome to 3 years ago

[steelfood]

Plane ticket: $350
Hotel room for 5 nights: $500
Rental car for 6 days: $200
Broadway show tickets for two: $300
Finding out your VISA card doesn't work but your Master Card does: priceless.

Re:Welcome to 3 years ago

[jimicus]

You can't clone a chip, period. The devices which read them are tamper resistant and tamper evident. It's not been cracked yet. It's been done really well - unsurprisingly, because the stakes are so high.

Really?

You'd better tell the people whose chip cards have been cloned.

Re:Welcome to 3 years ago

[Threni]

Your problems are all related to the desire to stop fraud. You're not a subversive - you're just a little unusual. If you use a mag swipe and the card turns out to be stolen, the store loses out. So, unsurprisingly, some stores would rather not serve you. With chip and pin, they'll not lose out if the card turns out to be stolen/fraudulently used. Ditto the post code - they wanted it so they could check it against the postcode the card is registered against. In the perfect world the store staff would know some people, especially tourists/foreigners, don't have chip and pin cards but really the store staff don't give a shit about you - they're just there to get paid, and frankly don't care whether you buy anything or not. I'm sure the store managers are a little more concerned you have a good time, but you're just going to have to get used to being asked awkward questions, or perhaps pay cash.

Re:Welcome to 3 years ago

[Anne_Nonymous]

Also:

1. Always carry more than one card (one each of Visa and MC for example).
2. Don't bother with AMEX or their Traveler's Checks, since neither is accepted as widely.
3. Make sure your PINs don't contain any 1's or 0's (some countries disallow those numbers).
4. When withdrawing money, use the ATMs of worldwide banks rather than local banks (BNP and HSBC work especially well).
5. Carry the overseas phone number of your cards' banks somewhere else besides your wallet or money belt.

Re:Welcome to 3 years ago

[scamper_22]

There's a very easy solution to this problem. I'm sure they have similar system elsewhere but Interac (debit card) in Canada allows you to pay online. I use it for shopping at ncix.com for example.

You setup an account with the merchant.
You do your shopping... add to card... go to checkout... they give you a bill.

You then log into your online bank separately! and from your bank account you transfer money to the merchants account.

The merchant never sees your password and phishing is near impossible because you have to logon to your bank account separately. It's a bit inconvenient, but it's a much more secure system. You don't even have to trust the merchant as they never see your password info. They just wait for the money.

There's no other way to really do it. even if the showed a URL in the Verified by Visa scheme, you would still need to check it... a shady merchant could fake it...
About the only other way would be to have some trusted authorities built into the browser (like we do with certificates). The site can request the browser to 'bring up secure payment for visa'... and it handles it with a non-webpage login/payment system.

Re:Welcome to 3 years ago

[jimicus]

But cloning a chip should be very difficult without destroying the card and having long term access to the card. Even then it should be very difficult. Are there any demonstrated examples of criminals cloning credit card chips (or extracting the private cryptographic key)?

I did look a bit further after posting.

It would seem that the chips aren't cloned in their entirety - however it is possible to create a fake card which is good enough to fool some machines in some circumstances.

There may be be proof of concept demonstrations done by researchers, particularly on satellite cards, but has it been found in the wild for credit cards? And has it been verified, not just a crooked card holder falsely claiming his card was stolen?

Of course cloning the magstripe shouldn't do any good without the chip.

There are some instances of magswipe readers being attached to cash machines. The data isn't much good in the UK (it identifies that the card has a chip, and most if not all UK cash machines read the chip) but it is enough to create a fake card with just the magnetic strip and using it in a country where chipped cards are unknkown.

Are some locations accepting cards with only a magstripe and pin and non-functioning chips?

Not possible unless you're the bank - the magstripe doesn't contain the PIN. The verification process is "card reader asks the chip if the PIN supplied is OK. Chip says either yes or no". Incidentally, this is a weak spot - build a chip which always says "yes" and suddenly you don't need the cardholders' PIN.

While these chip and pin systems might tend to shift liability to the card holder, the reduction in the number of frauds might nevertheless make it cheaper for the card holder anyway.

Banks have not reduced their charges as a result of this system - indeed, most personal UK bank accounts are free of charge anyway. Where you get charged is if you have a business bank account or if you exceed your overdraft limit - and if you exceed your overdraft limit, boy do you get charged.

The American system of giving every merchant and his employees all the information needed to max out your credit card account, seems almost insane. Chip and pin and or a push system of payment like paypal, makes a lot more sense to me.

Better, yes. However, the banks are (or at least were originally) taking the line that it's 100% cast-iron foolproof, which is obviously balls.

Re:Welcome to 3 years ago

[orlanz]

I am a long time credit card user (don't believe in cash). I ran into this a few months back with Walmart online. It actually looked like a scam. And you are right about the security aspect, just an offloading of (increased) risk. It pops out of no where and the new page's instructions clearly said it was optional and I can hit cancel. BUT, there was no cancel button, I even looked in the source code. So I closed the browser.

This was considered _fraudulent_activity_ and locked my card for a while (automatic, no warning). I basically had to tell them: I don't want to sign up for the "optional feature" and I leave it to you if you want to keep my card locked. I just started using my MC. A Visa card that used to get charged 2-3k a month in business charges now gets about $50. I think Visa completely, utterly screwed up with not only the idea, but the implementation, and the very approach of presenting the system. A colossal failure for Visa and a big win for MC. If MC starts it, rest assured, I will move to Discover and so on with Paypal at the end.

A credit card is supposed to provide you with security and convenience. This system gives you neither! Now, you basically have the risk of a TON of cash sitting behind yet another password only _you_ are supposed to know. There are better ways to provide FAR more security with a negligible loss of convenience at a slightly higher price (ex: personal and one time pins), but I guess Visa just wanted to waste money tricking its customers into accepting a lot of the merchant's and Visa's risk.

Re:Welcome to 3 years ago

[jonbryce]

Tell them it is SW1A 2AA, and when they ask for the house number, tell them it is number 10.

Re:Welcome to 3 years ago

[TheRaven64]

Merchant banks will only guarantee the transaction with the chip and pin. If you don't (or can't) use it then the retailer will be liable for fraud. Big shops, like Tesco, will not care because it's better for them to eat the cost of fraud and maintain good customer relations. For smaller shops, it might cost them their profit margin to accept it.

Re:Welcome to 3 years ago

[mrcaseyj]

It would seem that the chips aren't cloned in their entirety - however it is possible to create a fake card which is good enough to fool some machines in some circumstances.

The machines that would take a cloned card are probably the ones that will work with only the magstripe. That would protect the card holder somewhat against fraudulent charges, especially if the charge was in another country. You still might have a hard time getting your money back if your pin was used though.

Are some locations accepting cards with only a magstripe and pin and non-functioning chips?

Not possible unless you're the bank - the magstripe doesn't contain the PIN. The verification process is "card reader asks the chip if the PIN supplied is OK. Chip says either yes or no". Incidentally, this is a weak spot - build a chip which always says "yes" and suddenly you don't need the cardholders' PIN.

In the US cards don't typically have chips. They only have mag stripes. But ATM cards work with a pin even though they don't have a chip. The card reader pin pad encrypts the pin after it is typed, and sends it to the bank and the bank confirms if the pin is correct. No chip is needed in the card. I assumed UK cards could work similarly with regard to the pin, though with additional protection provided by the chip. With the pin being stored only at the bank and in the card holder's brain, it doesn't matter what the card says about the validity of the pin. The card need not even know what the pin is.

While these chip and pin systems might tend to shift liability to the card holder, the reduction in the number of frauds might nevertheless make it cheaper for the card holder anyway.

Banks have not reduced their charges as a result of this system - indeed, most personal UK bank accounts are free of charge anyway. Where you get charged is if you have a business bank account or if you exceed your overdraft limit - and if you exceed your overdraft limit, boy do you get charged.

The reduced fraud costs might not show up in direct charges. Merchants competing on price could reduce retail prices with lower fraud and negotiate lower merchant fees with card companies who would also have less fraud costs. And credit card interest rates could also be lowered a little. On the other hand, saving one percent on all your purchases might not be much consolation if you're one of the unlucky few that gets stuck with a fraudulent $10000 bill, because chip and pin allowed the bank to transfer the liability to you. It must also be remembered that banks don't always make it easy to get your money back even if chip and pin isn't used. If the charge is from Nigeria, then they'll probably have to give you your money back, but if the charge is made locally or shipped to your house and intercepted, you might have a hard time convincing them it was fraudulent. Chip and pin would probably drastically reduce such charges. I expect chip and pin and this verified by visa thing would be beneficial to us card holders over all.

The real solution to this though is that cards need to have a display and pin pad on the card. That's hard because they're thin, but the system would be much more secure. A fake pin pad would not be able to capture the pin (though a camera still might). And the card holder could see on the display who the payment was being sent to and how much was being sent. Such a system could even be used on a poorly secured home computer without much worry, since no transaction could take place without the card holder physically authorizing it and seeing the amount and destination on the card's secure display. If the card's operating system was simple enough, it would stand a reasonable chance of being virus proof.

Re:Lol

[tatsuyame]

It's not. I tried making a purchase on newegg, got the the Verified by Visa page, but the frame didn't show anything. Assuming that the purchase wouldn't go through, I tried making the same purchase on my other computer. Frame loaded, entered password, purchase went through. However, the first purchase went through, even though I never entered the password for that one. So yeah, I'm guessing it doesn't really do anything to protect you.

I'd rather use

[sconeu]

Single-use CC numbers. But my Visa (issued by my Credit Union) doesn't have one, and AMEX doesn't do them any more.

Re:I'd rather use

[pdbaby]

There are enough numbers. Each issuer has 1 trillion numbers and there's about a million possible issuer numbers... there's a useful description of the anatomy of credit card numbers at http://www.merriampark.com/anatomycc.htm

Re:Lol

[Kamokazi]

I used my Visa instead of my usual MC on Newegg for a Christmas gift and it came up for the first time ever. I closed the widow intending to buy it on my MC instead, but the payment still went through. 2 days later I got a call from the Visa fraud department...haha. I told the lady the verified thing was a bullshit pain in the ass and she let me on my way. Haven't used my Visa since.

It's all the wrong system anyway

[Anonymous Coward]

The "verified by visa" password is just another password that can be stolen. If you accidentally reveal information to the wrong person, your account is completely compromised. That's how it was before "verified by visa", and that's how it is now. The correct solution would be to use public key cryptography, where the credit card has an associated secret key, known only to the user (not even the credit card company). That way, the credit card user never has to reveal any secret information to anyone. The entire transaction can take place unencrypted, because any listening attacker (or malicious employee of the merchant) can't get the private key. They can only get the public key, and the digital signature of the transaction. There's no way to use that information to make fraudulent transactions.

Re:Lol

[FlyingBishop]

No, because it's in an iFrame it's less secure than having nothing at all. When you're pulling data from two different sites on the same page, it's much easier for a third party to insert their own fields without you knowing.

Mastercard gives me Virtual Numbers for online use

[JoshDM]

I go to the Mastercard website and request a virtual number. I can specify amount and expiration time (in months). It is linked to my credit card and once I use it at a merchant, that number can only be used at that merchant for up to the amount I specified. I love it.

Meanwhile, a few years back I had to implement Verified by Visa, Mastercom, and Paypal solutions for the checkout process for the company I worked for. Paypal was the easiest and the other two were crappy. I'm not sure how they've worked out in the years since, but you don't see me using them currently. Virtual Numbers all the way.

Insecure != Unsecured

[Anonymous Coward]

Can we get this right, once and for all? Something that is unsecured is vulnerable to a security breach. However, something that is insecure is in an emotionally anxious state.

I chuckle every time I read about an "insecure document." I imagine a document harbouring feelings of self-doubt and a lack of confidence. "Am I really a document? Will people like to read me? Does this file format make me look fat?"

Re:Insecure != Unsecured

[pjt33]

I would understand "unsecured" to mean "no-one has attempted to secure it". If they've attempted and failed then it's badly secured and insecure.

Re:Insecure != Unsecured

[pjt33]

But if I lock it with a 50 cent padlock then it's locked, but extremely easy to open.

it kills sales

[Anonymous Coward]

We had it forced on us by our payment provider and it killed sales, we had so many customers asking what their password was and where do they find it. We opted out of it.

Re:Recomendations?

[DCstewieG]

Discover passes all these, except for being Discover. I'm able to use mine for 99% of purchases.

http://www.discovercard.com/customer-service/security/create-soan.html

Re:I switched credit cards

[pavon]

I thought and still think that it is dumb to encourage consumers to type confidential information into a random pop-up page from a different web site than the one they are visiting.

No kidding. What is worse is that every time I have been shown the verification page isn't wasn't even hosted at something obviously legitimate like verify.visa.com, but rather the domain was some other corporation related to Visa (can't remember the name right now).

What Is The Point Of 6 Digit Password?

[tunapez]

I've used the service 3 times...guess how many times I've set/reset my "Verified by Visa" password. Rather than allow for a secure password(8+ characters, alpha-numeric-symbol) I am limited to 6 digits and remember yet another non-standard password? Might as well throw a captcha AND a question to doubly verify I am not a bot, too.

You don't even need the password

[beneppel]

I recently forgot my verified by visa password - the only security question it asked me that wasn't printed on the card was my date of birth - it's not the first time I've had to reset my password, and each time the question is the same. That means if somebody has my card, all they need to know is my date of birth, and they can reset my 3DS password easily.

Re:Recomendations?

[prestonmichaelh]

I would recommend the Citi Forward Card:

http://creditcards.citicards.com/usc/citiforward/single/external/affiliates/Q309/rewards/default.htm?app=UNSOL&app_COL=COLLEGE&sc=46EZA3U9&sc_COL=4CECA3T9&m=90J600000ZW&langId=EN&siteId=CB&B=V&screenID=3124&link=Consumer_15687859&ProspectID=94A073FC70EB478AB75EF008227CD425

I have had it for a while now and things have been good. It has virtual account numbers like you wanted that you can set either a time limit, spending limit, or both on. It has basicially everything thing else in your list as well. You can even dispute charges online without having to call anyone (just finished this and the charge was reversed within 2 days without me having to talk to anyone on the phone). It also does have pretty nice rewards anyway, fairly reasonable interest rates, and an interest rate that will drop by .75% after 3 months on-time payments. You can also set it up to auto-pay or "pay on demand" via ACH from your bank (enter your routing and account number). Anyway, I generally think of Citi as a pretty big corporate evil, but this card, so far, has been pretty good.

RSA keyfobs in credit cards

[ehud42]

I would like to see my credit card display a time sync'd rolling number instead of the lame 3 digit code on the back of the card. As I see it, the problem with credit card fraud is not stolen cards, but stolen numbers. If I lose my card, I will know fairly soon and can have the card canceled. However, it may take quite a while to determine my number has been compromised. When shopping online I would like to enter my card number and a second number generated by the card. Cards expire after 2 years, so this should be doable from a battery life point of view. It could even be introduced as an extra fee initially to those who want the extra online shopping security.

Re:I switched credit cards

[Anonymous Coward]

In the UK, the server's domain name is securesuite.co.uk. How is the average user going to be aware that the domain is legit? Furthermore, most merchants seem to use iframes (seen some popups too) so you can't even see the domain unless you right-click->properties. Pretty stupid.

Activation During Shopping

[epine]

My GF's great-grandmother passed away in November. She was very close.

Weepy GF gets onto the web site of a regional Canadian carrier that prides itself on its customer service, selects her flight, and begins to fill out the VISA information. After filling out most of the information she clicks "continue" and *bam* up comes VISA's activation during shopping page (ADS) with a giant "I agree" button under inscrutable masses of legal fine print. She is in a fine state of mind for clicking her life away.

This happens right in the middle of the transaction, with no advance warning. Not on the page before she began filling out the details: to complete this transaction with your VISA card, you will be obligated to click "I agree" to the ADS terms of service, which shifts VISA's liability onto your shoulders and plays havoc with established web security practices and altogether makes the world a shittier place.

All of this under the commercial maxim that instant gratification == learned helplessness. Your average user will blindly click anything during gratification interruptus.

As it happens, my red-eyed GF muttered out loud "WTF is this?". It took me about 30s to get past "HF those sleezy MFs". Then I told her to slam down the virtual circuit on her half-completed web page transaction and start the transaction over again using an aging circuit-switched technology far less suited to rights erosion, and also more expensive for the airline to provide. Real human at the other end. What a PITA.

Brilliant lose-lose for everyone involved.

Two of the links I recorded checked this out:
Links More Banking Stupidity: Phished by Visa
Verified by Visa: British banks phish their own customers - Boing Boing

Redacted portions of an online TOS from a large Canadian bank which has since gone 404.

You agree not to: modify, adapt, sub-license, translate, sell, reverse engineer, decompile or disassemble any portion of the Verified by Visa Website or service or the software used in connection with Verified by Visa.

You agree to immediately notify us by contacting us, as we require in our cardholder agreement with you for a lost or stolen card of any unauthorized use of your password or other verification information, or any other breach of security. You will be liable for any unauthorized activity involving use of your password or Activation Data, until we receive such notice.

Answer me this, Batman:

How is one supposed to notify the bank that you've lost control over the password, when you lose control to a phishing widget embedded in a concealed iFrame?

I wrote that riddle back in November, and I'm no closer now to coming up with the solution. FWIW, this agreement is probably less egregious than the one that came up under ADS, from a different major Canadian bank. Bonus marks for completing this task without first discovering how the service works which violates your TOS.

This whole thing makes me seriously limbic.

Larry Lessig on laws that choke creativity

And on the other side, among our kids, there's a growing copyright abolitionism, a generation that rejects the very notion of what copyright is supposed to do, rejects copyright and believes that the law is nothing more than an ass to be ignored and to be fought at every opportunity possible. The extremism on one side begets extremism on the other, a fact we should have learned many, many times over, and both extremes in this debate are just wrong.

For the good of society, the law ought not to be an ass, and the VISA company ought to not be pushing the matter like a used car salesman at the helm of an invincible glass castle.

Re:Lol

[Trails]

Security is about tradeoffs. So, let's be clear. iFrame = bad, I agree with you. But let's take it further, let's look at what you're getting. I've hit verified by visa a couple times, I always forget my password. In part, my standard repetoire of passwords don't work because it only accepts letters and numbers, my passwords often contain various symbols. In other words, the limitations on the password characters limit the number of possible passwords. Not great, though not as bad as the iframe thing. So I use the "forgot your password" flow everytime. The genius thing about that is that it asks me stuff I'd already entered on the retailer's purchase form. There's no additional info required, it's all fairly standard "accessible" user profile info, but for the re-entering of the card details. So, to be clear, from a quantitative aspect we have 1 bad and 1 "not so hot". But what have we gained? Nothing!!! It's online security theatre. It's about as effective as a Dutch Airport security officer.

Re:I just use Paypal

[Neoprofin]

Unless Paypal decides to shut down your account for no reason, or drain more money from the bank account than you've ever put in it for obvious reasons. Both of these are quite common if you've been following any of the Slashdot stories about Paypal.

Re:Recomendations?

[sgtrock]

MBNA'a (now owned by BofA) ShopSafe.

No surprise

[sjames]

The entire financial industry is about 2 things. First, skimming a few cents off of the top of any financial activity they can get their claws into and second, pushing any and all risks and costs onto the public.

Get wiped out by high risk loans? Get a bailout. Credit reporting systems so flimsy they can't even tell two people in the same apartment building apart? Spawn an entire industry for people to fix it at their own expense. Can't be bothered to implement a secure credit card system? Either make it the merchant's problem or the consumer's. Someone defrauds you out of some money? Demand it from the person they impersonated and tell them it's their problem (cost and obligation) to fix it (even though they're not the ones sending credit offers to dogs and toddlers).

In a just system, credit agencies munging data together based on practically nothing would be guilty of libel if they wrongly claim you're a deadbeat. Creditors would be obligated to show that you personally are the actual person they extended credit to before they could try to collect. There would be no such thing as "identity theft", only the usual run of the mill fraud.

In such a system, the banks would make sure credit card transactions were as secure as they could practically be because THEY would lose out when it fails.

Re:Lol

[Wintermute__]

My Chase MC and Visa required this to be setup and crazy passwords too, which I can't recall. I rarely use my Chase cards anymore as a result.

See that! You're more secure already!

And you doubted the value of this valuable security feature...

Re:Lol

[mr_lizard13]

I've often wondered about that. When presented with the 'Verified by Visa' screen, how do I know it's the real thing?

What's to stop a dysfunctional e-store using a mocked-up version of that screen to collect my online PIN?

Airport Security

[Xeleema]

Well that's good news, because the American ones like to plant drugs as a practical joke.

Bank fucked up

[Nicolas MONNET]

Chip cards have been in use for a very long time in France. They all have mag stripes, mainly because that's what most ATM use anyway, but also for use abroad. The mag stripe contains information as to whether the card also has a chip, so that even when an authorisation (the terminal phoning the acquirer) is not required, it can decide to deny the transaction preemptively if the card is supposed to have a pin and the terminal is supposed to be able to read it.

In that I case I guess the bank is just being incompetent, and failed to implement the ultra-advanced algorithm:

if (card.haschip() && terminal.haschipreader())
        return MUSTUSECHIP;
else
        return ITSOKTOUSETHEMAGSTRIPE;