Credit Card Breach at California DMV

http://krebsonsecurity.com/2014/03/sources-credit-card-breach-at-california-dmv/

by ssclafani • 12 years ago

65 66 12 years ago

Varcht3• 12 years ago

I heard a commercial for Lifelock the other day. The hook was something like "Big news in identity theft! There hasn't been a major breach in a couple weeks..."

Something needs to be done to prevent this. I wonder if it would be feasible for the Credit card companies to do all the storage of card data as a service for retailers. Retailers would just store a reference token.

Until then my credit is frozen[1]

1. http://www.clarkhoward.com/news/clark-howard/personal-financ...

Cherian_Abraham• 12 years ago

What you are talking about is essentially the tokenization concept which should become real in 2014. All retailers such as Amazon would become Token requestors in this concept. Advantages would be to essentially make these breaches irrelevant as tokens could be invalidated quickly by the card issuers easily. Further, for merchants - the advantage would be reduced fraud and hopefully better interchange economics.

Varcht3• 12 years ago

Good to hear, I sincerely hope that can get it right.

jimktrains29• 12 years ago

A lot of processors have offered that service for years.

Amazon, being their own processor, probably stores their own numbers, but if Visa themselves would start tokenizing, that would be huge and awesome.

KMag• 12 years ago

It would be tragically easy for each credit card company to give each retailer a different Curve25519 public key and keep all of the private keys.

The retailer could immediately encrypt the CC number using Curve25519 and AES-256 as soon as they got it, requiring 48 bytes of storage. One or two more bytes (or a variable-length integer) would store which credit card company the token is good for. That way, each merchant can generate its own tokens without having to interact with the credit card companies, and any stolen tokens can only be used to make fraudulent charges with the same merchant from which they were stolen.

hga• 12 years ago

I would add in all seriousness that:

"It would be tragically easy for many retailers to not immediately encrypt the CC number using Curve25519 and AES-256 as soon as they got it, or take years to move to this, etc."

Although anything that, if properly used, would massively decrease the attack surface and localize the consequence of a breach, would be fantastic.

Right now the attack surface is just too damned big.

Hmmm, to prevent another Target, wouldn't each POS card acceptor need firmware or hardware changes to do this action "immediately"?

kabdib• 12 years ago

"Tragically easy" in the case of a large government deployment of software probably means "a few years of study, about a hundred consultants, and a bunch of custom COBOL and Java written by people who can't spell XOR and think that ROT13 is overkill."

The encryption algorithms you use are the least interesting piece of the puzzle: Just use something strong enough. It's the key management, data flow, storage and access security (both physical and via computer) that this kind of thing falls apart on.

You really need security all the way from the reader, which is (sort of) what chip-and-PIN is.

superuser2• 12 years ago

The security of credit card information isn't the consumer's problem, thanks to zero fraud liability policies. The worst that happens is you have to use your debit card for a few days while a new credit card comes in the mail.

It's typical of the HN ethos to want to take heroic steps to safeguard your personal data and to demand better of the people who handle it, but in the case of credit card numbers, it's really the industry's problem, not ours.

yukichan2• 12 years ago

I'm going to start paying cash everywhere. I already use cash at point of sale at regular stores, and I've limited my online exposure to Amazon, Netflix, Google and PayPal. Insecurity is sending me back into the 70's with financial technology.

I don't even want to use checks. I went to H&R block, tried to pay with a check to avoid giving my credit card details and they scanned the check's routing and bank number and stored that! Losing your bank info is more severe than credit card data because you have to close your account. Seriously bringing like a wad of cash next time I go to H&R block.

ianhawes2• 12 years ago

You're almost never liable for any fraudulent charges made on your credit card or debit card. Provided you notify your bank, the standard procedure is to issue you a new card and reverse the charges. While it's not convenient, I'd gladly trade the convenience of paying with plastic over cash.

Additionally, any situation where you COULD pay in cash, you're not providing billing information to the merchant, so there's no risk of information compromise (aside from your name).

wdewind• 12 years ago

Not only that, if you're paying back your credit card every month you're getting some kind of points/rewards thing which definitely covers the risk of inconvenience if your number is stolen.

lawnchair_larry2• 12 years ago

Why? The customer has no exposure from credit card theft. You're making your life difficult over a non-issue.

Varcht3• 12 years ago

Somehow somebody got enough information to attempt to open a line of credit in my name. Thankfully it was declined for some reason even though I ha e a good credit score but I am left with a refusal on my report. Still working on getting that cleaned up. Not sure how it was done but having a credit card in my name could be a good step in phishing.

yukichan2• 12 years ago

It's not a non-issue. I've been a victim of identity theft 3 times already.

DocG2• 12 years ago

You can research, maybe you have similar possibilities.

My bank allows me to register virtual "credit" card. It lasts 30 days(I can close it earlier also), I can have custom limit and making it takes around 2 minutes online. It costs i guess around 50cents per card. So by the time the card details leak from online shop, card is already useless.

re_todd• 12 years ago

As for Amazon, I've been paying cash for the Amazon gift cards at the local grocery store. For other sites, I'm using GreenDot, a debit card that can be used online like a credit card. I can keep a low balance on it so if it ever gets compromised I won't be out very much. However, the over $5 a month charge is a pain and I'm looking for something similar but cheaper.

drdeadringer• 12 years ago

I'm going to start paying cash everywhere.

And people wonder why the cashless society is five years away and always will be.

eliteraspberrie• 12 years ago

This is the new model for non-petty theft. Rather than target individual credit card holders, just target the watering holes -- which, like credit cards themselves (in the US) have near zero security.

sigkill• 12 years ago

To be fair, technology makes it easy to firehose-vacuum data for both the government and civilians if you know how to wield that power. The government needs to supply a letter stating that they're 'quartering troops' in your datacenters in an abstract manner (bureaucratic exploit) while the normal user learns the intricacies of the system and uses that (technological exploit). It so happens that fixing bureaucratic 0days are harder than fixing tech. 0days.

DocG2• 12 years ago

After I have seen how irresponsibly companys handle these situations, I wonder is it possible to sue them if there is a damage done. Same if someone has identity theft. Can the information "leaker" be taken accountable for such thing? Is there a precedent on this?

ljd2• 12 years ago

I used to work on a credit card processing system for a large ecommerce company where my code and I were audited on an annual basis.

The fear was always, if there were a breach on our several hundred thousand credit card database it would be trivial to find out that it came from us and it would be VISA that would start litigation against us.

I'm lucky enough to never have had a credit card system that I wrote broken into so I couldn't tell you first hand.

If anyone wants to know how to make a secure credit card system, it's pretty simple:

1. Don't be creative - there are plenty of rock solid boring implementations that will encrypt your cards.

2. Don't get fancy with encryption or key storage and use strong encryption and a salt and you'll be fine.

3. Limit physical and administrative access to the servers to as few humans as possible.

4. Let the only code that decrypts the cards be the code that is literally right before your call to the gateway.

5. Tokenize your cards, even if it's for an internal project where you think everyone can be trusted.

EDIT: As a note, just follow PCI[0] to the letter and you'll end up pretty safe.

[0]https://www.pcisecuritystandards.org/documents/pci_dss_v2.pd...

jimktrains29• 12 years ago

The better option, for most places, is to use some form of tokenization where your CC processor stores the CC numbers and hands you an opaque token to store.

Much less to worry about on your end as the tokens have no meaning outside the tokenization service.

Also, just to reïterate the point: When it comes to security, and you're not a crypto or security person, don't be creative and don't be fancy. Use what works.

lvs2• 12 years ago

I think we're going to have to face the music soon: credit cards are a broken transaction mechanism. They have a basic security model that's decades old, with only a few patches over time. The truth is that a credit card has no inherent security once you know a few essentially public things about it.

Insert cryptocurrency endorsement here -- or at least something else, because the current tech has hit a wall.

ljd2• 12 years ago

Chip & Pin [0] as well online authentication challenges such as 3-D Secure [1] have already solved these issues but the United States has been slow to picking them up.

[0] http://en.wikipedia.org/wiki/Chip_and_PIN [1] http://en.wikipedia.org/wiki/3-D_Secure

lvs2• 12 years ago

It seems like yet another bandage on the current model, no?

http://en.wikipedia.org/wiki/EMV#Vulnerabilities

jpollock• 12 years ago

Chip and Pin has already been attacked successfully.

https://www.cl.cam.ac.uk/research/security/banking/relay/

2bluesc• 12 years ago

I'm a fan of crypto currency, but the current solutions don't quite solve this problem -- yet. I'm enthusiastic about what start-ups in the space will bring to the table to fix problems like this.

tlb• 12 years ago

What do you think is needed for Bitcoin to solve the problem? Is it just wider adoption, or are there technical features missing?

jimktrains29• 12 years ago

The current solutions (such as Chip-and-Pin and 3D-secure) do solve the problem. The problem is noöne uses them.

ketralnis3• 12 years ago

I don't have a strong cryptocurrency opinion, but "we should have a better way to move money" vs. "we should have a totally different money system that's different in every way" is throwing the baby out with the bathwater.

We can have "better credit cards". Most countries do.

Bitcoin at present has a massive theft rate. Clearly it alone doesn't solve that problem at all.

stcredzero4• 12 years ago

The bitcoin protocol isn't in question. It's the exchanges and the security of user computers that is the problem. Likewise, one could say that it's security of these institutions and user computer security that's the problem with credit cards.

jervisfm• 12 years ago

Agreed. But in the mean time, I encourage everyone to inquire if their bank supports virtual Credit Cards. Sometimes they do but may not widely advertise it.

Using virtual cards provides you a fine level of control over various features of the credit card and also protects your real credit card number. One can set up time limits (expiry date), set a monetary limit or make it a one time use card.

Virtual credit cards are also useful for dealing with service providers who make it hard to cancel their subscriptions (e.g. you have to call in and talk to a person to unsubscribe). With virtual credit cards, one can sign up freely and not have to worry about being continuously surreptitiously charged each month. Once the card expires or the transaction limit is exceeded, the service provider will be forced to close/suspend the account on their own.

bashinator• 12 years ago

Wouldn't that last example lead some (many?) service providers to send your account to a collections agency and hurt your credit rating?

ojii• 12 years ago

I always wish we had some sort of standardized way to do Oauth-style payment via e-banking. As in, I go to onlinevendor.com and click "pay", it redirects me to my bank, I log in and accept the charge, it directly charges my bank account.

Online payment is the only reason I have a (pre-paid) credit card, but it really doesn't need a credit card. I don't want/need "credit" and since it's online a "card" is useless. We already have e-banking for many things, why can't I use this for payment?

kalleboo4• 12 years ago

As in, I go to onlinevendor.com and click "pay", it redirects me to my bank, I log in and accept the charge, it directly charges my bank account

This is quite common in Sweden at least. It's called "direct payment" and works with the 3 biggest banks. The rules around disputes and chargebacks are muddier though. Debit/credit cards also have 3DSecure for password authentication.

edit: also, debit cards work 100% for online payment, there's no reason to apply for credit

gluczywo• 12 years ago

Insert cryptocurrency endorsement here

Not likely to happen soon:

"The system is not sustainable but it may take decades until it collapses. Having multi billion budget credit card companies can shape legislation to stifle innovation that could reduce amount of fraud. Banks have no incentive to fix the system. The more fraud exists, the more obscure and complex services they can offer and the more effectively can justify their existence and demand higher fees."

http://www.securitykiss.com/resources/roboblog/credit_cards/...

kevinpet• 12 years ago

Not surprising considering the geniuses at the CA DMV think that "Who did you vote for in the last presidential election?" is a good security question.

I write about six checks a year. Two of them are auto registration because their site is so horribly broken when it could be so amazingly easy. These people are able to send me a piece of paper in the mail with an access code. It should take 30 seconds to pay my registration online.

existencebox• 12 years ago

Not that I have any particularly related thoughts, but my most recent interaction with a DMV was them refusing my birth certificate as a valid form of ID because "It's printed on paper" and "what's a notary." (It was a formally notarized copy, which AFAIK is the only way to get a copy from records, you can no longer get an original if you've lost it; and this was the DMV MANAGER I was speaking to.)

The entire DMV system has been so backwards I don't even know where I would start addressing it.

reustle• 12 years ago

Ever since I started using Simple, I haven't worried too much about my card info getting stolen and used without me realizing. I instantly get a push notification whenever my card is charged, so I am mentally confirming every time I spend.

ketralnis3• 12 years ago

Knowing that it happened isn't the same as having a system that's resistant to it happening

stcredzero4• 12 years ago

In some cases, it's the only viable option.

ianhawes2• 12 years ago

Not that I don't like what Simple is doing, but American Express, Bank of America, Wells Fargo, etc.. all have the capability to receive an email when your card is charged either by swipe or electronically.

prostoalex• 12 years ago

What happens when you travel abroad and have no data plan there?

Credit Card Breach at California DMV

Related Stories