2 ms·

Thomas, You're sorta not understanding what goes on in a verifone device. I would advise actually constructing and inserting a rogue verifone PED, it is non-tr

by not_me 16y ago

Thomas, You're sorta not understanding what goes on in a verifone device. I would advise actually constructing and inserting a rogue verifone PED, it is non-trivial. First, understand that when you swipe your card at mcdonalds, you're not trusting the guy behind the counter, the manager, the district or anyone else physically present or even mcdonalds. you're not trusting their malware laiden office computers, nor their network, et cetera. You're trusting the terminal. And the terminals, depending on model and service/etc, all have cryptographic MAC addresses "that are burned in" (lol), and they're externally by verifone. So first hurdle is that you can't just get a job at mcdonalds and ebay your way to a better life, when you switch out the device, it gets detected and blocked, and i imagine once the burger flippers figure out that its not broken and someone tried to own them, they pull the cameras, et cetera. Next, the device has a myriad of tamper-detection qualities which make it non-trivial to get into and still have the damned thing still function. This is again, dependent on which device is in play and so on-- getting in successfully obviously can be done, but you're getting sorta specialized. Next, the card details/pin/etc all get encrypted at the device never to see plain-text again until it's "safely in the cloud". That's the theory anyways, there's some problems but it's not that joe bubblegum is gonna download an 'app' and extract my credit card details from his employers iphone. If pressed for an opinion, I'd say the entire idea of getting people used to paying by swiping their cards through some guys phone is maligned and going to be horribly problematic. This is sorta like SSL, there's another maligned trust heirarchy that exists and makes sense sorta. So, basically my point is, verifone is not entirely incorrect here. It's not that "a little white card skimmer dongle is trivial to construct" or any other hyperbole. A PED or other input device that I can dump my card info from is a problem. There's another entire trust relationship going on here which everyone seems to skip: the most common use-case of dealing with a representative of a third-party who is less trustworthy than the third-party itself ('Alice meet George, embassary of Bob, don't mind the collasped veins, he's legit!').

tptacek 16y ago
This is all interesting but it has nothing at all to do with the point I'm making. What I'm saying is, Square could come up with an encrypted obsfuscated reader-to-iPhone protocol that, like Skype, would take the better part of a year to fully reverse. Verifone would then say: "yeah, but how does anyone who looks at the reader know that it isn't a fake Square dongle that doesn't really run that protocol?" In that respect we are saying the same thing: the entire platform is, by Verifone's standards, unsuitable for accepting cards. But that's not what Verifone is actually saying. They picked a much more specific argument against Square. There are two reasons that makes sense for them: (1) because there will be another 57 similar arguments they can make if Square does something to mitigate that first concern, and (2) because if they made the intellectually honest argument ("It's not safe to accept cards with any iPhone app, Square's or otherwise") the competitive issue driving this complaint would be too transparent.
- not_me 16y ago
  I think you sorta misunderstood, and but also possibly hold some misguided beliefs (like i dont?). The first thing is, there's a lot of things Square could do, and we could both live on the moon eventually also. Their current implementation is a skimmer with all of the logic and safety in the software with all the guarantees of PCI network security beyond that (lol, i bet its salesforce or ec2). On Verifone's end, it's not like we're talking some software-based encraption. Think hardware based asset tags to compliment client certs. Surely it's self-evident that the ease of obtaining what at the moment at best could be a client certificate from a phone and recovering the information from a tamper-resistant device that goes dark if you take it offline too long (rendering the information useless). If they took their device and made it less like a mouse and more like something that tried to tunnel through the stupidest medium ever, I could live with it a little more and see the 'they are stupidly insecure' argument as fud. Second, you realize it took 1 person about a week to reverse, document and develop the PoC for blocking skype (me) and not much longer for a crypto-library from it (accuvant ryan)? A year is a vast over-estimate and im pretty slow at it. If the overall debate pertains to whether verifone did this right or not, I'd agree with you. Although, I have to admit cheering for them with their 'and we will prove it with an app@#@!' part-- if they were consultants they wouldve gotten invited to speak at blackhat. If I had to take a stab at it, after looking at square a little bit. I'd say that if they made the honest argument, Square would try to throw lawyers at them. The honest argument is, 'have you looked at these guys? they're bordering on a criminal-enterprise-by-design, albeit rubber stamped by PCI'. I mean seriously? a point and a half more if I don't have the card and want to enter it on your website instead? (Also the hubris in their research & disclosure policy made my blood boil)
  - tptacek 16y ago
    Anyone in the world can make a little white dongle that reads credit card magstripes. What is the point of making an ultra-secure white dongle? How would anybody know you're using the ultra-secure one?
- not_me 16y ago
  Also as an addendum; the thought process about hardware reversing is not entirely correct. You will run into things like can't build a device that can sniff that fast without a substantial budget; how much is that microscope? That just have no real parallel in software

by not_me 16y ago

tptacek 16y ago

This is all interesting but it has nothing at all to do with the point I'm making. What I'm saying is, Square could come up with an encrypted obsfuscated reader-to-iPhone protocol that, like Skype, would take the better part of a year to fully reverse. Verifone would then say: "yeah, but how does anyone who looks at the reader know that it isn't a fake Square dongle that doesn't really run that protocol?" In that respect we are saying the same thing: the entire platform is, by Verifone's standards, unsuitable for accepting cards. But that's not what Verifone is actually saying. They picked a much more specific argument against Square. There are two reasons that makes sense for them: (1) because there will be another 57 similar arguments they can make if Square does something to mitigate that first concern, and (2) because if they made the intellectually honest argument ("It's not safe to accept cards with any iPhone app, Square's or otherwise") the competitive issue driving this complaint would be too transparent.

not_me 16y ago
I think you sorta misunderstood, and but also possibly hold some misguided beliefs (like i dont?). The first thing is, there's a lot of things Square could do, and we could both live on the moon eventually also. Their current implementation is a skimmer with all of the logic and safety in the software with all the guarantees of PCI network security beyond that (lol, i bet its salesforce or ec2). On Verifone's end, it's not like we're talking some software-based encraption. Think hardware based asset tags to compliment client certs. Surely it's self-evident that the ease of obtaining what at the moment at best could be a client certificate from a phone and recovering the information from a tamper-resistant device that goes dark if you take it offline too long (rendering the information useless). If they took their device and made it less like a mouse and more like something that tried to tunnel through the stupidest medium ever, I could live with it a little more and see the 'they are stupidly insecure' argument as fud. Second, you realize it took 1 person about a week to reverse, document and develop the PoC for blocking skype (me) and not much longer for a crypto-library from it (accuvant ryan)? A year is a vast over-estimate and im pretty slow at it. If the overall debate pertains to whether verifone did this right or not, I'd agree with you. Although, I have to admit cheering for them with their 'and we will prove it with an app@#@!' part-- if they were consultants they wouldve gotten invited to speak at blackhat. If I had to take a stab at it, after looking at square a little bit. I'd say that if they made the honest argument, Square would try to throw lawyers at them. The honest argument is, 'have you looked at these guys? they're bordering on a criminal-enterprise-by-design, albeit rubber stamped by PCI'. I mean seriously? a point and a half more if I don't have the card and want to enter it on your website instead? (Also the hubris in their research & disclosure policy made my blood boil)
- tptacek 16y ago
  Anyone in the world can make a little white dongle that reads credit card magstripes. What is the point of making an ultra-secure white dongle? How would anybody know you're using the ultra-secure one?
not_me 16y ago
Also as an addendum; the thought process about hardware reversing is not entirely correct. You will run into things like can't build a device that can sniff that fast without a substantial budget; how much is that microscope? That just have no real parallel in software