12 ms·

VeriFone Takes The Gloves Off, Accuses Square Of Serious Security Hole

43 points by thankuz 16y ago

avree 16y ago
This 'open letter' has a ring of dishonesty to it. > Clearly, Square is a threat to VeriFone, so it’s intentions aren’t so pure when exposing this potential issue. That much is obvious. The letter is geared towards 'protecting the consumer', but makes the skimming method extremely public (especially with sq-skim.com) I'm sure this will result in an increase in credit card theft incidents. I'm also curious as to whether or not the perceived security threat is a bit overblown—there are many opportunities for my credit card number to be stolen (either when I use it online, or for physical transactions.) There's always a risk, and as such, I generally don't go passing my credit card (or scanning my credit card) to vendors I don't trust. I assume that since you'd need to be physically present to give the card to be skimmed, you'd draw on other internal factors of trust (and not have much of a higher potential for card theft than at any other establishment.)
- thenayr 16y ago
  No kidding. >"In less than an hour, any reasonably skilled programmer can write an application that will "skim" – or steal – a consumer's financial and personal information right off the card utilizing an easily obtained Square card reader." Oh, but wait, we already DID IT FOR YOU. VeriFone, protecting consumers by posting hacked apps to skim credit card numbers.
  - paulgerhardt 16y ago
    Were you able to find actually find the app? It seems they (wisely) never posted it. >Don’t take our word for it. See for yourself at www.sq-skim.com where you can download the sample skimming application and view a video of this type of fraud in action. Commenting on the YouTube video has also been disabled. I feel like there is some sort of parable about glass houses here...
    - yrral 16y ago
      http://www.mediafire.com/?zxtbagfkz7e64ja http://www.mediafire.com/?zxtbagfkz7e64ja Here is the zip of the IPA and provision file.
      - superchink 16y ago
        Any idea how it works?
      - sdrguy 16y ago
        Yrral, Thank you!! Is this for the iPhone or for the Android phone? And do you know how it works?
drivebyacct2 16y ago
The comments are spot on on the TC article. Does TC really not think about these things before publishing? If you give me your credit card, I can steal your CC info regardless of whether or not I use a card reader, a camera or a pen/paper. This is just sad.
jedsmith 16y ago
The comments on the story, and the first round here, make me worry that people are missing the point. Particularly this one: > VeriFone's point (albeit a stupid one) is that the path from the card reader itself to the iOS device is not secure, so it's a hardware "problem." That point isn't stupid at all, and is actually a legitimate gripe. It is my understanding that the Square device is only meant to be used with the Square payment software. Is that wrong? If that's the case, it shouldn't be as easy as VeriFone claims it is to skim a number from the device. I don't follow card skimming, but I would think that the point VeriFone is trying to make here is that Square is making it easier for low-tech criminals to implement a skimmer. While it is possible today, I've never heard it described as easy. Another of the commenters mentioned that professional card skimmers have their own devices. That's fine; that isn't the problem here. Professionals will always do things better than the entry-level criminals. However, from my reading, it sounds like there is the capability here to write a shrink-wrapped iOS app that talks to the free Square reader, and you have skimming for a total investment of an iPod touch (or lack of investment -- you are a criminal, after all). Which is the problem that VeriFone is bringing up, and I halfway agree with given the limited evidence presented to me. We're way too lax with credit cards. Does the Square app really need to know the card number at all, aside from transmitting it upstream? What is the vector here? It seems like the Square device should be a black box that yields only some kind of payment token, and the app only gets the cardholder name (from their screenshots). Square's own security page[1] makes this ambiguous, too: > Card numbers, magnetic stripe data, or security codes are not stored on Square client devices. I've never used Square, so I might be full of hot air. However, I think instantly painting this as not an issue simply because it came from a competitor is doing a disservice to the potential (real) vulnerability here. Read the information, not the source... [1]: https://squareup.com/security https://squareup.com/security
- mbreese 16y ago
  I've never used the Square device either, but I don't see this as a hardware "problem". This is no different (to me) than a USB card reader that operates as a keyboard. You could scan the card into the vendor software, or into Notepad. Either way, it isn't a hardware flaw.
mbreese 16y ago
I take it that VeriFone has never heard of a magnetic card reader that plugs into a keyboard port? This is a very shaky "security hole", if you ask me. When you hand over your card to someone, there is always a risk for them skimming the number. However, they kind of have to know the number in order to get paid... so how is this a security risk that is exclusive to Square again?
pieter 16y ago
It seems their problem with Square is that it allows you to get the credit card number in plaintext if you use their hardware. Of course, this is nothing new: you can buy a cardreader that acts as a USB keyboard for $20 and use that to read a credit card and output it in TextMate. Square's hardware really has nothing to do with it: if Squary would use something else, you'd still be able to buy one of those reader thingies for $5 from DealExtreme or some other site, and use the same procedure to skim a credit card. One thing Square could do would be to, say, encrypt the credit card info with a public key, then pass that data on to the app. The app could upload the data to Square, where it could be decrypted and verified. Of course, this wouldn't fit in a $2 reader, and there really isn't a point to do this as long as there are other readers out there that allow you to read the data in plain text.
- jedsmith 16y ago
  > and there really isn't a point to do this as long as there are other readers out there that allow you to read the data in plain text. This is the rub. If we had that attitude to everything in computing, the world would be a much worse place. Think about what you're saying, and grant me a paraphrasing: devices exist to circumvent traditional card security, so implementing card security is unnecessary. How exactly do you get from A to B, there? Software exists to root iOS; does that mean Apple should give up and stop trying to defend their platform's security? I strongly disagree with any strategy that says "well, the vector's already been exploited, so why bother doing anything about it in our product? It's cheaper if we don't!"
  - pieter 16y ago
    No, the fix is really easy: you drop the magnetic strip and only use chipped credit card (or similar). And this is what all the CC have been moving to already.
    - jedsmith 16y ago
      I agree, but good luck getting every mom-and-pop merchant in the entire world to redo their POS. Moving is going to take a long time.
thinkcomp 16y ago
I'm kind of surprised Square didn't include some kind of hardware encryption, but then again, it would probably make the readers a lot more expensive to manufacture. One of the amazing things about plastic cards is that they were never designed in the 1960s with security or the internet in mind. The card itself (with its Primary Account Number) is an inherently insecure medium. PCI DSS tries to make up for this by layering rule after rule on how you can treat PAN data, but as most professionals in the space know, a system is only as secure as its weakest link. There's really nothing PCI or any other standard can do. By focusing on cards, Square has opened itself up to all of the problems associated with them. Starting from scratch is the best way, and pretty much the only way, to create a secure payment network in today's environment.
- radicaldreamer 16y ago
  Hopefully with the next gen of NFC devices, this is what we'll get.
modeless 16y ago
I've just discovered another serious security hole! When you hand your credit card to a waiter, they can see the credit card number totally unencrypted with their eyes! Clearly the solution is to blind all waiters. The truth is credit card "security" is a bad joke. The only real defense these days is the fact that every payment processor has extremely sensitive fraudulent transaction detection systems because of the consumer protection laws that put fraud liability on the card issuer instead of the consumer. The whole system is a relic from the days before the internet and the only way to fix it is to replace it with something better like NFC.
- Bud 16y ago
  This is the only relevant comment in this entire thread. What's more, the 3-digit "security" code (pardon me, whilst I scoff) for these cards is printed on the card! If you hand someone your card, you're already saying that you trust them not to keep your card number and security code and submit false charges. The Square reader isn't making that process any harder or easier; it's totally irrelevant.
- lisper 16y ago
  > fraud liability on the card issuer instead of the consumer The law may have put it on the issuer, but the issuers just fob it off on the merchants. > The truth is credit card "security" is a bad joke. Word. [EDIT:] Some additional thoughts: http://news.ycombinator.com/item?id=2305899l http://news.ycombinator.com/item?id=2305899l
- danielrhodes 16y ago
  This is a good point. The real security flaw is in the credit card itself, not the device reading it.
- amalcon 16y ago
  The last part is the really sad thing. We have the technology to do it right now, but because credit cards are everywhere and better stuff isn't, there's no motion toward improvement. The fundamental problem is that the credit card system works by requiring the customer to provide the merchant with all of the credentials necessary to make a transaction. We could have inexpensive devices that receive payment details, display them on cheap LCDs, and digitally sign them if the user confirms. Such a device would be about as complex as a pocket calculator, and as secure as any application of digital signatures. Nobody is moving on them because of the chicken/egg problem.
joshu 16y ago
First they ignore you, then they ridicule you, then they fight you, then you win. (I am a square investor.)
adolph 16y ago
Can I download VeriFone's pseudo-Square app from the App Store? I don't see an iTunes link on their website.
archgrove 16y ago
I guess they didn't notice that all smart phones have this ability as standard, and call it "Camera". One quick snap, and boom - I've stored your CC number. No need for fancy hardware!
dclaysmith 16y ago
So is their a security flaw in the combination of the Square reader (hardware) and Square app (software)? That would be a problem and VeriFone wouldn't be in the wrong pointing it out. Or is VeriFone just saying that hardware Square manufactures can be used for skimming? If that's the case, the email is pretty ridiculous. Skimming technology is nothing new and like others have said, readily available.
Calamitous 16y ago
In case you've heard of a "corporate hit job" but never knew what one looked like; rest easy. It looks like this.
ig1 16y ago
It comes down to what Square are trying to do, if they want to be "another credit card reader device" then this isn't a security hole. On the other hand if they want to take the PayPal approach and build a secure payment brand which says "we're a securer way to pay because the end merchant never sees your credit card details", then it is a security hole, because it means you can't trust the Square brand to act as a layer between you and the merchant.
pitdesi 16y ago
There are two dangers here: 1. This actually does lead to a breach of card numbers, in which case Square will face penalties from Visa/MC/Amex - those penalties can be huge because they are calculated based upon the number of cards that were compromised (check out Heartland's breach last year). 2. Verifone is able to convince Visa/MC/Amex that Square is not PCI compliant and that they should fine Square out of existence (it's not a legal thing, it's at Visa/MC's discretion). #1 is somewhat likely, on Android moreso than Iphone, there have been android viruses before. #2 isn't that likely, unless there is actually a breach and it ends up costing Visa and Mastercard money, Square is strategic to Visa and Mastercard because it gives them access to an entirely new customer base (that Verifone hasn't had any luck with). 1. Customers don't give a shit. We hand our cards over into insecure situations all the time without thinking twice. 2. Businesses don't care either - they only care about PCI and security when either their acquirer (in this case Square, which won't do it) or Visa/MC start fining them or threaten to shut them down.
undrwd 16y ago
This attack really struck me the wrong way. I'll never, ever be a verifone customer. Verifone really went about attacking it's competitor the wrong way. In the video that demonstrates being able to read the card information with their own iOS app they mention a criminal glass blower buying a TV with your credit card after making a purchase with square. A glass blower, really, ummmmm let me think when is the last time I made a purchase from a glass blower? Is that a common interaction? I would have thought they would have chosen a common transaction. Street vendor, food stand, but no a glass blower. Very strange. If you follow startups you'll remember that Jim McKelvey developer of the square hardware in question is a . . . what does he do again . . . oh yeah a software engineer and glass blower. This appears to be a personal attack on Jim as well as on Square. I hope verifone enjoys a good laugh on putting a glass blower in their video. Hopefully verifone will be writing Mr. McKelvey a large check after the lawyers are through with this one. Very poor business practice whether or not I don't see the download for their skimming app have they taken the app down? Probably a good idea, I doubt the credit card companies will appreciate them providing a skimming app regardless of what reading hardware it's using. It appears their video has been removed from youtube.com for violating terms of service.
- nchaimov 16y ago
  > I don't see the download for their skimming app have they taken the app down? Probably a good idea, I doubt the credit card companies will appreciate them providing a skimming app regardless of what reading hardware it's using. I imagine that part of the problem was that they were distributing an iPhone app binary along with their in-house enterprise distribution provisioning certificate to the public, which I imagine Apple isn't happy about.
phwd 16y ago
Related [2007] http://www.cl.cam.ac.uk/research/security/banking/ped/verifone-response.pdf http://www.cl.cam.ac.uk/research/security/banking/ped/verifo... > We believe it is not in the best interest of the consumers, merchants and overall payment industry to publish the details of product designs describing potential attacks however remote those might be. Even if these attacks are difficult to be accomplished it gives the bad guys a leg up on research they would not have to do and encourages bad behavior. in response to : PIN Entry Device (PED) vulnerabilities http://www.cl.cam.ac.uk/research/security/banking/ped/ http://www.cl.cam.ac.uk/research/security/banking/ped/

43 points by thankuz 16y ago

avree 16y ago

This 'open letter' has a ring of dishonesty to it. > Clearly, Square is a threat to VeriFone, so it’s intentions aren’t so pure when exposing this potential issue. That much is obvious. The letter is geared towards 'protecting the consumer', but makes the skimming method extremely public (especially with sq-skim.com) I'm sure this will result in an increase in credit card theft incidents. I'm also curious as to whether or not the perceived security threat is a bit overblown—there are many opportunities for my credit card number to be stolen (either when I use it online, or for physical transactions.) There's always a risk, and as such, I generally don't go passing my credit card (or scanning my credit card) to vendors I don't trust. I assume that since you'd need to be physically present to give the card to be skimmed, you'd draw on other internal factors of trust (and not have much of a higher potential for card theft than at any other establishment.)

thenayr 16y ago
No kidding. >"In less than an hour, any reasonably skilled programmer can write an application that will "skim" – or steal – a consumer's financial and personal information right off the card utilizing an easily obtained Square card reader." Oh, but wait, we already DID IT FOR YOU. VeriFone, protecting consumers by posting hacked apps to skim credit card numbers.
- paulgerhardt 16y ago
  Were you able to find actually find the app? It seems they (wisely) never posted it. >Don’t take our word for it. See for yourself at www.sq-skim.com where you can download the sample skimming application and view a video of this type of fraud in action. Commenting on the YouTube video has also been disabled. I feel like there is some sort of parable about glass houses here...
  - yrral 16y ago
    http://www.mediafire.com/?zxtbagfkz7e64ja http://www.mediafire.com/?zxtbagfkz7e64ja Here is the zip of the IPA and provision file.
    - superchink 16y ago
      Any idea how it works?
    - sdrguy 16y ago
      Yrral, Thank you!! Is this for the iPhone or for the Android phone? And do you know how it works?

drivebyacct2 16y ago

The comments are spot on on the TC article. Does TC really not think about these things before publishing? If you give me your credit card, I can steal your CC info regardless of whether or not I use a card reader, a camera or a pen/paper. This is just sad.

jedsmith 16y ago

The comments on the story, and the first round here, make me worry that people are missing the point. Particularly this one: > VeriFone's point (albeit a stupid one) is that the path from the card reader itself to the iOS device is not secure, so it's a hardware "problem." That point isn't stupid at all, and is actually a legitimate gripe. It is my understanding that the Square device is only meant to be used with the Square payment software. Is that wrong? If that's the case, it shouldn't be as easy as VeriFone claims it is to skim a number from the device. I don't follow card skimming, but I would think that the point VeriFone is trying to make here is that Square is making it easier for low-tech criminals to implement a skimmer. While it is possible today, I've never heard it described as easy. Another of the commenters mentioned that professional card skimmers have their own devices. That's fine; that isn't the problem here. Professionals will always do things better than the entry-level criminals. However, from my reading, it sounds like there is the capability here to write a shrink-wrapped iOS app that talks to the free Square reader, and you have skimming for a total investment of an iPod touch (or lack of investment -- you are a criminal, after all). Which is the problem that VeriFone is bringing up, and I halfway agree with given the limited evidence presented to me. We're way too lax with credit cards. Does the Square app really need to know the card number at all, aside from transmitting it upstream? What is the vector here? It seems like the Square device should be a black box that yields only some kind of payment token, and the app only gets the cardholder name (from their screenshots). Square's own security page[1] makes this ambiguous, too: > Card numbers, magnetic stripe data, or security codes are not stored on Square client devices. I've never used Square, so I might be full of hot air. However, I think instantly painting this as not an issue simply because it came from a competitor is doing a disservice to the potential (real) vulnerability here. Read the information, not the source... [1]: https://squareup.com/security https://squareup.com/security

mbreese 16y ago
I've never used the Square device either, but I don't see this as a hardware "problem". This is no different (to me) than a USB card reader that operates as a keyboard. You could scan the card into the vendor software, or into Notepad. Either way, it isn't a hardware flaw.

mbreese 16y ago

I take it that VeriFone has never heard of a magnetic card reader that plugs into a keyboard port? This is a very shaky "security hole", if you ask me. When you hand over your card to someone, there is always a risk for them skimming the number. However, they kind of have to know the number in order to get paid... so how is this a security risk that is exclusive to Square again?

pieter 16y ago

It seems their problem with Square is that it allows you to get the credit card number in plaintext if you use their hardware. Of course, this is nothing new: you can buy a cardreader that acts as a USB keyboard for $20 and use that to read a credit card and output it in TextMate. Square's hardware really has nothing to do with it: if Squary would use something else, you'd still be able to buy one of those reader thingies for $5 from DealExtreme or some other site, and use the same procedure to skim a credit card. One thing Square could do would be to, say, encrypt the credit card info with a public key, then pass that data on to the app. The app could upload the data to Square, where it could be decrypted and verified. Of course, this wouldn't fit in a $2 reader, and there really isn't a point to do this as long as there are other readers out there that allow you to read the data in plain text.

jedsmith 16y ago
> and there really isn't a point to do this as long as there are other readers out there that allow you to read the data in plain text. This is the rub. If we had that attitude to everything in computing, the world would be a much worse place. Think about what you're saying, and grant me a paraphrasing: devices exist to circumvent traditional card security, so implementing card security is unnecessary. How exactly do you get from A to B, there? Software exists to root iOS; does that mean Apple should give up and stop trying to defend their platform's security? I strongly disagree with any strategy that says "well, the vector's already been exploited, so why bother doing anything about it in our product? It's cheaper if we don't!"
- pieter 16y ago
  No, the fix is really easy: you drop the magnetic strip and only use chipped credit card (or similar). And this is what all the CC have been moving to already.
  - jedsmith 16y ago
    I agree, but good luck getting every mom-and-pop merchant in the entire world to redo their POS. Moving is going to take a long time.

thinkcomp 16y ago

I'm kind of surprised Square didn't include some kind of hardware encryption, but then again, it would probably make the readers a lot more expensive to manufacture. One of the amazing things about plastic cards is that they were never designed in the 1960s with security or the internet in mind. The card itself (with its Primary Account Number) is an inherently insecure medium. PCI DSS tries to make up for this by layering rule after rule on how you can treat PAN data, but as most professionals in the space know, a system is only as secure as its weakest link. There's really nothing PCI or any other standard can do. By focusing on cards, Square has opened itself up to all of the problems associated with them. Starting from scratch is the best way, and pretty much the only way, to create a secure payment network in today's environment.

radicaldreamer 16y ago
Hopefully with the next gen of NFC devices, this is what we'll get.

modeless 16y ago

I've just discovered another serious security hole! When you hand your credit card to a waiter, they can see the credit card number totally unencrypted with their eyes! Clearly the solution is to blind all waiters. The truth is credit card "security" is a bad joke. The only real defense these days is the fact that every payment processor has extremely sensitive fraudulent transaction detection systems because of the consumer protection laws that put fraud liability on the card issuer instead of the consumer. The whole system is a relic from the days before the internet and the only way to fix it is to replace it with something better like NFC.

Bud 16y ago
This is the only relevant comment in this entire thread. What's more, the 3-digit "security" code (pardon me, whilst I scoff) for these cards is printed on the card! If you hand someone your card, you're already saying that you trust them not to keep your card number and security code and submit false charges. The Square reader isn't making that process any harder or easier; it's totally irrelevant.
lisper 16y ago
> fraud liability on the card issuer instead of the consumer The law may have put it on the issuer, but the issuers just fob it off on the merchants. > The truth is credit card "security" is a bad joke. Word. [EDIT:] Some additional thoughts: http://news.ycombinator.com/item?id=2305899l http://news.ycombinator.com/item?id=2305899l
danielrhodes 16y ago
This is a good point. The real security flaw is in the credit card itself, not the device reading it.
amalcon 16y ago
The last part is the really sad thing. We have the technology to do it right now, but because credit cards are everywhere and better stuff isn't, there's no motion toward improvement. The fundamental problem is that the credit card system works by requiring the customer to provide the merchant with all of the credentials necessary to make a transaction. We could have inexpensive devices that receive payment details, display them on cheap LCDs, and digitally sign them if the user confirms. Such a device would be about as complex as a pocket calculator, and as secure as any application of digital signatures. Nobody is moving on them because of the chicken/egg problem.

joshu 16y ago

First they ignore you, then they ridicule you, then they fight you, then you win. (I am a square investor.)

adolph 16y ago

Can I download VeriFone's pseudo-Square app from the App Store? I don't see an iTunes link on their website.

archgrove 16y ago

I guess they didn't notice that all smart phones have this ability as standard, and call it "Camera". One quick snap, and boom - I've stored your CC number. No need for fancy hardware!

dclaysmith 16y ago

So is their a security flaw in the combination of the Square reader (hardware) and Square app (software)? That would be a problem and VeriFone wouldn't be in the wrong pointing it out. Or is VeriFone just saying that hardware Square manufactures can be used for skimming? If that's the case, the email is pretty ridiculous. Skimming technology is nothing new and like others have said, readily available.

Calamitous 16y ago

In case you've heard of a "corporate hit job" but never knew what one looked like; rest easy. It looks like this.

ig1 16y ago

It comes down to what Square are trying to do, if they want to be "another credit card reader device" then this isn't a security hole. On the other hand if they want to take the PayPal approach and build a secure payment brand which says "we're a securer way to pay because the end merchant never sees your credit card details", then it is a security hole, because it means you can't trust the Square brand to act as a layer between you and the merchant.

pitdesi 16y ago

There are two dangers here: 1. This actually does lead to a breach of card numbers, in which case Square will face penalties from Visa/MC/Amex - those penalties can be huge because they are calculated based upon the number of cards that were compromised (check out Heartland's breach last year). 2. Verifone is able to convince Visa/MC/Amex that Square is not PCI compliant and that they should fine Square out of existence (it's not a legal thing, it's at Visa/MC's discretion). #1 is somewhat likely, on Android moreso than Iphone, there have been android viruses before. #2 isn't that likely, unless there is actually a breach and it ends up costing Visa and Mastercard money, Square is strategic to Visa and Mastercard because it gives them access to an entirely new customer base (that Verifone hasn't had any luck with). 1. Customers don't give a shit. We hand our cards over into insecure situations all the time without thinking twice. 2. Businesses don't care either - they only care about PCI and security when either their acquirer (in this case Square, which won't do it) or Visa/MC start fining them or threaten to shut them down.

undrwd 16y ago

This attack really struck me the wrong way. I'll never, ever be a verifone customer. Verifone really went about attacking it's competitor the wrong way. In the video that demonstrates being able to read the card information with their own iOS app they mention a criminal glass blower buying a TV with your credit card after making a purchase with square. A glass blower, really, ummmmm let me think when is the last time I made a purchase from a glass blower? Is that a common interaction? I would have thought they would have chosen a common transaction. Street vendor, food stand, but no a glass blower. Very strange. If you follow startups you'll remember that Jim McKelvey developer of the square hardware in question is a . . . what does he do again . . . oh yeah a software engineer and glass blower. This appears to be a personal attack on Jim as well as on Square. I hope verifone enjoys a good laugh on putting a glass blower in their video. Hopefully verifone will be writing Mr. McKelvey a large check after the lawyers are through with this one. Very poor business practice whether or not I don't see the download for their skimming app have they taken the app down? Probably a good idea, I doubt the credit card companies will appreciate them providing a skimming app regardless of what reading hardware it's using. It appears their video has been removed from youtube.com for violating terms of service.

nchaimov 16y ago
> I don't see the download for their skimming app have they taken the app down? Probably a good idea, I doubt the credit card companies will appreciate them providing a skimming app regardless of what reading hardware it's using. I imagine that part of the problem was that they were distributing an iPhone app binary along with their in-house enterprise distribution provisioning certificate to the public, which I imagine Apple isn't happy about.

phwd 16y ago

Related [2007] http://www.cl.cam.ac.uk/research/security/banking/ped/verifone-response.pdf http://www.cl.cam.ac.uk/research/security/banking/ped/verifo... > We believe it is not in the best interest of the consumers, merchants and overall payment industry to publish the details of product designs describing potential attacks however remote those might be. Even if these attacks are difficult to be accomplished it gives the bad guys a leg up on research they would not have to do and encourages bad behavior. in response to : PIN Entry Device (PED) vulnerabilities http://www.cl.cam.ac.uk/research/security/banking/ped/ http://www.cl.cam.ac.uk/research/security/banking/ped/