Slashdot Mirror
Encrypted PIN Data Taken In Target Breach
New submitter danlip writes "Target has confirmed that encrypted PIN data was taken during its recent credit card breach. Target doesn't think they can be unencrypted by whoever may have taken them, because the key was never on the breached system. The article has no details on exactly how the PINs were encrypted, but it doesn't seem like it would be hard to brute force them."
Another article at Time takes Target to task for its PR doublespeak about the breach.
Is there a good reason for keeping this that I'm not seeing?
When 25% of the pins encrypt to one string, and 25% to another, we'll know they used a symmetric cipher with a fixed key, and that one batch is "0000" and one is "1234".
How hard it would be to decrypt, knowing that each pin is exactly 4 digits?
I would think if salting was not using, it is just a matter of the time.
The article I read stated that the key necessary to decrypt the data was never on the systems which encrypted the data, then went on to state that the data was encrypted with triple DES. Oh my lord. Which is it? Symmetric or asymmetric encryption?
That depends. How understanding will your landlord or your bank be when your rent or mortgage check bounces because the day it was deposited somebody ran up charges on your debit card that emptied your bank account? Sure you'll be able to dispute the charge, but that didn't stop the checks from bouncing between the time it happened and the time you got to the bank to fill out the paperwork on the fraudulent charge. Same if you're at the end of a trip and go to pay your hotel bill and your credit card's over limit because of fraudulent charges. Sure you'll be able to dispute them, but that doesn't make the hotel bill magically paid.
Why combine something you know with something you have? I thought only banks stored pins?
If you ignore ACs because they are anonymous - you're an idiot.
OK, that's fine, but how is PIN code useful? Can't you just order on the web with your credit card without any PIN code? Can't you just pay for speedways in at least France and Italy without PIN?
To be honest I am wondering why there is even a PIN code on those cards given there are so many ways to use them without entering the PIN code.
The trip a card purchase takes from your physical card to the merchant bank is actually pretty convoluted -- the simplified explanation is that a card purchase with PIN has a lot fewer safeguards and security checks than an online purchase with card, address and CV only. For card purchases where only the number is used, the vendor assumes a HUGE amount of liability. It often makes sense for fast food vendors and such, where the transaction values are small and they get a significant uptick in sales for shorter transaction times, but for purchasing big ticket items, you either do chip+pin or track 1 data plus second factor (usually stored by the vendor).
So the even shorter answer is: PIN codes mean relative anonymity. Without the PIN, you need to provide other PII at some point in the transaction.
PIN are supposed to be encrypted on the terminal (not on the POS computer but the actual card reader/terminal) using Triple-DES Derived unique key per transaction (DUKPT - http://en.wikipedia.org/wiki/Derived_unique_key_per_transaction ).
So no the PINs are safe unless the card terminals have been hacked too.
To my knowledge the laws that protect consumers against fraudulent credit card transactions don't apply to debit cards. Banks make a lot of promises about zero liability on debit cards but you'll have to read the fine print and beg for mercy when the time comes.
They didn't get anything onto the card readers from all that's been published publicly so far. Most card readers these days will encrypt the pin *before* sending the data to the terminal. Thus, only getting encrypted pins.
Given that the terminals run windows, it's not that difficult to get some malware to spread to them from a central source. Could still be an inside job for sure, but none of the details published yet can confirm that for fact.
When I've had issues, some quick arguing with the bank got money invented from nowhere and put in my account. Yes, it would delay the checkout from the hotel by a few minutes, but it will get the hotel bill paid. I'm sure you can find some cases where someone was a jackass to their bank, who then refused to fix the issue on the customer's time frame. But I've had this issue before, and the bank took care of it outside the minimum contractual requirements.
Learn to love Alaska
I think they meant to say the key was stored on somebody's Nintendo 3DS.
"Unheard of means only it's undreamed of yet,
Impossible means not yet done." ~~ Julia Ecklar
What was Target collecting credit card numbers AND PIN numbers for? What business purpose did they need that data for? Why has no one raised this question? They have just created a huge credit theft problem for their customers. This is a shining example why businesses should not maintain any database of sensitive customer information.
I already suffered identity theft and credit card theft in the past and I'm not at all anxious to go through that again. I'm taking my business elsewhere. In fact I may avoid large national chains for this very reason.
Eternity: will that be smoking, or non-smoking? I Corinthians 6:9-10
How did this breach happen? What were the mechanics behind the data theft? Was the server hacked? As it firmware in the POS registers? How did this happen?
Windows corporate networks almost always operate on the idea of protecting the perimeter, and leaving the inside horrendously insecure... For something like a retail store, where the general public have physical access to the building that idea breaks down very quickly... You only need to have momentary access to a network socket/cable, and these will often be available at random points on the shop floor or at the very least at the back (i.e. facing the customer) of the pos terminals...
Once you're on, chances are all the windows boxes are on one domain making them a very easy target.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
triple rot26
Sleep your way to a whiter smile...date a dentist!
the usual. an excel spreadsheet on a computer running bittorrent in the background.
at least they put a password on the spreadsheet.
Sleep your way to a whiter smile...date a dentist!
Your response is orthogonal to the question. Your example is not that of bounced checks, it is of trying to use a debit card at point of sale when the balance was low.
It is an entirely different thing to write a check and then have it bounce 3 days later. There are all kinds of fees and penalties that get assessed when that happens, some of which can come from the company you wrote the check to, the bank never even sees the penalty. There are even non-monetary penalties like your landlord, or your utility company reporting the bounced check to the credit agencies.
There really is only one reason to ever use a debit card - your credit is so bad that you can't actually get a credit card. In all other ways credit cards are the superior tool.
When information is power, privacy is freedom.
In case you aren't familiar with major U.S. retail chains, it's a breach of the payment processing systems of Target Corporation. An unrelated Australian company operates a chain called "Target." (with the period) under license from Target Corporation.
I think you can safely assume that when a Slashdot poster talks about a legal problem, a problem with consumer protection or issues with the health care system, they are either talking about the USA or, perhaps, North Korea.
Faster! Faster! Faster would be better!
Can anyone tell me what operating system and software that Target uses?
I'd really like to know what exploits this software has and if any other store uses them so I can avoid shopping there.
I think retailers and wholesale clubs ought to be transparent in what operating systems and software they use for their POS system and then list the vulnerabilities they found with an code audit and how they plan to fix them.
This ought to be a law, so consumers can be protected from retailers and wholesale clubs who don't care about their privacy and credit card and debit card data and just use operating systems and software with exploits in them that they never tested nor figured out how to fix.
I think the same should be done with websites as well.
Am I right here or wrong?
Remember, Slashdot does not have a -1 disagree moderation, and no, troll, flamebait, and overrated are not substitutes.
The article also says "Target does not have access to nor does it store the encryption key within our system." The problem is that 3DES is a symmetric encryption algorithm; both parties need to share the same key to encrypt or decrypt anything. So at some point, they needed to have a key for the transaction.
The way the system works, the 3DES key is embedded in the pin pad which is sealed against tampering. It is also held by the processor (who owns the pad). In this way, the merchant never knows the key, and so only holds the encrypted PINs.
What I'm waiting for is the moment when some criminally minded individual realizes that "targeting" vendors isn't the way to go, and instead starts APT attacks against the processors -- suddenly, you can pick and choose what data you take, and have access to all the processing information required to make, modify, and revoke transactions. Next stop... compromising the credit companies themselves.
Information about debit cards are NOT shared with anyone outside of the issuing bank.
I find that impossible to believe when the exact same processing system is used for both credit and debit cards.
Hell, there are even "rewards" programs for visa and mastercard branded debit cards. I think you would be hard pressed to explain how visa can do that without knowing your spending.
http://usa.visa.com/personal/cards/debit/visa_extras.html
When information is power, privacy is freedom.
Credit cards are in fact better than a debit card in one way: the money doesn't actually come out of your pocket until you pay your bill. With a debit card the money's gone and you're trying to get it back (and the fact that the bank tends to be cooperative doesn't change this dynamic). And the old adage about possession being 9/10ths of the law does ring true here: it's much easier to keep what you have than to get back what you don't.
When away from home, I have the 800-number for the bank. On the card. When I travel internationally, I put a stickey-note on every card with the bank's toll-free numbers from every country on my itinerary. Reaching the bank isn't an issue while on the road. I've never had someone ask for ID over the phone. At most, they ask for your most recent transaction, and standard account info anyone would know off the top of their head, like SSN and address.
Learn to love Alaska
Provided it is CPA and KPA secure (chosen plaintext attack, known plaintext attack) then it's as hard as brute forcing the keys.
However the ANSI X9 series crypto specs and the PCI-DSS stuff, the banks and card processors use are hardly the best available. They might be secure, but without specifics of what crypto profiles the devices were using, you cannot be sure.
I should use this sig to advertise my book ISBN-13 : 978-1501515132.