Mobile Payment Industry News

Friday, April 17, 2009

Personal Identification Numbers, or PINs, are supposed to provide secure authentication for bank cards. Unfortunately, they are increasingly failing to do so. - Chad Perin from the Tech Republic Blog

Most of you have probably heard about ATMs with skimmers mounted over the card slot that can read your card on the way in and out of the machine, with carefully placed cameras to read your PIN as you type it in. The person setting up this little trap can then clone the card with the skimmed data, and with the pin gets access to your bank accounts. The first time I remember hearing about that method for cracking PIN security on bank cards was in the early ’90s, so it’s not exactly a new technique.

More recent developments in bank card security cracking include malicious phishing Websites, cross-site scripting, and legitimate Websites that have been directly compromised by security crackers. It’s an especially disturbing phenomenon because bank cards don’t usually have the same zero liability protections as credit cards — a fact most users of debit cards don’t think about when they use their bank cards the same way they’d use credit cards.

A new, and even more disturbing, security vulnerability for bank cards has arisen.

A research fellow at the French National Institute for Research in Computer Science and Control (say that five times fast) named Graham Steel wrote a paper in 2006 that addressed vulnerabilities in the hardware security modules that tie the bank card authentication network together.

The paper, submitted to British HSM manufacturer nCipher, provided guidelines for hardware security module configuration that would help mitigate the vulnerability of the devices to attack, but it also pointed out that other aspects of HSM vulnerability were inherent to their design. To really and truly fix the problem of HSM vulnerability, the devices would have to be fundamentally redesigned in a manner that is not backward compatible. Payment processing networks across the globe would have to be reimplemented using a different, improved standard.

HSM manufacturers such as Thales-eSecurity maintain that they address the security vulnerabilities addressed by Steel’s paper, but thus far they seem to be taking an approach remarkably similar to the way Microsoft OSes are “secured” against viruses. Other reassurances that HSM manufacturers are seeing to our security involve statements about how the devices are delivered in a very secure configuration by default, which is all well and good if you don’t need them to actually do much. Unfortunately, most payment processing transactions require functionality to be enabled that exposes the devices to significant potential for compromise. As Brian Phelps of Thales-eSecurity put it, according to the Wired article PIN Crackers Nab Holy Grail of Bank Card Security:

It’s a very difficult challenge to protect against the lazy administrator. Out of the box, the HSMs come configured in a very secure fashion if customers just deploy them as is. But for many operational reasons, customers choose to alter those default security configurations — supporting legacy applications may be one example — which creates vulnerabilities.

He went on to confirm Steel’s estimation of the scope of the problem, saying that redesigning the payment processing system to comprehensively address the current vulnerabilities due to legacy systems compatibility needs “would require a mammoth overhaul of virtually every point-of-sale system in the world.” If this doesn’t send a chill down your spine, either you aren’t paying attention, or you don’t actually use a bank card.

It is only recently that verifiable incidents of PINs being skimmed from HSMs, either gathered unencrypted from the device’s volatile memory or picked up as encrypted PIN blocks and decrypted. In some cases, at least, the decryption is made possible by the fact that the HSMs themselves contain decryption keys, and once one encrypted PIN block is decrypted it becomes much easier to decrypt the rest of them.

At first glance, one might think that the idea of storing decryption keys on devices scattered around the country that relay PINs from point to point using a model conceptually similar to Internet routing itself should have been immediately recognizable as a bad one, thanks to the example of the inherently flawed concept of digital DRM. Of course, the design of payment processing hardware security modules predates the AACS key for HD-DVDs, the Sony DRM rootkit, and Microsoft’s WGA. HSM designers get a free pass on learning from the mistakes of others, although the fact the mistake was made in the first place should have been avoidable.

For the most part, the problem is the way HSMs pass PINs around, tend to have scads of unnecessary features enabled at any given time, and contain the keys needed to decrypt the encrypted PINs. A couple of key points include:

End-To-End Encryption: The PINs should be encrypted and decrypted only at the end-points. Encrypting and decrypting anywhere between those points just increases the options for unauthorized interception.
Private Key Encryption: Using standardized encryption keys is tantamount to criminal negligence in this age of private key cryptography. Each and every end-point, including the bank cards themselves and the receiving systems that need to authenticate a request, should have a private and public key set. This way, you’d only be able to read data if you’re one of the unique end-points that is supposed to have access to it.

As things currently stand, however, the likelihood of the system being overhauled is pretty slim due to the immense cost that would be involved in replacing an entire global payment processing network with an incompatible standard. As a result, this problem is likely to be addressed only in a superficial, “it works right now and that’ll have to be good enough” manner. In many cases, it may not even be secured that well. Be extremely careful where you use your bank cards in the future. While liability protection for credit cards tends to be better than for debit cards, even there you should be wary of the potential threat.

Chad Perrin is an IT consultant, developer, and freelance professional writer. He holds both Microsoft and CompTIA certifications and is a graduate of two IT industry trade schools. Read his full bio and profile.

Shares of Major Credit Card Companies Mixed

Sector Snap: Credit card companies mixed - Forbes.com

Associated Press
Sector Snap: Credit card companies mixed
Associated Press,

Shares of major credit card companies were mixed Thursday, as several analysts warned that ongoing credit deterioration and a decline in consumer spending will likely pressure earnings for some time.

Investors got some mixed data about credit card losses Wednesday: Capital One Financial Corp. said its U.S. and international credit card defaults jumped in March, but American Express Co. said defaults in its U.S. card unit rose only slightly. The latter report indicated that some cardholders may be having an easier time paying their bills.

Visa shares fell 99 cents to $58.12, while MasterCard dropped $3.99, or 2.4 percent, to $161.47.

Read the Entire Article at Forbes

Visa, MasterCard, Discover, American Express, Capital One

Visa Aquarium :60 Second "Tuesday Afternoon" Commerical

The Moody Blues "Tuesday Afternoon" is the song used by Visa in their Aquarium Ad. If you want to hear the entire song, scroll down for the "extended version" of Tuesday Afternoon.

I've got a lot of questions in the comments section regarding who sings it and what's the name of the song, on a post I did back in early March, about Visa's new Go with Visa campaign. "New Visa Commercial: Aquarium

So I thought I'd bring you the :60 second commercial. Here it is a long with a post from Zoo and Aquarium Vistor's Rudy Socha:

Should You Use Your Visa Card When You Visit An Aquarium On A Tuesday Zoo and Aquarium Visitor News

Should You Use Your Visa Card When You Visit An Aquarium On A Tuesday?

By Rudy Socha

Lorain, OH - Recently as part of its GO global advertising campaign Visa ran an ad showing a father taking his daughter to a public aquarium. The commercial was very well done and would have great appeal to young families with children, especially those who regularly visit zoos and aquariums. The tag line asks “When was the last time you took your daughter to an aquarium on a Tuesday?”

There are many branding messages implied by Visa being associated with a family visit to a public aquarium. The most prominent message is “Visa enables your visit”. Visa wants to be thought of as synonymous with a visit to a public animal attraction.

There is a very good reason for Visa doing this as a component of their global ad campaign. Each year more than 200 million Americans visit animal attractions. Worldwide attendance is close to 800 million.

The image of a parent taking their child to an aquarium is very positive and there are a lot of positive connotations associated with this industry. Today’s animal attractions in the United States are associated with conservation, wildlife preservation, environmental education, and overall have the “Green” image every company desires.

Continue Reading

Visa Aquarium, Moody Blues, Tuesday Afternoon

Google, Green Dot, MasterCard, Visa, Western Union in Online Payment Suit

If you can't compete, file a patent-infringement lawsuit!

Actus a Texas Hold'em company, is gambling that it could win big. Oops...did I say Texas Hold'em, I meant Texas-based patent-holding company Actus has filed a patent suit against 20 companies including Google and Sonic Solutions in the US District Court of Texas alleging infringement of four of its patents for an electronic payment system.

What have they been doing all these years? I haven't heard a peep about this company.

Apparently they dream big, because other defendants in the case include Bank of America, Capital One Financial, Green Dot, JP Morgan Chase & Co, MasterCard International, Meta Financial Group, M&T Bank Corporation, Obopay, Visa, Vivendi Universal SA, Wal-Mart Stores, Walt Disney Co, (hope they slip 'em a Mickey) and Western Union.

Google faced 14 patent challenges in 2008, compared to only three in 2006 and has suggested that it plans to curb the growth of potential lawsuits by fighting rather than settling them. However, last month it agreed to settle a visual voicemail patent dispute with Klausner Technologies.

Here's more on the story from Finextra:

Finextra: BoA, MasterCard, Visa sued over e-commerce payments patents

BoA, MasterCard, Visa sued over e-commerce payments patents
Actus, a recently formed US holding company, is suing 20 companies, including Bank of America, MasterCard, Obopay and Visa, accusing them of infringing four patents related to an electronic payments system for e-commerce.

Actus, a holding firm based in Texas, filed a suit against the companies in the US District Court for the Eastern District of Texas last week.

The other defendants are Blaze Mobile, Capital One, Enable Holdings, Google, Green Dot, Javien Digital Payments Solutions, JP Morgan Chase, Meta Financial Group, M&T Bank, Sonic Solutions, Vivendi Universal, Walt Disney, Western Union, WildTangent, AgileCo and Wal-Mart.

The patents in question relate to "methods and apparatus for conducting electronic commerce using electronic tokens", where digital currency is used by customers for online payments.

According to the abstracts for the patents: "The electronic tokens are issued and maintained by a vendor, who also provides products and services that can be purchased or rented using the electronic tokens. The electronic tokens may be purchased from the vendor either on-line, using a credit card, or off-line, using a check, money order, purchase order, or other payment means."

The patent applications were originally filed by a company called PayByClick, with Marvin T Ling listed as the inventor.

According to legal newswire Law360, gift cards offered by Bank of America, JP Morgan, Visa, and others, are among the products accused of infringing the patents. Google's Checkout service is also named.

Actus is seeking a permanent injunction against further infringement and unspecified damages. The suit also seeks treble damages because Actus says the patents were infringed wilfully.

Actus, Visa, MasterCard, Western Union, Green Dot, JP Morgan, Capital One, Obopay, Wal-Mart, Vivendi Universal, Western Union, online payment

Hackers Not Limited...Is PCI?

Brian Krebs, from the Washington Post writes regularly on security. Here's an excerpt from an article he wrote in response to Verizon Business' latest report on the state of the payments industry...

Hackers Test Limits of Credit Card Security Standards

The number, scale and sophistication of data breaches fueled by hackers last year is rekindling the debate over the efficacy of the credit card industry's security standards for safeguarding customer data.

All merchants that handle credit and debit card data are required to show that they have met the payment card industry data security standards (PCI DSS), a set of technical and operational requirements designed to safeguard cardholder information from theft or unauthorized access.

Yet, some of the most notable data breach incidents last year targeted companies that had recently been certified as compliant with those standards, raising the question of whether the standards go far enough, or if entities that experienced a breach are falling out of compliance with the practices that led to their certification.

In a recent hearing on PCI standards at a House Homeland Security Committee panel, experts from the retail sector charged that the entire PCI scheme is only a tool to shift risk off the banks and credit card companies' balance sheets.

"The premise behind PCI -- that millions of retail establishments will systematically keep pace with the ever-evolving sophistication of today's professional hacker -- is just not realistic," said David Hogan, senior vice president and chief information officer for the National Retail Federation.

Merchants and retailers who experience a breach and are later found to be out of compliance with the PCI standards face steep fines from the credit card companies, and may eventually be forced to pay banks the costs of reissuing compromised cards.

Michael Jones, chief information officer for Michaels Stores Inc., a craft store chain, maintains that the PCI mandates were developed from the perspective of the card companies, rather than those who are expected to follow them.

For example, major tenet of the PCI standards is that hackers cannot steal credit and debit card data if retailers simply choose not to store the data. But Jones said retailers are required to store the data to defend themselves from chargebacks, a dispute that can be initiated by a bank or by a bank's customer. If a retailer cannot produce a copy of the receipt in the face of a chargeback, that retailer is forced to pay the cost associated with that chargeback, Jones said.

"This could have been fairly easily solved using a unique approval ID for each transaction, thus eliminating the need for credit card number storage by the retailer," but the credit card companies have balked at that suggestion, Jones said.

Continue Reading Brian Krebs story at the Washington Post

PCI, Hackers,

Severity of Breaches Increase

Study: Despite Increased Security Spending, Severity Of Breaches Is On The Increase
CompTIA study says human error is the most frequent cause of breaches worldwide

By Tim Wilson DarkReading

Despite increased spending on both security technology and training, most companies are experiencing more severe data breaches, according to a newly-completed study.

In its seventh annual security research study, the Computing Technology Industry Association (CompTIA) surveyed some 1,500 IT and security pros in countries around the globe. In the study, CompTIA found that the frequency of breaches had not increased significantly between 2008 and 2007, but the severity of those breaches has increased slightly. The average severity of a breach in 2008 was ranked as 5.6 on a ten-point scale, up from 5.3 in 2007 and 4.8 in 2006.

"The number of breaches may not be going up, but companies are feeling their impact a little bit more each year," says Tim Herbert, vice president of research at CompTIA.

Almost 10 percent of U.S. respondents said security breaches have cost their organizations more than $100,000 in the past 12 months. About a third saw employee productivity affected by a breach, and 20 percent saw an impact on revenue-generating activities. Nineteen percent experienced some server or network downtime as the result of a breach, and 10 percent paid fines or legal fees.

Continue DarkReading

More Bad News for Software Applications

Source: The Register
Complete item: http://www.theregister.co.uk/2009/04/16/internet_backbone_hacking/

Description:
Network backbone technologies used to route traffic over large corporate networks are vulnerable to large-scale hijacking attacks, according to two researchers who released freely available software on Thursday to prove their point.

The tools, demonstrated at the Black Hat security conference in Amsterdam, are intended to show that attacks once believed to be only theoretical are very much practical, said Enno Rey, one of the creators of the software. He developed the tools along with researcher Daniel Mende.

"We think the trust models of some technologies that are widely deployed in some networks are outdated," Rey told The Register. "This is to make people aware that the technologies they use in their daily life are not as secure as they might seem.

Some of the new tools attack a network data-forwarding technology known as MPLS, or multiprotocol label switching. Carriers such as Verizon, AT&T and Sprint use it to segregate one corporate customer's traffic from another's as it's shuttled from one geographic region to another. The tools make it trivial for anyone with access to the carrier's network to redirect that traffic or alter data on it.

The software works because MPLS has no mechanism for protecting the integrity of the headers that determine where a data packet should be delivered.

"There is no way of detecting modification of labels," Rey said. "If somebody gets access to this network, it's quite easy to cause disastrous havoc."

Other tools attack a separate network technology known as BGP, or border gateway protocol. Among other things, they crack the MD5 cryptographic keys used to prevent tampering. They also make it easy to inject unauthorized routes in BGP tables, allowing an attacker to hijack huge swaths of internet traffic.

Other tools exploit similar weaknesses in the ethernet protocol.

Of course, the lack of security in MPLS, BGP and ethernet is well documented. At last year's Defcon hacker conference, for example, researchers Anton "Tony" Kapela and Alex Pilosov demonstrated an attack on BGP that allowed them to redirect traffic bound for the conference network in Las Vegas to a system they controlled in New York. Other internet underpinnings, including the DNS, or domain name system, and SNMP or Simple Network Management Protocol have also been shown to be vulnerable to tampering.

Rey said he and Mende are well aware of this research. But up to now, the assumption has been that the attacks are technically difficult to carry out. The goal of the tools is to make corporate security professionals aware that the only thing preventing the hijacking of entire corporate networks is the steps carriers take to secure their infrastructure.

"Try to understand if your carrier is trustworthy," he recommended. "If there are any doubts, it might be a good idea to encrypt the traffic. We just want people to be able to make informed decisions."

E-Secure-IT
https://www.e-secure-it.com

Thursday, April 16, 2009

Painting (a picture) By Numbers

What are the Odds?

I was reading a Page 1 article about HomeATM in "ISO and Agent" published by SourceMedia and saw the tell-tale quote on the left from Avivah Litan. I'm wondering why "everyone" isn't listening to her?

After a post I did yesterday, (If Cybercriminals are Focusing on PIN's, Shouldn't Someone Be Focusing on Security?) some numbers kept sticking in my head.

Now I'm no statistician, but I was playing with those numbers in my head and came up with an interesting thought...which led to a question which I pose below...

First the numbers:

1. 93% of breaches were targeted at the financial sector: (Last year Verizon investigated 90 breaches with 285 million records stolen, of which 93% were accounted for by the financial sector...)

2. 92% of breaches are software related... - TowerGroup

3. 90% of breaches were committed by organized crime syndicates - Verizon

4. PIN's are the new focus of cybercriminals - "Organized crime was responsible for (90%) nine in 10 breaches, with an explosion of attacks targeting PIN data" - Verizon

So...here's my question...first, I asked myself, if PIN's are the new focus of cybercriminals... if 93% of breaches occur at Financial Institutions and 92% are software related (with "organized crime" being responsible for 90% of the attacks) then...

What are the chances that a Software Based PIN Debit "Application" Will be Attacked, Cracked and Hacked by an
"Organized Crime Syndicate?"

Anybody Want to Take an Educated Guess?

Finally I'll make this last promise or take a lunch bet with anyone...that once software PIN goes live, within a month an FTP site will arise with user's PAN and PIN numbers.

I One-Hundred-Percent (100%) guarantee it.

Thanks,

kgm
Chairman/CEO

HomeATM ePayment Solutions

Report: 2008 Saw More Records Breached Than The Previous Four Years Combined

By Tim Wilson DarkReading

More electronic records were breached in 2008 than the previous fouryears combined, according to a report published today by VerizonBusiness Systems.

This second annual study -- based on data analyzed from VerizonBusiness' actual caseload comprising 285 million compromised recordsfrom 90 confirmed breaches -- revealed that corporations fell victim tosome of the largest cybercrimes ever during 2008, the company said.

The financial sector accounted for 93 percent of all suchrecords compromised last year, and a staggering 90 percent of theserecords involved groups identified bylaw enforcement as engaged in organized crime.

Verizon Business investigative experts found, as they did inthe company's first report covering 230 million compromised recordsfrom 2004 to 2007, that nearly nine out of 10 breaches were consideredavoidable if security basics had been followed. Most of the breachesinvestigated did not require difficult or expensive preventivecontrols.

Similar to the first study's findings, the latest study found thathighly sophisticated attacks account for only 17 percent of breaches.However, these relatively few cases accounted for 95 percent of thetotal records breached -- proving that motivated hackers know where andwhat to target, the company says.

(Click any graphic to enlarge)

"The compromise of sensitive information increased dramaticallyin 2008, and it's past time to be vigilant about enterprise security,"said Dr. Peter Tippett, vice president of research and intelligence forVerizon Business Security Solutions. "This report should serve asanother wake-up call that good security and a proactive approach areparamount to running a business in this day and age -- particularlysince the economic crisis is likely to trigger a further increase incriminal activity."

Way Systems and TNS Add PIN Debit to Synapse Customers

PRESS RELEASE
WAY Systems and TNS Add PIN Debit Capabilities for Synapse Customers

TNS 16.69, +0.25, +1.5%) has teamed up with WAY Systems to offer PIN Debit capabilities to mobile merchant customers via Synapse sm, TNS' wireless payment gateway.

Based in Boston, MA, and founded in 2004, WAY Systems is a privately held organization that provides mobile Point of Sale (POS) terminal devices to mobile merchants throughout the US. WAY Systems currently offers the smallest, most compact terminal models available.

Since 2005, WAY Systems has utilized the Synapse solution by TNS to process credit card transactions over TNS' secure global network. Once implementation is complete, Synapse customers utilizing WAY terminal devices will be able to process both debit and credit transactions over the TNS payment gateway.

Harry Hargens, Vice President of Product Management at WAY Systems said: "Synapse customers using WAY terminals will now enjoy the benefits of utilizing a single solution for both credit and PIN Debit. TNS and WAY Systems are able to offer the complete package of reliable service and quick and easy processing from anywhere through one secure wireless connection.

"We have a long standing relationship with TNS and the service they have delivered has proven to be extremely reliable, so it just made sense for us to build on that trusted relationship.

"Merchants already using our terminals and the Synapse payment gateway for credit transactions will be able to instantly use the same devices for debit processing once the solution is available. By working with TNS, we are able to offer the combination of a secure mobile merchant solution along with the reliable service TNS brings to the table."

The Synapse solution offered by TNS provides a one-stop-shop for ISOs, acquirers, and processors to manage wireless terminal portfolios.

By taking advantage of Synapse, merchants are able to rely on the security and performance of TNS' PCI DSS certified Synapse processing environment and 24x7x365 helpdesk services with live real-time support.

Alan Schwartz, Executive Vice President, North America Sales at TNS, added: "We are thrilled to be expanding our processing capabilities with WAY Systems. Having the ability to process debit transactions rounds out our feature-set, and will allow customers to take a deeper look at the high quality of customer service and gateway reliability that sets us apart from our competitors."

Synapse is a wireless gateway and management solution providing services for ISOs, acquirers, and processors to manage their wireless terminal portfolios. Using a PCI DSS certified processing environment, it offers a broad range of end-to-end services. The solution includes wireless network access, account activation, fast, reliable, and secure transaction delivery to most major processors, web-based merchant and terminal management, customizable online reporting, and live 24x7 customer service.

To find out more about TNS, please visit www.tnsi.com.

About Transaction Network Services
Transaction Network Services (TNS) is an international data communications company that enables payments, money and voices, to move around the world.
TNS' mission is to enable the world to transact. It does this through a broad range of networking, communications and value added services, which it provides to many of the world's leading retailers, banks/processors, telecommunications companies and financial markets.
Since its inception in 1990, TNS has designed and implemented multiple data networks, each designed specifically for the transport of transaction-oriented data. TNS' networks support a variety of widely accepted communications protocols and are designed to be scalable and accessible by multiple methods. Today, TNS has offices throughout the world serving customers in 28 countries with the ability to provide services in other countries.

For further information about TNS, visit www.tnsi.com

Statements and information contained in our press releases and newsletters that are not descriptions of historical fact may contain forward-looking statements. Forward-looking statements involve a number of risks, uncertainties or other factors beyond our control, which could cause actual results to differ materially from historical results or performance and from any opinions or statements expressed with respect to future periods. www.tnsi.com

SOURCE: Transaction Network Services

TNS
Clare Cockroft
PR Manager, +44 (0)114 292 6416
ccockroft@tnsi.com
or
Stephen Aryan, +44 (0)114 292 6410
PR Assistant
saryan@tnsi.com

PIN Debit, Way Systems, TNS, PIN, Mobile, Synapse

Phish-Ingcreases

Banking / Finance News -
Source: ComputerWeekly

Banks, online payment organizations and other financial institutions are bearing most of the financial cost of phishing attacks, according to research firm Gartner.

A survey of nearly 4,000 US consumers revealed a 40% increase in the number of phishing victims in 2008 over the year before to five million.

The average loss was $350 per phishing attack, but consumers said they had recovered 56% of their losses from the financial institutions involved.

"The findings underline the fact that the war against phishing is far from over," said Avivah Litan, analyst at Gartner.

Celent Report on AltPays

Alternative Realities: The Commoditization and Allure of Alternative Payments

Report Published by Celent

In the past three years, alternative payments have gained considerable market value with no loss of momentum in sight. Alternative payments currently account for roughly 15% of total e-commerce volume. However, by offering a superior value proposition to buyers, alternative payments pose a threat to traditional payment methods. PayPal's recent acquisition of Bill Me Later validates Celent's assessment that the strongest value is derived from the creation of sales lift.

In less than a decade, alternative payments have evolved from "dot bomb" burnouts to widely accepted, widely recognized forms of online payment. Alternative players' business models once relied on their solutions' status as "something new" or the only way to pay in a particular online environment. However, they now focus on providing greater value than payment cards. Card brands and issuers stand to forgo $345 million in volume in 2010 and about $1.7 billion in volume in 2015 to alternative payment. In a new report, Alternative Realities: The Commoditization and Allure of Alternative Payments, Celent examines the maturation of the online alternative payments sector.

Given cards' historical dominance over online payments, this market is the card industry's to lose. Every time a bank account is debited via ACH rather than a card, the card industry loses roughly 1.5 - 2.4% or more of the transaction size. The card industry must pay attention to alternative payments, which can be categorized as enablers, quasi-disruptors, or disruptors, in order to prevent further losses.

Enablers offer a technological "wrap around" for payment cards that leads to increased card volume when cards are used as the source of funds. Quasi-disruptors are players that allow for both cards and other funds sources (e.g., bank accounts) to be used. Should bank accounts be used instead, these same players take on disruptive qualities. Finally, disruptors are solutions in which the card industry plays no role whatsoever.

However, the outlook is not entirely rosy for alternative payments. "Alternative payments players have already become commodities in terms of security, convenience and pricing. The real differentiator is their ability to induce purchases and affect a corresponding sales lift. Of all the major alternative payments players, Bill Me Later understands this the best," says Red Gillen, senior analyst with Celent's banking group and author of the report. "The greatest threat to the card industry is a disruptive alternative payments solution that has figured out how to increase online merchants' sales. With its recent acquisition of Bill Me Later, PayPal is obviously a believer in this fact."

"The spoils will go to those players who understand that their role is no longer simply making shoppers able to pay. Instead, such players realize that, going forward, they must make shoppers want to pay," he adds.

This report spotlights some of the main players in the remittance space and provides an analysis of how they match up against online payment incumbents (cards) as well as each other.

The report contains 56 pages, 17 figures and 10 tables. A table of contents for this report is available online.

Members of Celent's Retail and Business Banking research service can download the report electronically by clicking on the icon to the left. Non-members should contact info@celent.com for more information.

About Celent

Celent is a research and advisory firm dedicated to helping financial institutions formulate comprehensive business and technology strategies. Celent publishes reports identifying trends and best practices in financial services technology and conducts consulting engagements for financial institutions looking to use technology to enhance existing business processes or launch new business strategies. With a team of internationally experienced analysts, Celent is uniquely positioned to offer strategic advice and market insights on a global basis. Celent is a member of the Oliver Wyman Group, which is part of Marsh & McLennan Companies [NYSE: MMC].

Alternative Payments

Signature Debit in a Chip and PIN World

Ed Perkins writes for SmarterTravel about how Chip and PIN may affect credit and debit card transactions for American's who are traveling abroad...

Why Your Credit Card Might Not Work Overseas - SmarterTravel.com

Ed Perkins on Travel
by Ed Perkins - April 16, 2009

The next time you go overseas—especially to Europe—don't be surprised if you have occasional trouble using your credit card. Many big European banks have switched to chip-enabled cards that require use of an identification number (PIN) to complete the transaction, and only a very few cards issued in the United States comply with the new European standard. International card networks (American Express, MasterCard, and Visa) require all participating merchants to accept U.S. cards, and many do. But you may still face situations where your card won't work.

This column was suggested by reports of difficulties experienced by American travelers in Europe. Several reported having their cards refused by a local hotel, restaurant, or merchant unless the travelers provided a PIN. After the usual argument, some accepted the American card; others didn't. The worst case came from an American traveling in Scandinavia, who tried to buy a rail ticket with his Visa card from a vending machine in a small-town station that did not have an attendant. He was flat unable to buy a ticket and had to prevail on some helpful local to buy it for him.
Advertisement

After checking with the card networks and a few banks, I've concluded that the U.S. card establishment really doesn't have a foolproof solution to the problem. Here's what they say:

* The party line is that there's no problem: Your U.S.-issued card is good everywhere with a signature and without a PIN. Even though some parts of the world have adopted chip-enabled systems—requiring a PIN—as a means of authentication, magnetic-stripe cards issued in the United States continue to be accepted everywhere the card is accepted, including countries that have adopted chip-and-PIN technology. Most terminals in those countries can recognize a non-chip-enabled card and will indicate when a signature, rather than PIN, is necessary.

Continue Reading Ed's column at SmarterTravel

Wednesday, April 15, 2009

280 Million Records Compromised Last Year

Over 280 million records compromised last year - vnunet.com

Damning report finds simple steps still being ignored
Phil Muncaster - vnunet.com, 15 Apr 2009

More than 280 million records were compromised in 2008, according to a new Data Breach Investigations Report from global comms and IT provider Verizon Business.

The report was written by the Verizon Business Risk team using first-hand evidence collected from the firm's data breach investigations over 2008.
Advertisement

Three-quarters of breaches resulted from external threats, the report found, while just 20 per cent were caused by insiders. This is despite the message from most security firms that the inside threat is more dangerous than that posed from the outside.

The sheer number of credit card and other details being compromised has driven their price down on the underground economy, forcing criminals into new tactics, explained Matthijs van der Wel, managing principal of forensics at Verizon Business.

The average price for a piece of stolen card information has dropped from around $10 (£6.70) in 2007 to 50 cents (33p) today.

"For the criminals it's becoming less profitable so they're looking for new ways to make money, which means targeting financial institutions much more, looking for richer data," said van der Wel.

"Attackers have to do a lot more work to get their information now. They're intercepting the PINs, which has been theorised before but now we're seeing it. " To this end, criminals are creating customised 'memory scraping' malware to harvest customer PINs entered at ATMs from banks' servers.

Yet despite the increasingly creative ways some criminals are compromising customer data for sale on the black market, the majority of incidents appear to have been preventable, according to the report. For example, 81 per cent of affected organizations subject to the Payment Card Industry Data Security Standard were found to be non-compliant prior to being breached.

Editor's Note: HomeATM is PCI 2.0 PED Compliant!

A software application can never ever be certified because it would be literally impossible to know what malware may lurk in the darkness of each individual PC. Since a software application would use the PC, the keyboard, or the mouse...as the PIN Entry Device (PED) every single PC would need to be PCI PED certified.

Since only 24 devices have been 2.0 certified worldwide and only 1 (HomeATM) designed for eCommerce, I would say that a software application being awarded PCI 2.0 PED certification is "impossible."

Some 53 per cent of stolen data records came from organizations using shared or default credentials, and 83 per cent of hacks were considered avoidable through simple or intermediate controls. Van der Wel recommended firms to check access controls regularly, change default credentials, keep up to date with patches, and test applications for vulnerabilities. "You need to ask yourself 'Do I need to store this data?'" he said. "Many organisations today are data hungry, but if you don't store the data you'll reduce your risk."

HomeATM

If Cybercriminals Focus on PIN's, Shouldn't We Focus on Security?

Complete item: http://www.finextra.com/fullstory.asp?id=19911

Description: Hackers stole 285 million electronic records in 2008, more than in the previous four years combined, with the vast majority of breaches targeting the financial services industry, according to a study from Verizon.

Lat year Verizon investigated 90 breaches with 285 million records stolen, of which 93% were accounted for by the financial sector. The industry also accounted for 30% of the breaches - double its share for 2007.

Verizon says the increase reflects the recent trends in cybercriminal activity, especially the focus on acquiring PIN numbers to sell on the black market.

Editor's Note: If there's a FOCUS on acquiring PIN numbers to sell on the black market, then "SECURITY" needs to be the financial sector's FOCUS. Again...92% of all breaches are software-based (see graph...top left) and if cybercriminals are "focusing" on obtaining PIN's take an "educated guess" as to which one will be targeted.

Between the Graph above and the Graph-itti on the right...the writing is "so on the wall" and it's clearly showing us the future.

I KNOW I'm not the only one who see's it!

93% of breaches target financial sector, 92% target software...and 90% of attacks come from organized crime) Leave your comment below on the 93/92/90 data...

The story continues: Organized crime was responsible for (90%) nine in 10 breaches, with an explosion of attacks targeting PIN data, which Verizon says hit the consumer much harder than typical signature-based counterfeit attacks.

The higher monetary value commanded by PIN data has spawned a cycle of innovation in attack methodologies, with criminals re-engineering their processes and developed new tools, such as memory-scraping malware, to steal this valuable data.

Editor's Note: Click the memory-scraping malware link to read more into the future of software based PIN Debit at Wired.

Will V/MC Flip the KillSwitch on Interac?

Interac in a fight for its life

With lucrative banking fees in their sights, Visa and MasterCard aim to challenge a home-grown success

THERESA EBDEN
April 15, 2009

With the debate raging in Ottawa about credit card rates, you may have overlooked another issue in the mix: the uncertain future of your bank debit card.

Let's put it this way. Don't get too used to calling your debit transactions "Interac," because Visa Canada and MasterCard Canada may yet challenge the monopoly held by the national not-for-profit Interac Association, a co-operative payment system created in 1984 by the country's big banks and merchants.

Many Canadians don't realize that Interac is a low-cost anomaly.

In other countries, high-fee, for-profit systems from companies such as Visa, MasterCard and China UnionPay reign. Now the first two are considering a foray into Canada. Visa has held talks with Canadian banks and retailers, said Tim Wilson, head of Visa Canada. Visa debit is used by 844 million cardholders in 170 countries, according to company reports.

"The bank card in Canada has been tremendously successful, but it's relatively plain vanilla," Mr. Wilson said.

MasterCard said recently it will "create competition in the Canadian debit market where it has never existed" with its debit system, Maestro, used by 652 million people in more than 100 countries. Under the system, Canadian customers could use their debit cards abroad, and retailers here could accept foreign cards.

Interac is in a fight for its life, says Mark O'Connell, its president and CEO. He maintains it is a world-class, low-cost payment system that won't survive unless its regulatory structure is altered by the Competition Bureau.

Interac should be "a more independently run commercial organization that has the ability to innovate," he said. As it stands, the not-for-profit association can't raise funds for research and development of new products, such as high-tech terminals.

"We cannot let such a successful debit system continue in this shackled fashion, as the market changes around it," Mr. O'Connell said. "I think it would be a tragedy to have this made-in-Canada success story obviated by U.S. card companies."

Analysts say that Visa and MasterCard can enter Canada with new products and set up lucrative fee structures for all involved - themselves, the banks, and the middlemen.

Continue Reading

Visa, Mastercard, Interac, Fight for Life

PIN Crackers

PIN Crackers Nab Holy Grail of Bank Card Security | Threat Level from Wired.com

By Kim Zetter Email

Hackers have crossed into new frontiers by devising sophisticated ways to steal large amounts of personal identification numbers, or PINs, protecting credit and debit cards, says an investigator. The attacks involve both unencrypted PINs and encrypted PINs that attackers have found a way to crack, according to the investigator behind a new report looking at the data breaches.

"We're seeing entirely new attacks that a year ago were thought to be only academically possible," says Sartin. Verizon Business released a report Wednesday that examines trends in security breaches. "What we see now is people going right to the source ... and stealing the encrypted PIN blocks and using complex ways to un-encrypt the PIN blocks."

The revelation is an indictment of one of the backbone security measures of U.S. consumer banking: PIN codes. In years past, attackers were forced to obtain PINs piecemeal through phishing attacks, or the use of skimmers and cameras installed on ATM and gas station card readers. Barring these techniques, it was believed that once a PIN was typed on a keypad and encrypted, it would traverse bank processing networks with complete safety, until it was decrypted and authenticated by a financial institution on the other side.

But the new PIN-hacking techniques belie this theory, and threaten to destabilize the banking-system transaction process.

according to the 2009 Data Breach Investigations report, the hacks have resulted in "more targeted, cutting-edge, complex, and clever cybercrime attacks than seen in previous years."

"While statistically not a large percentage of our overall caseload in 2008, attacks against PIN information represent individual data-theft cases having the largest aggregate exposure in terms of unique records," says the report. "In other words, PIN-based attacks and many of the very large compromises from the past year go hand in hand."

Although there are ways to mitigate the attacks, experts say the problem can only really be resolved if the financial industry overhauls the entire payment processing system.

"You really have to start right from the beginning," says Graham Steel, a research fellow at the French National Institute for Research in Computer Science and Control who wrote about one solution to mitigate some of the attacks. "But then you make changes that aren't backwards-compatible."

PIN hacks hit consumers particularly hard, because they allow thieves to withdraw cash directly from the consumer's checking, savings or brokerage account, Sartin says. Unlike fraudulent credit card charges, which generally carry zero liability for the consumer, fraudulent cash withdrawals that involve a customer's PIN can be more difficult to resolve since, in the absence of evidence of a breach, the burden is placed on the customer to prove that he or she didn't make the withdrawal.

Some of the attacks involve grabbing unencrypted PINs, while they sit in memory on bank systems during the authorization process. But the most sophisticated attacks involve encrypted PINs.

Sartin says the latter attacks involve a device called a hardware security module (HSM), a security appliance that sits on bank networks and on switches through which PIN numbers pass on their way from an ATM or retail cash register to the card issuer. The module is a tamper-resistant device that provides a secure environment for certain functions, such as encryption and decryption, to occur.

According to the payment-card industry, or PCI, standards for credit card transaction security, PIN numbers are supposed to be encrypted in transit, which should theoretically protect them if someone intercepts the data.

The problem, however, is that a PIN must pass through multiple HSMs across multiple bank networks en route to the customer's bank. These HSMs are configured and managed differently, some by contractors not directly related to the bank.

At every switching point, the PIN must be decrypted, then re-encrypted with the proper key for the next leg in its journey, which is itself encrypted under a master key that is generally stored in the module or in the module's application programming interface, or API.

"Essentially, the thief tricks the HSM into providing the encryption key," says Sartin. "This is possible due to poor configuration of the HSM or vulnerabilities created from having bloated functions on the device."

Sartin says HSMs need to be able to serve many types of customers in many countries where processing standards may be different from the U.S. As a result, the devices come with enabled functions that aren't needed and can be exploited by an intruder into working to defeat the device's security measures. Once a thief captures and decrypts one PIN block, it becomes trivial to decrypt others on a network.

Other kinds of attacks occur against PINs after they arrive at the card-issuing bank Once encrypted PINs arrive at the HSM at the issuing bank, the HSM communicates with the bank's mainframe system to decrypt the PIN and the customer's 16-digit account number for a brief period to authorize the transaction.

During that period, the data is briefly held in the system's memory in unencrypted form.

Sartin says some attackers have created malware that scrapes the memory to capture the data.

"Memory scrapers are in as much as a third of all cases we're seeing, or utilities that scrape data from unallocated space," Sartin says. "This is a huge vulnerability."

He says the stolen data is often stored in a file right on the hacked system.

"These victims don't see it," Sartin says. "They rely almost purely on anti-virus to detect things that show up on systems that aren't supposed to be there. But they're not looking for a 30-gig file growing on a system."

Information about how to conduct attacks on encrypted PINs isn't new and has been surfacing in academic research for several years. In the first paper, in 2003, a researcher at Cambridge University published information about attacks that, with the help of an insider, would yield PINs from an issuer bank's system.

The paper, however, was little noticed outside academic circles and the HSM industry. But in 2006, two Israeli computer security researchers outlined an additional attack scenario that got widespread publicity. The attack was much more sophisticated and also required the assistance of an insider who possessed credentials to access the HSM and the API and who also had knowledge of the HSM configuration and how it interacted with the network. As a result, industry experts dismissed it as a minimal threat. But Steel and others say they began to see interest for the attack research from the Russian carding community.

"I got strange Russian e-mails saying, Can you tell me how to crack PINs?" Steel recalls.

But until now no one had seen the attacks actually being used in the wild.

Steel wrote a paper in 2006 that addressed attacks against HSMs as well as a solution to mitigate some of the risks. The paper was submitted to nCipher, a British company that manufactures HSMs and is now owned by Thales-eSecurity. He says the solution involved guidelines for configuring an HSM in a more secure manner and says nCipher passed the guidelines to customers.

Steel says his solution wouldn't address all of the types of attacks. To fix the problem, would take a redesign.

But he notes that "a complete rethink of the system would just cost more than the banks were willing to make at this time."

Thales-eSecurity is the largest maker of HSMs for the payment-card and other industries, with "multiple tens of thousands" of HSMs deployed in payment-processing networks around the world, according to the company. A spokesman said the company is not aware of any of the attacks on HSMs that Sartin described, and noted that Thales and most other HSM vendors have implemented controls in their devices to prevent such attacks. The problem, however, is how the systems are configured and managed.

"It's a very difficult challenge to protect against the lazy administrator," says Brian Phelps, director of program services for Thales-eSecurity. "Out of the box, the HSMs come configured in a very secure fashion if customers just deploy them as is. But for many operational reasons, customers choose to alter those default security configurations — supporting legacy applications may be one example — which creates vulnerabilities."

Redesigning the global payment system to eliminate legacy vulnerabilities "would require a mammoth overhaul of virtually every point-of-sale system in the world," he says.

Responding to questions about the vulnerabilities in HSMs, the PCI Security Standards Council said that beginning next week the council would begin testing HSMs as well as unattended payment terminals. Bob Russo, general manager of the global standards body, said in a statement that although there are general market standards that cover HSMs, the council's testing of the devices would "focus specifically on security properties that are critical to the payment system." The testing program conducted in council-approved laboratories would cover "both physical and logical security properties."

Software Based PIN...Doin' It Wrong?

Over 60% Of Breaches Tied To Flaws In Business-Critical Applications - DarkReading

Secure Software Development Programs are Rare

Survey by Forrester Consulting and Veracode shows businesses struggling to stay on top of application security

Apr 14, 2009 | 03:20 PM
By Kelly Jackson Higgins
DarkReading

If you still don't think security vulnerabilities in software will necessarily catch up with you, think again: 62 percent of organizations in the last 12 months suffered data breaches as a result of bugs being exploited in their major applications, according to a newly released survey.

Forrester Consulting, commissioned by Veracode, surveyed application developers and security and risk professionals in 200 organizations in the U.S. and U.K., and found that secure software development programs are rare -- only 34 percent said they have a software development lifecycle program that integrates security.

"The survey showed that people, process, and culture are the primary inhibitors," says Matt Moynahan, CEO of Veracode, in an interview. "Security is not a core competence of enterprises developing code."

Continue DarkReading

How to Hack an ATM Part IV

ATM blast gang strikes again | The Daily Telegraph

By Amy Dale
April 15, 2009 06:05am

POLICE are searching for three men seeing running from an ATM explosion in Lane Cove early today. The explosion occured outside the National Australia Bank in Longueville Road at about 2am.

The ATM was badly damaged_ with debris strewn around the footpath_ however no cash was stolen.

Witnesses reported seeing two men sprint from the scene of the blast into a car driven by a third man but a police search failed to locate them.

Detectives from Strike Force Piccadilly, which was established following a string of ATM blasts across the state, were called to the scene.

NAB ATMs were the targets of two successful bamraids in St Ives and Neutral Bay in February.

bamraid