Monday, April 20, 2009

Visit HomeATM at ETA...Booth 647! (FIS Booth) and We'll Put $10 on Your Card in Real Time!

HomeATM will be at Fidelity Information Services Booth (eFunds/Metavante/NYCE) Tuesday thru Thursday! So stop by booth #647 during the ETA Meeting & Expo April 21-23at the Mandalay Bay Resort & Casino and visit with one of ourmerchant experts.

(Look for anyone wearing a Polo with "PINterchange for the Internet " on their back)
Cause when it comes to providing "TRUE" PIN Debit for the Web, and military grade security,
we've got YOUR back covered!

Also...be sure to check out FIS’:

Creative solutions to accepting PIN Debit for payment at Web-based merchant sites
Expanding payment options
Reduced interchange costs (PINterchange!)

Stop by and say hello.

We've got a $10.00 "Card" Present for you!

Correction: Booth #647

Just mention the fact that you saw this post in the "PIN Payments News Blog" and we'll put $10 on ANY US BANKCARD in "REAL TIME."
(right before your eyes)

RKL ATM Security (Remote Key Loading)

ATM Security | Remote key loading: The next in ATM security for ISOs | ATM Marketplace

By Tracy Kitten editor • 20 Apr 2009

Dennis "Abe" Abraham has spent the last five years waiting for remote key loading to reach a tipping point. The president of Concord, N.C.-based Trusted Security Solutions Inc., developer of the A98 remote key loading system, says the timing for RKL is finally right, and independent sales organizations are now seriously considering their options.

Though complicated by complex algorithms and multiple levels of encryption, the function of remote key loading is simple. Basically, RKL eliminates the need for ATM technicians to physically visit ATMs for manual key changes — thus eliminating expense and the possibility for human error.
story continues below...

After completing their investments in Triple DES upgrades, ATM deployers are now finally able to focus some time and money on RKL. Up to this point, financial institutions have expressed interest in RKL, but few have made large investments. In the ISO space, movement has been, by and large, non-existent.

And there are a few reasons for that.

Deployers of off-premises ATMs have not been as diligent about ensuring their keys are changed. In fact, before the October 2008 release of version 1.2 of the Payment Card Industry Council Data Security Standard, no definitive requirements for key changing existed. ATM deployers were required to change keys if and when audited, but audits were not mandated across the board.

Under version 1.2, keys must be changed every 12 months, and the networks are watching, says Chuck Hayes, product development manager for Long Beach, Miss.-based Triton Systems of Delaware. That PCI push has encouraged manufacturers like Triton to start marketing RKL part of the overall ATM offering.

"It's a differentiator for us," Hayes said. "It's the first time an RKL solution has been brought to market for the off-premises space, and that's helping us enjoy a competitive advantage."

Triton's patent-pending RKL offer may only require a software upgrade, if the ATM already has Triton's upgraded encrypting PIN pad.

For an ISO that acquires and needs to merge a fleet of remote-key capable ATMs with an existing fleet of ATMs that aren't remote-key ready, the Triton solution calls for a mere switch of the host for transaction processing, Hayes says.

"The business case for ISOs is simple: less key handling," he said. "That's an advantage. If an ATM key was corrupted, the host could rekey that ATM within minutes, rather than having to go through the manual process of sending someone out, which takes time and expense."

A case for ISOs and FIs

Continue Reading at ATM marketplace

Midnight Raid Attack Creates HelluvaSMS

Source: CNet
Complete item

Description:
Be careful who you give your mobile phone number out to. An attacker with the right toolkits and skill could hijack your phone remotely just by sending SMS messages to it, according to mobile security firm Trust Digital.

In what it calls a "Midnight Raid Attack" because it would be most effective when a victim is asleep, an attacker could send a text message to a phone that would automatically start up a Web browser and direct the phone to a malicious Web site, said Dan Dearing, vice president of marketing at Trust Digital. The Web site could then download an executable file on the mobile phone that steals data off the phone, he said.

Dearing demonstrates how this can be done in a video on YouTube.

In another type of attack, an attacker could hijack a phone by sending a type of SMS message called a control message over the GSM network to a victim's phone that is using a Wi-Fi network and then use special toolkits to sniff the Wifi traffic looking for the victim's e-mail log-in information. This attack is explained in another YouTube video.

While the attacks at this point are proof-of-concepts, they could be done if someone has the requisite knowledge and toolkits, said Dearing. Trust Digital recently announced software called EMM 8.0 that can help organizations protect employee phones from these types of attacks, he said.

"This is a completely real threat," said Philippe Winthrop, a director in the global wireless practice at Strategy Analytics. "We will see these attacks. It's a matter of time."

Online Security Fears Deepening...HomeATM Can Help

Consumers in Belgium apparently feel least anxious about online security than people in any other European country.

In an Index that tracks trends in consumer perception of security issues among approximately 8,500 people in nine countries, Unisys has reported that ID theft and fraud fears have surged in the last six months as recession bites.

“Reports that fraudsters are increasingly moving online, in addition to well publicized security breaches, may have also helped push up the Unisys Security Index for Internet security concerns from 105 a year ago to 121 in the UK,” the company said.

Editor's Note: See the device on the left? Fraudsters hate it because instead of "Typers" consumers become "Swipers." I love the irony... "Consumers "swipe their card information" vs. Fraudster's being the "Swiping Type"...

Virtually "every" security expert knows that entering a card number, expiration date and CVV with a keyboard is the exact "type" of transaction that allows fraudsters to "swipe" your financial details. On the flipside, when you "swipe" your own card details with our SafeTPIN terminal, and enter your PIN, it's done "outside" the browser space, is "instantaneously" 3DES encrypted "inside" the box" and the data is never transmitted in the clear.

In addition to 3DESD end-to-end encryption, HomeATM employs DUKPT key management AND also encrypts the Track 2 data.

These procedures helped the HomeATM "SafeTPIN" become the FIRST and ONLY payment terminal/PIN Entry Device IN THE WORLD, designed solely for e-commerce to be PCI 2.0 PED Certified.

Thus, HomeATM is also the "FIRST and ONLY" provider of "Tried and TRUE" PIN Debit for eCommerce." The card is present, the Track 2 data is captured (including the PIN Offset (PVKI) AND the PIN Verification Value (PVV) and the PIN provides 2FA (two factor authentication)

Again, on the flip side, with a software PIN Debit "application" (see graphic below/right) the card is NOT PRESENT, the Track 2 data is NOT captured, (nor is the PVKI/PVV), and the PIN does NOT provide 2FA, because the Primary Account Number (PAN) could have been purchased for a dime online. So, if your perception is that there's "TWO" Internet PIN Debit choices, hardware or software, it's time to re-evaluate...because the truth is:

There's only ONE TRUE PIN Debit "solution" for the web. HomeATM...period. Speaking of "conventional" you can visit us at Booth 347 at the ETA Convention. Oh...and did I mention that HomeATM is EMV/SmartCard/Chip and PIN ready? I think I just did...back to the article

According to the survey, 69% of UK consumers are now concerned about computer security and 65% are worried about their safety and security when shopping or banking online.

The study assessed attitudes towards national security and epidemics, financial services security, as well as sentiment towards spam, virus and online financial transactions, and physical risk and identity theft.

It used measures of consumer perceptions on a scale of zero to 300, with 300 representing the highest level of perceived anxiety. The relaxed Belgians scored a low 94 on a rating of internet security concerns.

Overall, the average score for citizens of the nine countries surveyed is 133, representing a moderate level of concern. Those surveyed are most concerned about financial security and least concerned about Internet security.

Unisys said its twice yearly survey presents an interesting social indicator regarding how safe consumers feel on key areas of security.

Some 72% of UK citizens believe they are at greater risk from identity theft and related crimes such as credit card fraud, as a result of the financial crisis

Four out of every five people in Germany are extremely or very concerned about identity theft, yet under half would accept biometric technology to verify their identities.

As many as 88% of consumers are concerned about other people obtaining and using their credit card, debit card or bank account details or are concerned about others gaining unauthorized access to or misusing their personal information.

“Fraud fears have deepened as a result of the financial crisis,” Neil Fisher, VP at Unisys said.

The company found that bankcard fraud is the greatest single area of concern across all markets, with concerns about misuse of credit or debit card details being the top concern among adults in five countries and the number two concern in four more countries.

Identity theft is seen as the second greatest area of concern, being the number one concern in three countries and the number two concern in four more.

Since the last survey six months ago, Unisys measured a jump of ten-points in its Internet Security Index and charted a significant six-point rise in its Financial Security Index. Its National Security Index continues its downward trend, while its Personal Security Index is essentially flat.

Fraud Fears, Online Security, Unisys, HomeATM, true pin debit, pin debit, interet pin debit, ecommerce

Mikeyy Worm: Jokes on Twitter...Womp!

http://twitter.com/homeatm

Source: Sophos
Complete item: http://www.sophos.com/blogs/gc/g/2009/04/18/mikeyy-worm-jokes-twitters-expense/

Description: Another day, another Twitter worm. After yesterday's attack referencing the likes of Ashton Kutcher and Oprah Winfrey we are now seeing many Twitter users spreading messages on behalf of a new version of the Mikeyy worm, this time their common denominator is that they're all jokes including the (somewhat bizarre) word "womp".

Here are some of the messages that are being sent from compromised accounts on Twitter right now:

Ninety-nine percent of all lawyers give the rest a bad name. Womp. mikeyy.
If your father is a poor man, it is your fate, if your father-in-law is a poor man, it's your stupidity. Womp. mikeyy.
If you are born ugly blame your parents, if you died ugly blame your doctor. Womp. mikeyy.
Money is not the only thing, it's everything. Womp. mikeyy.
Every man should marry. After all, happiness is not the only thing in life. Womp. mikeyy.
Success is a relative term. It brings so many relatives. Womp. mikeyy.
Be nice to your kids. They'll choose your nursing home. Womp. mikeyy.
'Your future depends on your dreams', So go to sleep. Womp. mikeyy.

Once again, Twitter is left looking amateurish in its response as it clearly hasn't properly hardened its systems from these kind of cross-site scripting attacks. Until they get their act together, users need to remember to turn off scripting (the combination of Firefox and NoScript is a good one) if viewing users' profiles.

Oracle Buys Sun Microsystems

Had to bring you "tomorrow's news today!" From the April 21st edition of iTWire:

iTWire - Oracle vertically integrates paying $7.4B for Sun

by Stan Beer
Tuesday, 21 April 2009

In what is being viewed as a move to vertically integrate its business, business software giant has agreed to buy struggling servers hardware vendor Sun Microsystems for US$7.4 billion cash.

The deal will see Oracle pay a more than 40% premium of $9.50 a share for the company whose founder Scott McNealey coined the phrase “the network is the computer”.

Sun was at one time a rising star in the Unix servers business, with its Solaris operating system and Sparc based proprietary servers.

However, the commoditisation of the servers business through the x86 platform has bitten deeply into Sun’s bread and butter.

While Sun is primarily considered to be a hardware company, it does have some considerable software jewels in its crown. Aside from Solaris, Sun was the developer of the Java software development platform and owns Star Office, the commercial version of Open Office.

From Oracle's point of view - or least what its boss Larry Ellison claims - the Sun purchase will give Oracle a one-stop-shop or "applications to disk" capability, where the company could offer customers a tightly integrated hardware and software solution.

Commentators at this stage seem unsure about the wisdome of Oracle's strategy with this purchase because it's the first time the software giant has ventured boldly into the hardware space.

However, many note that previous acquisitions for Oracle such as PeopleSoft, Siebel and Bea have been successful.

In addition, as some pundits point out, Sun is not just a hardware company but is also strong in the software platform space. And the vertical integration of major computing conglomerates in the mould of IBM and HP, with hardware, software and services appearsto be where the market is heading.

6 Degrees of Separation to Preventing Fraud - Deloitte Consulting

A Discussion about Applying Six Degrees of Separation to Preventing Fraud

Consideringthe human element of fraud and channeling information and specializedresources already in your company toward that effort, could helpmitigate fraud and other compliance risks.

In “A Discussion about Applying Six Degrees of Separation to Preventing Fraud,” Toby Bishop, director of the Deloitte Forensic Center for Deloitte Financial Advisory Services LLP,moderates a discussion with Yogesh Bahl, Northeast leader of Anti-FraudConsulting for Deloitte Financial Advisory Services LLP, and TimLupfer, director in the Human Capital practice of Deloitte ConsultingLLP.

Listen to the discussion of how companies may be able toapply techniques used in fraud investigations to prevent and detectfraud before it causes serious damage. To watch the video, click the screen below...

Related content:
Overview: Applying Six Degrees of Separation to Preventing Fraud
Services: Anti-Fraud Consulting
Services: Deloitte Consulting

Sunday, April 19, 2009

TRUE Internet PIN Debit - See us at FinovateStartup09

Tried and True!

Visit HATM at FinovateStartup09 in our Hospitality Suite on April 28th in San Francisco and we will demonstrate the ONLY functional "TRUE" PIN Debit Internet system by putting $10 on ANY US Bank Card in "Real Time!"

Yes...you read this right. "THE ONLY" True Internet PIN Debit Payment in the World. True PIN Debit Interchange, True PIN Debit Transactions, True Card Present Rates.

Software solutions ARE NOT TRUE PIN Debit.

Sure, you can type or mouse click your PIN into a box, but since the card is not swiped, it's not TRUE PIN Debit...it's a "Card NOT Present" transaction. Without "card present' status, it's an "alternative" payment system.

True PIN Debit is conventional ...there's "NO ALTERNATIVE" way to do it...other than swiping the magnetic stripe (which contains the PIN Offset, the PIN Verification Value and the Track 2 data).

To see a LIVE Demonstration of the world's ONLY TRUE PIN Debit, simply Mention the PIN Payments News Blog OR cut out the Coupon above right, and bring it up to our Hospitality Suite.

We'll Remit $10.00 into your bank account using your (any U.S.) bank card "LIVE" in "real time"...right before your eyes!

HomeATM has engineered, patented and manufactures the ONLY PIN Entry Device in the WORLD to achieve the notoriety of PCI 2.0 PED Certification. In a sense we're the Porsche of Payments. "There is NO substitute! The most secure internet payment mechanism in the world...wide web! HomeATM enables:

Internet PIN Debit Transactions
Person to Person Payments
Secure 2FA (two-factor authentication)
Online Banking
P2B Online Bill Payments
B2B Payments
Secure Money Transfer/Remittance

All in Real-Time. Always 3DES DUKPT End to End Encryption...including Track 2 Data.

Friday, April 17, 2009

Something Phishy About Bank's Not Using 2FA from HomeATM

Research shows that most online banking sites have inbuilt flaws which could potentially put valuable customer data into the wrong hands.

Now there is a way (since March 17th, 2009) to vastly increase the security of online banking.

HomeATM engineered AND manufactures the world's FIRST and ONLY PIN Entry Device solely designed for online authentication and eCommerce to achieve PCI 2.0 certification. What that means is:

Banks now have a choice. They can use what many consider to be a very obsolete UserName/Password login OR they can provide a methodology which safely and securely authenticates their online banking customers with two-factor authentication.

Logging on to a bank's online banking site is now quick/convenient and easy.

Bank customers would simply swipe their bankcard through HomeATM's SafeTPIN device and enter their bank assigned PIN.

HomeATM is proud to introduce the security of "True" 2FA (two-factor authentication) to the online banking community AND provide the impetus for banks to procure more online banking customers via the allure of the most secure online banking platform in the industry.

I don't mean to oversimplify how easy it would be for a financial institution to implement "True 2FA" with HomeATM's device, but it's unavoidable.

To keep it short, I'll provide but one recent fact from Gartner Research:

Phishing attacks are costly:
According to research firm, Gartner, banks, online payment organizations and other financial institutions are bearing most of the financial cost of phishing attacks. (A survey of nearly 4,000 US consumers revealed a 40% increase in the number of phishing victims in 2008 over the year before to five million.)

The average loss was $350 per phishing attack, but consumers said they had recovered 56% of their losses from the financial institutions involved. (That's $196 to the banks and $154 to the consumers) "The findings underline the fact that the war against phishing is far from over," said Avivah Litan, analyst at Gartner. (Yes, the very same Avivah Litan who says "never" enter your PIN on the Internet unless it's hardware based)
Guess what? The HomeATM "SafeTPIN" device would not only eliminate "phishing attacks" but it would also eliminate the threat of "cloned cards," "cloned bank sites", AND provide "True 2FA." for online banking customers.

Additional benefits include empowering online banking customers with the ability to perform:

Person to Person Money Transfers,
Bill Payment Online (with "True PIN" vs. PINless Debit)
Secure online transactions with online retailers.
As I said, I don't mean to oversimplify WHY they banks should investigate our solution further, but sometimes the simplest things in life are the best...aren't they?

In closing out this week's edition of the PIN Payments News Blog, 'll state one more "food for thought" item.

According to a trustworthy source, Bank of America spent $129 Million on PCI DSS compliance last year.

Now I'm not saying that our SafeTPIN device would eliminate the entire cost of PCI DSS compliance, BUT...on account of how we are "already" PCI 2.0 PED certified, any bank that utilizes our device for "True Two Factor Authentication" during the log-in process, would effectively be removed from the scope of PCI DSS requirements.
at least for their online banking application
and Bill Pay
and online eCommerce Transactions
and Money Transfers
So...to anybody out there that knows some high level banking executives...pop me an email and let's talk.

I'll make you some serious money, save the bank's some serious money, enhance the banks' image AND provide consumers with the peace of mind knowing that their financial information is secure!.

Consumers fear financial security threats more than the threat of a terrorist attack (see graph on left)

Here's a quote from: Convenience or Security? How About BOTH?

American's "DEFINITELY" want security.

In fact American's worry more about credit and debit card fraud than they do about a terrorist attack...according to a new report from Unisys.

Oh...and in quantity, our device costs about 10% of what it currently costs banks and consumers for each "phishing incident." Simple...ain't it?

online banking, security, 2FA, two-factor authentication, HomeATM, Banks, Financial Institutions, Terrorist Attack, Phishing, Hack, Fraud, Bill Pay, login, SafeTPIN, PIN Debit

Online Fraud Benchmark Report - RSA Conference

Source: eFraud Network
More info: https://www.e-secure-it.com/upload/348032.pdf

To download a copy of the PDF, courtesy of E-Secure-It.com click the link above. Click the graph on the left to enlarge.

Executive Summary

Experts know there are more stolen credentials in the hands of the cybercriminals than ever before.

And, we’re seeing more fraudsters cash‐out using stolen credentials with unprecedented speed. Last year, RBS WordPay reported their debit card payroll card system was the victim of a hacking ring compromising over one million personal records. What was different about this hack, however, was the speed with which the cybercriminals behind the hack were able to cash‐out. News agencies in the U.S. reported that nine million in cash was netted by cloning cards in 49 cities across the globe in the U.S., Canada, Russia and Hong Kong all in about 30 minutes1. Similarly, in the U.S., PIN cashers were able to withdraw five million in less than 48 hours from Citibank2 using compromised prepaid debit card accounts.

In testimony at Homeland Security Committee hearings about data breaches, the Department of Justice said “the problem has grown so big federal prosecutors across the country are pursuing 2,000 cases related to identity theft” and that “the number of convictions for identity theft have more than doubled – a 138 percent increase, in the last four years.”3

Combine this testimony, and the attacks mentioned above with the Heartland Breach – the largest data breach on record as far as number or identities compromised – and 2008 will be remembered as the year the cybercriminals not only perfected their identity‐stealing skills but also their bank robbing skills.

To try and understand how online fraud and data breaches are impacting multiple industries and organizations, the Program Committee of the eFraud Network™ Forum (eFN)– a global group of antifraud professionals from the financial services, payment, merchant and law enforcement community created its first in‐depth survey about online fraud.

We received 104 responses from individuals representing organizations in many different industries and countries. We provide information about the survey respondents and our methodology in Appendix A.

Key Findings: The 2009 Online Fraud Benchmark Report highlights five significant findings:

• Data breaches are no longer a rarity and current regulations are not working.
• Spending to prevent fraud is up or holding steady through 2009.
• More cross‐industry information sharing is needed to prevent online fraud.
• We still don’t know the economic damage of the Heartland Breach.
• There is a direct correlation between the number of attacks and number of customer accounts
managed by the survey participants.

1 http://www.myfoxny.com/dpp/news/090202_FBI_Investigates_9_Million_ATM_Scam
2 http://blog.wired.com/27bstroke6/2008/06/citibank‐atm‐se.html
3 See: http://www.cnn.com/2009/US/03/31/identity.theft/index.html

2FA is Needed for Online Services

Will 2FA use transcend online banking? : News : Security - ZDNet Asia

Will 2FA use transcend online banking?
By Vivian Yeo, ZDNet Asia
Friday, April 17, 2009 07:25 PM

SINGAPORE--Two-factor authentication (2FA) is starting to become available for online services other than banking and remote logon to corporate networks, but it remains to be seen whether consumers will take to it.

Local security technology firm Data Security Systems Solutions (DSSS), is set to showcase a new two-factor authentication service for online services at the RSA Conference next week. Called BetterThanPin, the service is unique in that it allows consumers, rather than service providers or enterprises, to initiate stronger authentication for the online services they deem important, said Tan Teik Guan, the company's chief executive and chief technology officer, in an interview Friday with ZDNet Asia.

The BetterThanPin service requires a user to create an account on the BetterThanPin portal and register the online accounts. (Editor's Note...IMHO, that makes it "worse than PIN" because it's done on the web. Anything done in the browser space is hackable.)

During the sign-up process, the user is also asked to select the preferred mode or token of receiving the weekly-generated passwords. These temporary passwords--six-digit numbers--will be added to the string of characters in a user's static password for a particular account.

According to Tan, the service currently only allows users to initiate 2FA for their Gmail accounts. However, it is also ready to manage Facebook accounts, and there are plans to include Yahoo Mail and Skype to BetterThanPin. The service is also envisioned to be compatible with hardware and software tokens.

Starting next week, DSSS will initiate a trial for Gmail users, he added. The company is targeting 1,000 users of different demographics globally to participate in the trial, which will last till August.

"From the feedback, we will decide whether to continue [developing] the service [and] what [other] online services to ready [it for]," said Tan.

The company has so far been focused on developing BetterThanPin, which uses existing authentication technology by DSSS, and paid scant attention to the commercial viability of the service, admitted Tan. However, he said the service could eventually be offered through the cloud by service providers, in individual enterprise deployments such as Intranet sign-in or directly to individuals.

Should DSSS market the service direct to consumers, it may include advertisements sent with the temporary passwords as it would not be realistic to offer the service for free long-term to consumers, he noted.

DSSS is not alone at trying to introduce stronger authentication for online services. Last month, Vasco Data Security announced in a media release that customers of Square Enix would be offered stronger authentication to access content and services by the Tokyo-based video game company.

With the move, Vasco noted the popular massively multiplayer online role-playing game, Final Fantasy XI, would be the first online game in Japan to make use of one-time passwords for authentication.

Citing statistics released by Japan's Ministry of Internal Affairs and Communications in February, Vasco said there were nearly 2,300 cases of fraudulent access to online services in the country last year--a 26 percent increase year on year. Over half of the cases involved online auctions, while some 457 were related to online games.

Security vendors including Sophos and Symantec, have also, in the past, warned of cybercriminals tapping on malware such as Trojans to steal credentials of online gamers. With the growing number of online game sites and players, it was increasingly lucrative for malware writers looking to profit from online assets.

Continue Reading at ZDNETAsia

better than pin, homeatm

Breaches Will Get Worse in '09

Data Breaches Rampant in 2008

More electronic records were breached in 2008 than the previous four years combined, according to the 2009 Verizon Business Data Breach Investigations Report (pdf) released this Wednesday.

The research is based on Verizon Business data of 285 million compromised records from 90 confirmed breaches.

Key findings from Verizon's report:

Most data breaches investigated were caused by external sources. External data breaches are highest in Eastern Europe, East Asia and North America; these regions combined account for 82% of all external attacks.
Most breaches (64%) resulted from a combination of events rather than a single action. For example, an attacker exploiting a mistake committed by the victim, hacking into the network, and installing malware on a system to collect data.
In 69% of cases, the breach was discovered by third parties - most organizations do not discover their own breaches.
Nearly all records compromised in 2008 were from online assets, but not desktops, mobile devices, portable media, etc. Rather, 99% of all breached records were compromised from servers and applications.
Roughly 20% of 2008 cases involved more than one breach.
"Highly sophisticated" attacks account for only 17% of breaches, Verizon said. Still, these cases accounted for 95% of the total records breached, which indicates that hackers know where and what to target.
Being Payment Card Industry (PCI) -compliant is critically important: 81% of affected organizations subject to the Payment Card Industry Data Security Standard (PCI-DSS) had been found non-compliant prior to being breached.

Data breaches investigated in 2008 affected a wide array of organizations:

Food and beverage establishments, the second most frequently hit industry in the first report, dropped to 14% in 2008, down from 20%.
The retail industry accounts for a third of all cases.
Breaches in the financial services increased the most, doubling to a share of 30%, and representing 93% of the compromised records in the study - with 90% of these records involving groups engaged in organized crime.

Mistakes and oversight failures - as opposed to lack of resources and hindered security efforts - were identified as the main cause of the breaches. And 90% of all breaches could have been avoided if basic security guidelines had been followed, Verizon concluded from a previous study, covering 230 million compromised records from 2004 to 2007.

These are: changing default credentials; avoiding shared credentials; reviewing user accounts; employing application testing and code review; patching comprehensively; assuring HR uses effective termination procedures; enabling application logs and monitoring them; and defining "suspicious" and "anomalous" - be prepared to defend against and detect very determined, well-funded, skilled and targeted attacks.

Cybercrime is always evolving, Verizon said.

For example, new methodologies, like memory scraping malware, are being used to steal personal identification codes, or PIN numbers, associated with credit/debit accounts, to withdraw cash directly from a consumer's account.

Acculynk, HomeATM, Breach, PIN Codes

Hackers, PIN Codes and Sensationalism

What follows is a dynamite piece from the Securosis Blog explaining that the piece in Wired, about PIN cracking, was a blend of sensationalism and journalism. I especially like Adrian Lane's theory on the Heartland Breach which I have enlarged and greyed below. Enjoy!

“PIN Crackers” and Data Security

Really excellent article by Kim Zetter on the Wired Threat Level site in regards to "PIN cracking", and some of the techniques being employed to gather large amounts of consumer financial data. I know Rich referenced this post earlier today, but since I already wrote about it and have a few other points I think should be mentioned, hopefully you will not mind the duplicated reference.

Before I delve into some of the technical points, I want to say that I am not certain if the author desired a little sensationalism to raise interest, or if the security practitioners interviewed were not 100% straight with the author, or if there was an attempt to disguise deployment mistakes by hyping the skills of the attacker, but the headline and some of the contents are misleading. The attackers are not 'cracking' the ATM PINs, as the encryption is not what is being attacked here. Rather they are 'scraping' the memory of the security devices, looking for unencrypted data or the encryption keys. In this case by grabbing the data when it is unencrypted and vulnerable (in a cryptographic sense if not the physical one) within the Hardware Security Device/Module/Unit for electronic funds transfers, hackers are in essence sniffing unencrypted data.

The attack is not that sophisticated, nor is it new, as various eavesdropping methods have been employed for years, but that does not mean that it is easy. Common tactics include altering the device's operating system or 'attaching' to the hardware bus to access keys and passwords stored in memory, thus bypassing intended interfaces and protections. Some devices of this type are even constructed in such a way that physical tampering will destroy the machine and make it apparent someone was attempting to monitor information. Some use obfuscation and memory management technologies to thwart these attacks. Any of these requires a great deal of study and most likely trial and error to perfect. Unless of course you leave the HSM interface wide open, and your devices were infected with malware, and hackers had plenty of time to scan memory locations to find what they wanted.

I am going to maintain my statement that, until proven otherwise, this is exactly what was going on with the Heartland breach. For the attack to have compromised as many accounts as they did without penetrating the Heartland facility would require this kind of compromise. It implies that the attackers have access to the HSM, most likely exploiting negligent security of the command and control interface, and infecting the OS with malicious code. Breaking into the hardware or breaking the crypto would have been a huge undertaking, requiring specialized skills and access.

Part of the reason for the security speed-bump post was to illustrate that any type of security measure should be considered a hindrance; with enough time, skill and access, the security measure can be broken. Enough hindrances in place can provide good security. Way back when in my security career, we used to perform hindrance surveys of our systems to propose how we might break our own systems, under what circumstances this could be done, and what skills and tools would be required. Breaking into an HSM and scraping memory is a separate and distinct skill from cracking encryption (keys), and different from writing SQL and malware injection code. Each attack has a cost in time and skill required. If you had to employ all of them, it would be very difficult for a team of people to accomplish. Some of the breaches, both public as well as undisclosed breaches I am aware of, have involved exploitation of sloppy deployments, as well as the other basic exploitation techniques. While I agree with Rich's point that our financial systems are under a coordinated multi-faceted attack, the attackers had unwitting help.

Criminals are only slightly less lazy than system administrators. Security people like to talk about thinking like a criminal as a precursor to understanding security, and we pay a lot of lip service to it, but it is really true. We are getting to watch as hackers work through the options, from least difficult to more difficult, over time. Guessing passwords, phishing, and sniffing unencrypted networks are long since pase, but few are actively attacking the crypto systems as they are usually the strongest link in the chain. I know it sounds really obvious to say that attackers are looking at easy targets, but that is too simplistic. Take a few minutes to think about the problem: if your boss paid you to break into a company's systems, how would you go about it? How would you do it without being detected? When you actually try to do it, the reality of the situation becomes apparent, and you avoid things that are really freakin' hard and find one or two easy things instead. You avoid things that are easily detectable and being watched. You learn how to leverage what you're given and figure out what you can get, given your capabilities. When you go through this exercise, you start to see the natural progression of what an attacker would do, and you often see trends which indicate what an attacker will try and why.

Despite the hype, it's a really good article and worth your time.

—Adrian

PIN Codes, hacking, PIN Cracking, PIN Crackers, HomeATM, Acculynk

ATM Skimming Incidents Take Off!

ATM 'skimming' increases as economy falters
Thieves attach mini-technology to machines for just a few hours that secures customer card numbers, PINS, to make new cards

April 17, 2009
The Baltimore Sun

BALTIMORE — Privacy experts, banks and others are warning consumers about a threat to their personal financial information: electronic "skimming" devices that record credit-card and debit-card numbers at ATMs, gas pumps or vending machines. Using tiny technology disguised as part of the machine, thieves use the information to press new cards with customers' numbers, to the dismay of cardholders such as Kristin R. Kyriakos, 29, of south Baltimore, who returned from vacation Monday to numerous bank overdraft notices in her mailbox.

Thieves had stolen her number while she used an ATM at a Wachovia branch location. With that information, they withdrew cash from several ATMs in New York, taking $2,500, she said. "All of a sudden, I'm really apprehensive," Kyriakos said. "I wasn't aware that people were even capable of doing this."

There's no central source of data to determine the extent of the problem, said American Bankers Association spokeswoman Margot Mohsberg, but anecdotal evidence suggests skimming is cyclical, like other types of fraud.

"As the economy gets worse and people get more desperate for money, the amount of fraud tends to go up," she said.

Also, the technology is more accessible, with people able to purchase the necessary equipment over the Internet, she said. Criminals use magnetic strip readers to record information from the ATM card.

Continue Reading

FYI:

Under the federal Electronic Funds Transfer Act, banks have up to two weeks to investigate before returning any money, said Paul Stephens of the nonprofit Privacy Rights Clearinghouse. That can be a big problem for people who need cash in their accounts to pay bills and living expenses.
"You may be in a position where your account is completely depleted," he said. "Don't be fooled by the promise that ... you have 'zero liability for fraudulent transactions.' You have zero liability once the investigation is completed."
He noted that skimming schemes in which thieves capture ATM card information as well as PINs were not very common. Debit cards or check cards are more vulnerable, because they are used like credit cards for less secure point-of-sale transactions without entering a PIN, Stephens said. ATMs often have security cameras that would record any tampering, he said.
Federal law provides limited protections for consumers who use debit cards or check cards. Debit-card users are liable for $50 of fraudulent charges if they notify their banks in writing within two days of noticing errors, but up to $500 within 60 days, said Hugh Williams, coordinator of the identity-theft office of the Maryland attorney general's office.
"After that, it's gone, basically," he said. That's why he reminds everyone to regularly inspect their bank statements.

ATM Skimming, Skimming Devices, PINs

Personal Identification Numbers, or PINs, are supposed to provide secure authentication for bank cards. Unfortunately, they are increasingly failing to do so. - Chad Perin from the Tech Republic Blog

Most of you have probably heard about ATMs with skimmers mounted over the card slot that can read your card on the way in and out of the machine, with carefully placed cameras to read your PIN as you type it in. The person setting up this little trap can then clone the card with the skimmed data, and with the pin gets access to your bank accounts. The first time I remember hearing about that method for cracking PIN security on bank cards was in the early ’90s, so it’s not exactly a new technique.

More recent developments in bank card security cracking include malicious phishing Websites, cross-site scripting, and legitimate Websites that have been directly compromised by security crackers. It’s an especially disturbing phenomenon because bank cards don’t usually have the same zero liability protections as credit cards — a fact most users of debit cards don’t think about when they use their bank cards the same way they’d use credit cards.

A new, and even more disturbing, security vulnerability for bank cards has arisen.

A research fellow at the French National Institute for Research in Computer Science and Control (say that five times fast) named Graham Steel wrote a paper in 2006 that addressed vulnerabilities in the hardware security modules that tie the bank card authentication network together.

The paper, submitted to British HSM manufacturer nCipher, provided guidelines for hardware security module configuration that would help mitigate the vulnerability of the devices to attack, but it also pointed out that other aspects of HSM vulnerability were inherent to their design. To really and truly fix the problem of HSM vulnerability, the devices would have to be fundamentally redesigned in a manner that is not backward compatible. Payment processing networks across the globe would have to be reimplemented using a different, improved standard.

HSM manufacturers such as Thales-eSecurity maintain that they address the security vulnerabilities addressed by Steel’s paper, but thus far they seem to be taking an approach remarkably similar to the way Microsoft OSes are “secured” against viruses. Other reassurances that HSM manufacturers are seeing to our security involve statements about how the devices are delivered in a very secure configuration by default, which is all well and good if you don’t need them to actually do much. Unfortunately, most payment processing transactions require functionality to be enabled that exposes the devices to significant potential for compromise. As Brian Phelps of Thales-eSecurity put it, according to the Wired article PIN Crackers Nab Holy Grail of Bank Card Security:

It’s a very difficult challenge to protect against the lazy administrator. Out of the box, the HSMs come configured in a very secure fashion if customers just deploy them as is. But for many operational reasons, customers choose to alter those default security configurations — supporting legacy applications may be one example — which creates vulnerabilities.

He went on to confirm Steel’s estimation of the scope of the problem, saying that redesigning the payment processing system to comprehensively address the current vulnerabilities due to legacy systems compatibility needs “would require a mammoth overhaul of virtually every point-of-sale system in the world.” If this doesn’t send a chill down your spine, either you aren’t paying attention, or you don’t actually use a bank card.

It is only recently that verifiable incidents of PINs being skimmed from HSMs, either gathered unencrypted from the device’s volatile memory or picked up as encrypted PIN blocks and decrypted. In some cases, at least, the decryption is made possible by the fact that the HSMs themselves contain decryption keys, and once one encrypted PIN block is decrypted it becomes much easier to decrypt the rest of them.

At first glance, one might think that the idea of storing decryption keys on devices scattered around the country that relay PINs from point to point using a model conceptually similar to Internet routing itself should have been immediately recognizable as a bad one, thanks to the example of the inherently flawed concept of digital DRM. Of course, the design of payment processing hardware security modules predates the AACS key for HD-DVDs, the Sony DRM rootkit, and Microsoft’s WGA. HSM designers get a free pass on learning from the mistakes of others, although the fact the mistake was made in the first place should have been avoidable.

For the most part, the problem is the way HSMs pass PINs around, tend to have scads of unnecessary features enabled at any given time, and contain the keys needed to decrypt the encrypted PINs. A couple of key points include:

End-To-End Encryption: The PINs should be encrypted and decrypted only at the end-points. Encrypting and decrypting anywhere between those points just increases the options for unauthorized interception.
Private Key Encryption: Using standardized encryption keys is tantamount to criminal negligence in this age of private key cryptography. Each and every end-point, including the bank cards themselves and the receiving systems that need to authenticate a request, should have a private and public key set. This way, you’d only be able to read data if you’re one of the unique end-points that is supposed to have access to it.

As things currently stand, however, the likelihood of the system being overhauled is pretty slim due to the immense cost that would be involved in replacing an entire global payment processing network with an incompatible standard. As a result, this problem is likely to be addressed only in a superficial, “it works right now and that’ll have to be good enough” manner. In many cases, it may not even be secured that well. Be extremely careful where you use your bank cards in the future. While liability protection for credit cards tends to be better than for debit cards, even there you should be wary of the potential threat.

Chad Perrin is an IT consultant, developer, and freelance professional writer. He holds both Microsoft and CompTIA certifications and is a graduate of two IT industry trade schools. Read his full bio and profile.

Shares of Major Credit Card Companies Mixed

Sector Snap: Credit card companies mixed - Forbes.com

Associated Press
Sector Snap: Credit card companies mixed
Associated Press,

Shares of major credit card companies were mixed Thursday, as several analysts warned that ongoing credit deterioration and a decline in consumer spending will likely pressure earnings for some time.

Investors got some mixed data about credit card losses Wednesday: Capital One Financial Corp. said its U.S. and international credit card defaults jumped in March, but American Express Co. said defaults in its U.S. card unit rose only slightly. The latter report indicated that some cardholders may be having an easier time paying their bills.

Visa shares fell 99 cents to $58.12, while MasterCard dropped $3.99, or 2.4 percent, to $161.47.

Read the Entire Article at Forbes

Visa, MasterCard, Discover, American Express, Capital One

Visa Aquarium :60 Second "Tuesday Afternoon" Commerical

The Moody Blues "Tuesday Afternoon" is the song used by Visa in their Aquarium Ad. If you want to hear the entire song, scroll down for the "extended version" of Tuesday Afternoon.

I've got a lot of questions in the comments section regarding who sings it and what's the name of the song, on a post I did back in early March, about Visa's new Go with Visa campaign. "New Visa Commercial: Aquarium

So I thought I'd bring you the :60 second commercial. Here it is a long with a post from Zoo and Aquarium Vistor's Rudy Socha:

Should You Use Your Visa Card When You Visit An Aquarium On A Tuesday Zoo and Aquarium Visitor News

Should You Use Your Visa Card When You Visit An Aquarium On A Tuesday?

By Rudy Socha

Lorain, OH - Recently as part of its GO global advertising campaign Visa ran an ad showing a father taking his daughter to a public aquarium. The commercial was very well done and would have great appeal to young families with children, especially those who regularly visit zoos and aquariums. The tag line asks “When was the last time you took your daughter to an aquarium on a Tuesday?”

There are many branding messages implied by Visa being associated with a family visit to a public aquarium. The most prominent message is “Visa enables your visit”. Visa wants to be thought of as synonymous with a visit to a public animal attraction.

There is a very good reason for Visa doing this as a component of their global ad campaign. Each year more than 200 million Americans visit animal attractions. Worldwide attendance is close to 800 million.

The image of a parent taking their child to an aquarium is very positive and there are a lot of positive connotations associated with this industry. Today’s animal attractions in the United States are associated with conservation, wildlife preservation, environmental education, and overall have the “Green” image every company desires.

Continue Reading

Visa Aquarium, Moody Blues, Tuesday Afternoon

Google, Green Dot, MasterCard, Visa, Western Union in Online Payment Suit

If you can't compete, file a patent-infringement lawsuit!

Actus a Texas Hold'em company, is gambling that it could win big. Oops...did I say Texas Hold'em, I meant Texas-based patent-holding company Actus has filed a patent suit against 20 companies including Google and Sonic Solutions in the US District Court of Texas alleging infringement of four of its patents for an electronic payment system.

What have they been doing all these years? I haven't heard a peep about this company.

Apparently they dream big, because other defendants in the case include Bank of America, Capital One Financial, Green Dot, JP Morgan Chase & Co, MasterCard International, Meta Financial Group, M&T Bank Corporation, Obopay, Visa, Vivendi Universal SA, Wal-Mart Stores, Walt Disney Co, (hope they slip 'em a Mickey) and Western Union.

Google faced 14 patent challenges in 2008, compared to only three in 2006 and has suggested that it plans to curb the growth of potential lawsuits by fighting rather than settling them. However, last month it agreed to settle a visual voicemail patent dispute with Klausner Technologies.

Here's more on the story from Finextra:

Finextra: BoA, MasterCard, Visa sued over e-commerce payments patents

BoA, MasterCard, Visa sued over e-commerce payments patents
Actus, a recently formed US holding company, is suing 20 companies, including Bank of America, MasterCard, Obopay and Visa, accusing them of infringing four patents related to an electronic payments system for e-commerce.

Actus, a holding firm based in Texas, filed a suit against the companies in the US District Court for the Eastern District of Texas last week.

The other defendants are Blaze Mobile, Capital One, Enable Holdings, Google, Green Dot, Javien Digital Payments Solutions, JP Morgan Chase, Meta Financial Group, M&T Bank, Sonic Solutions, Vivendi Universal, Walt Disney, Western Union, WildTangent, AgileCo and Wal-Mart.

The patents in question relate to "methods and apparatus for conducting electronic commerce using electronic tokens", where digital currency is used by customers for online payments.

According to the abstracts for the patents: "The electronic tokens are issued and maintained by a vendor, who also provides products and services that can be purchased or rented using the electronic tokens. The electronic tokens may be purchased from the vendor either on-line, using a credit card, or off-line, using a check, money order, purchase order, or other payment means."

The patent applications were originally filed by a company called PayByClick, with Marvin T Ling listed as the inventor.

According to legal newswire Law360, gift cards offered by Bank of America, JP Morgan, Visa, and others, are among the products accused of infringing the patents. Google's Checkout service is also named.

Actus is seeking a permanent injunction against further infringement and unspecified damages. The suit also seeks treble damages because Actus says the patents were infringed wilfully.

Actus, Visa, MasterCard, Western Union, Green Dot, JP Morgan, Capital One, Obopay, Wal-Mart, Vivendi Universal, Western Union, online payment

Monday, April 20, 2009

Sunday, April 19, 2009

Friday, April 17, 2009

Data Breaches Rampant in 2008

Disqus for ePayment News