12 ms·

I propose that a few fake credit card numbers and names be issued to different companies and that they place them in their records. If there is a breach, findin

I propose that a few fake credit card numbers and names be issued to different companies and that they place them in their records. If there is a breach, finding those fakes will identify where the breach came from. Each set of fakes would only be given to a specific company. This is similar to how dictionaries (before the internet) would post fake entries to discover if competitors were copying them. Or how (some claim) map makers would plant fake places to identify similar copying. In the credit card case though, it wouldn't harm innocent users who may mistakenly think the fake is real.

robotcookies 11y ago
And to add, the credit card companies would know about the fakes so as soon as someone tried using it, we'd know about the breach and where it came from. All without having LE trying to buy the information from criminals.
Someone1234 11y ago
That wouldn't work. Your assumption is that these retail companies are storing full credit card information in some large database somewhere, that is not the case at all. Most large retailers only store the full credit card information for seconds while they process the transaction, when the transaction is complete it is discarded. What the criminals are targeting is the card terminals themselves. Meaning when you swipe your card, as the transaction is being conducted they take a copy of the information and re-transmit it to a host somewhere they control (or to a C&C machine on that network, which they then exfiltrate somehow). Plus even if you could get your "gotcha" credit cards into the criminal's hands, the chance of law enforcement buying one back is tiny, since the stolen batch is mixed with other cards, and only then a small sub-set is sold (since they verify if the card is still active, and meets other conditions). My point is, it just won't work with the situation we're dealing with today. Chip & Pin may help reduce retail card theft as it is harder to reproduce a physical card to later use, and internet transactions should require the CSC which a brick and mortar store won't record (even momentarily).
- vcarl 11y ago
  Swiper skimming might be an issue as well, but didn't some of the largest breaches include stored credit card data? Washington Post says credit and debit card information was included in the Target breach. https://www.washingtonpost.com/business/economy/target-says-70-million-customers-were-hit-by-dec-data-breach-more-than-first-reported/2014/01/10/0ada1026-79fe-11e3-8963-b4b654bcc9b2_story.html https://www.washingtonpost.com/business/economy/target-says-...
  - Someone1234 11y ago
    I said nothing about swiper skimming. What I said was: > What the criminals are targeting is the card terminals themselves. Meaning when you swipe your card, as the transaction is being conducted they take a copy of the information and re-transmit it to a host somewhere they control (or to a C&C machine on that network, which they then exfiltrate somehow). Which is accurate: > The apparent credit and debit card breach uncovered last week at Home Depot was aided in part by a new variant of the malicious software program that stole card account data from cash registers at Target last December, according to sources close to the investigation. So malware was intercepting the raw CC information inside the card terminal on its way to the payment processor upstream. This allowed them to remotely infect every single Target store in the country, and steal information without setting foot there. http://krebsonsecurity.com/2014/09/home-depot-hit-by-same-malware-as-target/ http://krebsonsecurity.com/2014/09/home-depot-hit-by-same-ma...
    - vcarl 11y ago
      Ah, the distinction being that it wasn't stolen in a single bulk breach or via a device placed between the card and the scanner. Fair enough.
      - jlgaddis 11y ago
        Yep, lots of these point-of-sale machines are (still!) running XP Embedded which is, AIUI, pretty heavily targeted. Apparently -- but not surprisingly -- they aren't updated all that much so they're pretty susceptible to being compromised.
bkruse 11y ago
Bloomberg does this with data sales. They'll sell you particular financial information, like tick-by-tick for the Russell 2000 over the last 5 years. They embed unique hidden markers or fake trades with everyone they sell them to. They then go and acquire data from other "providers", and find the leak.
- brokentone 11y ago
  Would fake trades not be distorting the data you are purchasing from them?
  - bkruse 11y ago
    From what I understand, they used to change volume slightly which they claim wouldn't negatively impact algorithms looking at historical data. Then, however, people were using volume weighted average pricing (VWAP), which would eliminate that change. This is just theory now, but I believe they just add double trades, instead of fake trades are certain prices.
- alasdair_ 11y ago
  Can't people just make two independent purchases of the data and diff them to find the issues?
nikcub 11y ago
You'd need to buy too many cards to find them by number, tho the combination of issuing bank, IBAN, card type, expiry date and [post|zip]code would likely provide enough bits to identify a source. The shops would combat this by narrowing the information available about a card pre-purchase. Here is what a record looks like on Rescator (a popular autoshop for credit cards) pre-purchase: http://i.imgur.com/eeEThdr.png http://i.imgur.com/eeEThdr.png
mkertajaya 11y ago
Not directly related, but this reminds me about the story of paper town in map making. Check this TED's talk: http://www.ted.com/talks/john_green_the_nerd_s_guide_to_learning_everything_online http://www.ted.com/talks/john_green_the_nerd_s_guide_to_lear...

robotcookies 11y ago

And to add, the credit card companies would know about the fakes so as soon as someone tried using it, we'd know about the breach and where it came from. All without having LE trying to buy the information from criminals.

Someone1234 11y ago

That wouldn't work. Your assumption is that these retail companies are storing full credit card information in some large database somewhere, that is not the case at all. Most large retailers only store the full credit card information for seconds while they process the transaction, when the transaction is complete it is discarded. What the criminals are targeting is the card terminals themselves. Meaning when you swipe your card, as the transaction is being conducted they take a copy of the information and re-transmit it to a host somewhere they control (or to a C&C machine on that network, which they then exfiltrate somehow). Plus even if you could get your "gotcha" credit cards into the criminal's hands, the chance of law enforcement buying one back is tiny, since the stolen batch is mixed with other cards, and only then a small sub-set is sold (since they verify if the card is still active, and meets other conditions). My point is, it just won't work with the situation we're dealing with today. Chip & Pin may help reduce retail card theft as it is harder to reproduce a physical card to later use, and internet transactions should require the CSC which a brick and mortar store won't record (even momentarily).

vcarl 11y ago
Swiper skimming might be an issue as well, but didn't some of the largest breaches include stored credit card data? Washington Post says credit and debit card information was included in the Target breach. https://www.washingtonpost.com/business/economy/target-says-70-million-customers-were-hit-by-dec-data-breach-more-than-first-reported/2014/01/10/0ada1026-79fe-11e3-8963-b4b654bcc9b2_story.html https://www.washingtonpost.com/business/economy/target-says-...
- Someone1234 11y ago
  I said nothing about swiper skimming. What I said was: > What the criminals are targeting is the card terminals themselves. Meaning when you swipe your card, as the transaction is being conducted they take a copy of the information and re-transmit it to a host somewhere they control (or to a C&C machine on that network, which they then exfiltrate somehow). Which is accurate: > The apparent credit and debit card breach uncovered last week at Home Depot was aided in part by a new variant of the malicious software program that stole card account data from cash registers at Target last December, according to sources close to the investigation. So malware was intercepting the raw CC information inside the card terminal on its way to the payment processor upstream. This allowed them to remotely infect every single Target store in the country, and steal information without setting foot there. http://krebsonsecurity.com/2014/09/home-depot-hit-by-same-malware-as-target/ http://krebsonsecurity.com/2014/09/home-depot-hit-by-same-ma...
  - vcarl 11y ago
    Ah, the distinction being that it wasn't stolen in a single bulk breach or via a device placed between the card and the scanner. Fair enough.
    - jlgaddis 11y ago
      Yep, lots of these point-of-sale machines are (still!) running XP Embedded which is, AIUI, pretty heavily targeted. Apparently -- but not surprisingly -- they aren't updated all that much so they're pretty susceptible to being compromised.

bkruse 11y ago

Bloomberg does this with data sales. They'll sell you particular financial information, like tick-by-tick for the Russell 2000 over the last 5 years. They embed unique hidden markers or fake trades with everyone they sell them to. They then go and acquire data from other "providers", and find the leak.

brokentone 11y ago
Would fake trades not be distorting the data you are purchasing from them?
- bkruse 11y ago
  From what I understand, they used to change volume slightly which they claim wouldn't negatively impact algorithms looking at historical data. Then, however, people were using volume weighted average pricing (VWAP), which would eliminate that change. This is just theory now, but I believe they just add double trades, instead of fake trades are certain prices.
alasdair_ 11y ago
Can't people just make two independent purchases of the data and diff them to find the issues?

nikcub 11y ago

You'd need to buy too many cards to find them by number, tho the combination of issuing bank, IBAN, card type, expiry date and [post|zip]code would likely provide enough bits to identify a source. The shops would combat this by narrowing the information available about a card pre-purchase. Here is what a record looks like on Rescator (a popular autoshop for credit cards) pre-purchase: http://i.imgur.com/eeEThdr.png http://i.imgur.com/eeEThdr.png

mkertajaya 11y ago

Not directly related, but this reminds me about the story of paper town in map making. Check this TED's talk: http://www.ted.com/talks/john_green_the_nerd_s_guide_to_learning_everything_online http://www.ted.com/talks/john_green_the_nerd_s_guide_to_lear...