Fraud , Payments Fraud

Four years after criminals exploited flaws related to the Europay-MasterCard-Visa, or EMV, security protocols to commit as much as 600,000 euros ($656,000) in fraud, security experts say that the underlying vulnerability remains present (see How Criminals Cracked EMV). But payment card issuers and industry representatives contend that the related vulnerability has been successfully mitigated and note that no successful copycat attacks have ever been seen.

More than just networking - our Fraud Summits provide actionable plans to put to work at your organization. Register Today >

News of the related fraud spree first came to light in October, when French researchers published a paper detailing their digital forensic analysis of the 2011 crimes. The researchers, who were commissioned by French authorities after the fraud was detected, found that a gang of criminals had "clipped" - removed - smartcard chips from genuine cards; those chips are designed to authenticate the card. By adding the chips to homebuilt cards and making use of a second chip - either on the card or connected to it via wires up their sleeve - they were able to subvert the cardholder-authorization process by executing a successful man-in-the-middle attacks against POS terminals.

To block repeat attacks, the French researchers report that Cartes Bancaires - France's national interbank network - added multiple countermeasures, including a new Combined Data Authentication mode, a.k.a. "strict checking," which requires online verification of all transactions.

But in the wake of the researchers' report, one banking official from Malaysia - which is currently transitioning from chip-and-signature cards to chip-and-PIN cards, contacted me to ask exactly how this flaw has been either fixed outright or mitigated: "I'd like to clarify on what 'fixed' in this case meant - were the countermeasures specific to the defrauded bank? Or was the EMV specifications updated to include the countermeasures? ... I need to understand if we will be exposed to this risk in the near future."

Full Fix: Strict Checking

There is a full fix for the related vulnerability. "The fix is to turn on strict checking and verify that the card and the PED [PIN entry device] had the same view of the transaction," says Ross Anderson, a professor of security engineering at the University of Cambridge.

But he tells me the fix has not been widely adopted. "The flaw hasn't been fixed in the U.K., except by HSBC," he adds. "Most banks seem to be happy to take the risk - which is largely borne by customers anyway." That's a reference to many European banks' terms and conditions, which posit that because EMV has eliminated card cloning, consumers must be at fault for any card-present transactions that were authenticated.

Tom Wills, a Singapore-based director at the consultancy Ontrack Advisory, also notes that while CDA mitigates the vulnerability, it "only works when it's turned on, and it's not in widespread use today." As a result, "in practical terms, the vulnerability is still very much out there."

No Copycat Crimes Seen

A Visa spokeswoman, however, contends that the problem exploited by the European fraudsters has been mitigated. "This was an isolated incident, and in the five years since it occurred, worldwide improvements in telecommunications and the resulting decline in 'offline' transactions, which are not authorized in real time by the issuing financial institution, have been effective in mitigating against this issue," she tells me.

EMVCo - which manages the EMV specifications - as well as MasterCard and the U.K. Card Association didn't immediately respond to a request for comment.

But the Visa spokeswoman says EMVCo now provides tools to developers that are designed to mitigate the vulnerability described by the French researchers and that Visa also now employs additional defenses. "Visa implemented a zero floor limit for contact-chip and magnetic-stripe-read transactions in a majority of Visa Inc. countries, meaning that transactions of any amount must request online authorization," she says. "This change to Visa's rules effectively mitigated the risk posed by so-called 'man in the middle' or 'wedge' attacks."

Strict Checking: Pros and Cons

Why not simply implement CDA - strict checking - across the globe?

Wills says that CDA works best in environments where all cards and readers are CDA-compatible. Unfortunately, when CDA-compatible cards are used in non-CDA environments, the risk of legitimate transactions failing increases. "Practically speaking, that means you would have to implement CDA in 100 percent of cards and terminals in a given market," he says. "That would be great from a security point of view, but when a cardholder from that market traveled to another country where CDA wasn't in place, then that wouldn't be so great."

As a result, many banks still use static data authentication, or SDA, which is less secure but also less computationally intensive, meaning it won't slow transaction speed. "That's seen as undesirable, especially during this early stage when the industry is trying to promote a new way of paying to sometimes non-receptive consumers," Wills says.

Not Foolproof

In recent years, researchers - and criminals - have identified multiple ways in which EMV-compatible POS systems can be subverted. Anderson and his colleagues in 2014, for example, demonstrated a "chip and skim" attack that could be used to exploit some types of POS devices and ATMs that failed to use sufficiently random numbers to relay back to the banking network to identify a card being used at a POS device. As a result, attackers could deduce the card authentication algorithm and use it to spoof legitimate cards.

University of Surrey computer science professor and cybercrime expert Alan Woodward says this type of research remains vital, so that EMV-related implementations can continue to be better locked down.

Such research is also a reminder that EMV, which is still in the process of being implemented in the United States, is not foolproof, Wills from Ontrack Advisory tells me. "Despite what we might hear from some proponents of EMV, it's not unsinkable - far from it, and we're going to see more exploits emerge in the future as smart and motivated criminal hackers diligently work to break the protocol," he says. "Like all security controls, without exception, EMV technology can only do its job properly if it's deployed in the context of a layered, defense-in-depth security architecture."

The card brands likewise note that it's important for card issuers to not just rely on EMV, but to also employ tokenization and other controls to better secure payment card data. Visa's spokeswoman, for example, says it also analyzes "up to 500 different data elements in real time - including geo-location, device ID, and IP addresses - to more accurately identify and prevent fraud."

Info Sharing , Payments , Technology

At the many events Information Security Media Group hosted in the past year, I had the opportunity to conduct video interviews with a long list of leaders in the financial sector.

In addition to interviews at our fraud and data breach summits, I also conducted sessions at the RSA Conference 2015. As the year draws to a close, here's my review of three of the best of those interviews that I encourage you to view.

Bob Carr

In October, I had an opportunity to sit down with Bob Carr, founder and CEO of payments processor Heartland Payment Systems.

As you'll recall, Heartland, which earlier this month was acquired by Global Payment Systems, suffered a massive data breach in 2008 that exposed some 130 million credit and debit cards. The incident cost issuing banks and credit unions about $500 million, and Heartland spent $150 million on remediation.

Carr took ownership of Heartland's breach and spoke about it in great detail in the following weeks and months. And his transparency earned him a lot of credibility.

"We knew when the breach happened ... and within hours we thought we had remediated it," Carr told me during our interview. "That was our mistake. ... The bad guys were in our system for six months before they figured out how to cross over into our payments network, which is when the disaster really occurred."

Watch the video with Carr, and you'll hear his explanation of how Heartland used its breach to make some significant changes. He also calls for improved breach detection and much wider use of encryption.

Eduardo Perez

I also had the opportunity in October to interview Eduardo Perez, senior vice president of payments risk at Visa.

The U.S. migration from magnetic stripe card technology to the EMV chip was front and center this year, and Visa was not always the most popular name among merchants and issuers.

Perez never dodges the hard questions, and he always speaks candidly to me. When testifying before Congress about data security concerns in the wake of the Target and Neiman Marcus breaches, he used the same straightforward approach.

"Retailers need to remain vigilant in practicing good security hygiene and complying with PCI-DSS at a minimum," Perez says during his video interview with me. "We continue to require entities to comply with PCI-DSS; that's another way that we are ensuring that large merchants, in particular, remain focused on protecting sensitive, residual data that may flow through their systems. And then what we also have promoted is merchants adopting other technologies, like encryption and tokenization, to protect residual data. Those technologies, in combination or in and of themselves, help to devalue data, which makes the likelihood of a breach less and the cost of a breach much lower for the affected institutions."

View the interview with Perez, and you'll hear him explain why PCI compliance is the best way to ensure payments networks aren't breached, while EMV makes breaching card data much less appealing.

Joseph Burton

I'll wrap up my review of the top interviews of 2015 with a look back at the RSA Conference, when I interviewed cybersecurity attorney Joseph Burton, a partner at San Francisco law firm Duane Morris.

Burton's credentials are impressive. He's a former assistant U.S. attorney for the Northern District of California, where he handled the first prosecution in the U.S. for criminal copyright infringement of computer code. Today, he's a nationally recognized expert in information security law, with an emphasis on cybercrime and cybersecurity.

In our video interview, Burton talks about the legal ramifications of information sharing. "One of the issues that clients have with information sharing is whether or not there may be some liability that flows from sharing the information and/or exposing what they are doing, or in some instances, not doing," Burton says. "So some sort of immunity or exemption for sharing is what most clients are worried about. The other issue is not so much liability for sharing, but clients worry about the confidentiality of information they have. There also are clients that have information that is regulated. They have a specific requirement to maintain the confidentiality of that information."

But Burton says some of the concerns about information sharing are overblown. And the recently enacted cybersecurity legislation, with its new liability protections, also could help ease those concerns (see: Obama Signs Cyberthreat Information Sharing Bill).

I hope you enjoy these video clips. I'm looking forward to bringing you many more interviews with industry leaders in the year to come.

Fraud

To minimize the risk of business email compromise schemes and similar types of fraud, senior executives at businesses should avoid posting information about their activities on social media and other accessible forums, says security expert Chuck Easttom.

See Also: 9 Steps to Build a Better Insider Threat Program

Business email compromise exploits use well-thought-out socially engineered scams, often involving impersonating executives, that con unsuspecting accounting staff members at businesses into scheduling fraudulent wire transfers.

In a video interview at Information Security Media Group's 2015 Fraud and Data Breach Prevention and Response Summit Dallas, Easttom describes how organizations get suckered by phony emails. "If you get a general email that says 'Dear sir or madam,' you probably dismiss it immediately. If you get an email that calls you by name and references things like, 'I saw you at the conference last Wednesday morning,' well, you were at a conference last Wednesday. That seems legitimate," Easttom says.

Easttom urges financial institutions to consider keeping certain information about senior executives less accessible to the public, similar to how intelligence and military agencies handle information. "[Recently], the secretary of Department of Homeland Security visited Cuba. It was announced once he was in Cuba. It was not announced before he flew for security reasons," he says.

"If I know that the vice president of finance is on a cruise for 10 days, then he's the guy I want to spoof. If you're a senior official at a bank, don't tell everyone you're about to be in Hong Kong for a summit. Tell everyone the week after how much you enjoyed the summit."

In this interview, Easttom also discusses:

Easttom, an independent consultant, is a computer security expert with more than 20 years of experience and multiple certifications, including CISSP, ISSAP, CEH, MCT and CCFP. In addition, he has published 19 books, including computer security textbooks used at universities around the world. He holds six patents and conducts training in security for law enforcement, federal agencies and other governments.

Risk Management , Technology

Out with the old, in with the new.

That's Adobe's holiday message for users of Flash, warning that attackers are actively exploiting a zero-day flaw in all versions of its Flash - a.k.a. Shockwave - browser plug-in software and that users should update immediately, or else.

On Dec. 28, Adobe released software updates that patch 19 separate security flaws in Flash as well as Adobe AIR, which is its cross-operating-system runtime that can combine HTML, JavaScript and Flash, among other technologies. Some of those flaws are labeled as being "critical," which in Adobe-speak means they potentially can be used by attackers to execute malicious code on a vulnerable system, possibly without a user being aware.

"These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system," Adobe's product security team says in a blog post.

Barring another emergency patch from Adobe before New Year's Day, the company this year will have patched 316 flaws in Flash, according to the Flash Tester website, which works out to the equivalent of more than 6 new bugs per week this year.

One of the 19 most recently patched flaws, described only as an "integer overflow vulnerability" and designated as CVE-2015-8651, "is being used in limited, targeted attacks," Adobe adds. "Adobe recommends users update their product installations to the latest version using the instructions referenced in the security bulletin." The company says credit for discovering that flaw goes to researchers at Chinese networking and telecommunications giant Huawei.

Even if attackers can't exploit that flaw to seize control of a targeted PC, "failed exploit attempts will likely result in denial-of-service conditions," warn security researchers from Symantec in a blog post.

Vulnerable software fixed in the latest update cycle includes all previous versions of the Adobe Flash Player Desktop Runtime for Windows and Mac OS X; the Adobe Flash Player for Google Chrome, plus Edge and Internet Explorer versions 10 and 11 - running on Windows 8.0, 8.1 or 10 - as well as Adobe Flash Player for Linux. Prior versions of Adobe AIR and related software development kits and compilers designed to run on Windows, Mac OS X, Android and iOS are also vulnerable.

But security experts recommend that users of recent versions of modern browsers - Google Chrome, Mozilla Firefox and Microsoft Edge and Internet Explorer - at least enable "click to play," so Flash won't execute without a user's permission. That can also help block related attacks, especially if they target zero-day flaws in the browser plug-in.

[!] ACTION REQUIRED: Set Flash as Click to Play in all your browsers. Here's easy all-in-one guide via @howtogeek | http://t.co/8IMLeW09nx

Why Use Flash?

The latest warning from Adobe that its plug-in software is being felled by zero-day attacks begs the question: Why do friends let friends run Flash anymore? (see Update or Uninstall Flash, Experts Warn).

Flash debuted in 1996, just three years after Adobe's then-proprietary PDF standard was first released. But whereas PDFs eventually became usable - I credit Apple - Flash has become the second-worst security nightmare plug-in that won't die, after Java.

How Flash Rates

What technology cyberattackers targeted in 2015. Source: Kaspersky Lab.

Security experts say that Flash's popularity with the hacking community is due to the plug-in's wide install base and the fact that buggy versions can be easily and automatically exploited en masse by crimeware toolkits, thus giving attackers an easy way to "pwn" many PCs at once. From there, they typically install malware to ransack the systems for financial information, install ransomware to extort bitcoins from victims, or turn infected systems into spam relays or nodes for launching large-scale distributed denial-of-service attacks (see Malware Hides, Except When It Shouts).

No End in Sight

Although Flash and Java are akin to the Steven Seagal of the security continuum - "Tough to Kill" and annoyingly persistent - experts are still trying to take it down. In July, Facebook's security chief, Alex Stamos, called on Adobe to set a date for Flash to die and for browsers to enforce the end of Flash so that developers will be forced to migrate to HTML5. He's just the latest in a long line of technologists - including the late Steve Jobs, who declined to let Flash run on iOS - to say that it's time to move to HTML5 and WebGL, which offer many of the capabilities of Flash, but in an open source and easier to secure form.

"Nobody takes the time to rewrite their tools and upgrade to HTML5 because they expect Flash4Eva," Stamos said via Twitter. And there are signs that even advertisers are finally dumping the plug-in, the Guardian reports.

It is time for Adobe to announce the end-of-life date for Flash and to ask the browsers to set killbits on the same day.

But don't hold your breath over Flash's imminent demise. On Nov. 30, Adobe announced that it soon plans to rebrand its Flash Professional CC tool - for creating Flash animations - as Animate CC. Adobe says the tool is designed "for developing HTML5 content while continuing to support the creation of Flash content. "

Anti-Malware , Breach Notification , Breach Response

Just in time for Christmas, Hyatt is notifying customers that their payment card data may have been compromised by malware-wielding cybercriminals. The major hotel chain is thus encouraging its customers "to review payment card account statements closely."

Hyatt says in a Dec. 23 statement saying that it recently "identified malware on computers that operate the payment processing systems for Hyatt-managed locations." The company says it launched a related investigation when the point-of-sale malware was detected, brought in third-party digital-forensic investigators, and that the related breach investigation remains ongoing.

Chicago-based Hyatt, which is controlled by the billionaire Pritzker family, says that in the wake of the breach it has "taken steps to strengthen the security of its systems," although does not detail what those steps might be.

Hyatt spokeswoman Stephanie Sheppard tells me that the hotel chain detected the POS malware infection on Nov. 30. But she declined to comment on my request for more details relating to the breach, including when it was first detected or how many of its 627 hotels - across 52 countries - might have been affected. Likewise, the hotel chain has not detailed how many customers may have been affected, or whether card issuers have yet detected related signs of fraud.

"The investigation is ongoing, and we will have more to share, such as scope, when the investigation is complete," Sheppard says.

But representatives at a call center set up to field related inquiries report that stolen information may have included payment cardholders' names, as well as card numbers, expiration dates and verification codes, Reuters reports. It adds that cybersecurity firm FireEye says that it was hired to investigate the breach. FireEye didn't immediately respond to a request for comment, although its Mandiant unit is one of the biggest breach-investigation service providers.

If Hyatt's breach notification is light on specifics, there is one message it tries to make loud and clear: "Customers can feel confident using payment cards at Hyatt hotels worldwide." In another bit of marketing speak, the Web page set up by the hotel to detail the results of the ongoing investigation into the Hyatt data breach is called "Protecting our Customers."

Finally, in what's now become such a de rigueur "we lost your data" disclaimer that it's cliché, Chuck Floyd, global president of operations for Hyatt, says in a post-breach statement: "Protecting customer information is of critical importance to Hyatt, and we take the security of your payment card data very seriously."

Hotel Malware-Infection Epidemic

With its breach alert, Hyatt becomes the fourth major hotel chain in two months to warn that it may have suffered a POS malware infection, following:

What Infections Often Reveal

Hyatt has not detailed what type of POS malware was used in the attack. But functionally speaking, security experts say there are often scant differences between different POS malware families.

Rather, a company's admission that it suffered a POS malware attack may speak to its failure to safeguard POS devices by changing their default passwords or running them on segmented networks, according to security expert Charles Henderson (see Why POS Malware Still Works). Using segmented networks in particular can help block unauthorized access to POS devices as well as data exfiltration attempts in the event of a breach, and not just for payment card data (see 5 Secrets to Security Success).

While the United States is in the process of adopting EMV-compatible payment cards, security experts say that POS malware can still steal payment card details, allowing criminals to buy and sell the stolen data, which can still be used for "card not present" fraud (see Why U.S. EMV Migration Will Spur Global Fraud Shift).

Note: This story has been updated with Hyatt spokeswoman Stephanie Sheppard's comments.

For half a decade, Congress debated, but never enacted, cyberthreat information sharing legislation. Then, this past December, Congress approved and President Obama signed the Cybersecurity Act of 2015.

The Cybersecurity Act provides liability protections to businesses to incentivize them to share cyberthreat information with government and with each other.

"Is the legislation perfect?" GovInfoSecurity Executive Editor Eric Chabrow asks in an audio blog (click player beneath image to listen). "Of course, not. What law is? For a bill to become a law, legislators make compromises. And that's what the Cybersecurity Act of 2015 is."

As James Lewis, senior fellow at the Center for Strategic and International Studies says, "It's a really good first step."

In this audio blog, you'll hear: