13 ms·

Credit Card Breach at California DMV

65 points by ssclafani 13y ago

Varcht 13y ago
I heard a commercial for Lifelock the other day. The hook was something like "Big news in identity theft! There hasn't been a major breach in a couple weeks..." Something needs to be done to prevent this. I wonder if it would be feasible for the Credit card companies to do all the storage of card data as a service for retailers. Retailers would just store a reference token. Until then my credit is frozen[1] 1. http://www.clarkhoward.com/news/clark-howard/personal-finance-credit/credit-freeze-and-thaw-guide/nFbL/ http://www.clarkhoward.com/news/clark-howard/personal-financ...
- Cherian_Abraham 13y ago
  What you are talking about is essentially the tokenization concept which should become real in 2014. All retailers such as Amazon would become Token requestors in this concept. Advantages would be to essentially make these breaches irrelevant as tokens could be invalidated quickly by the card issuers easily. Further, for merchants - the advantage would be reduced fraud and hopefully better interchange economics.
  - jimktrains2 13y ago
    A lot of processors have offered that service for years. Amazon, being their own processor, probably stores their own numbers, but if Visa themselves would start tokenizing, that would be huge and awesome.
  - Varcht 13y ago
    Good to hear, I sincerely hope that can get it right.
- KMag 13y ago
  It would be tragically easy for each credit card company to give each retailer a different Curve25519 public key and keep all of the private keys. The retailer could immediately encrypt the CC number using Curve25519 and AES-256 as soon as they got it, requiring 48 bytes of storage. One or two more bytes (or a variable-length integer) would store which credit card company the token is good for. That way, each merchant can generate its own tokens without having to interact with the credit card companies, and any stolen tokens can only be used to make fraudulent charges with the same merchant from which they were stolen.
  - hga 13y ago
    I would add in all seriousness that: "It would be tragically easy for many retailers to not immediately encrypt the CC number using Curve25519 and AES-256 as soon as they got it, or take years to move to this, etc." Although anything that, if properly used, would massively decrease the attack surface and localize the consequence of a breach, would be fantastic. Right now the attack surface is just too damned big. Hmmm, to prevent another Target, wouldn't each POS card acceptor need firmware or hardware changes to do this action "immediately"?
    - jimktrains2 13y ago
      The issue with target wasn't someone intercepting between the reader and the terminal. The terminal, or heck, even the store's servers, could do the encryption and it wouldn't be terribly difficult or time consuming to do (as opposed to firmware upgrades).
  - kabdib 13y ago
    "Tragically easy" in the case of a large government deployment of software probably means "a few years of study, about a hundred consultants, and a bunch of custom COBOL and Java written by people who can't spell XOR and think that ROT13 is overkill." The encryption algorithms you use are the least interesting piece of the puzzle: Just use something strong enough. It's the key management, data flow, storage and access security (both physical and via computer) that this kind of thing falls apart on. You really need security all the way from the reader, which is (sort of) what chip-and-PIN is.
- superuser2 13y ago
  The security of credit card information isn't the consumer's problem, thanks to zero fraud liability policies. The worst that happens is you have to use your debit card for a few days while a new credit card comes in the mail. It's typical of the HN ethos to want to take heroic steps to safeguard your personal data and to demand better of the people who handle it, but in the case of credit card numbers, it's really the industry's problem, not ours.
yukichan 13y ago
I'm going to start paying cash everywhere. I already use cash at point of sale at regular stores, and I've limited my online exposure to Amazon, Netflix, Google and PayPal. Insecurity is sending me back into the 70's with financial technology. I don't even want to use checks. I went to H&R block, tried to pay with a check to avoid giving my credit card details and they scanned the check's routing and bank number and stored that! Losing your bank info is more severe than credit card data because you have to close your account. Seriously bringing like a wad of cash next time I go to H&R block.
- re_todd 13y ago
  As for Amazon, I've been paying cash for the Amazon gift cards at the local grocery store. For other sites, I'm using GreenDot, a debit card that can be used online like a credit card. I can keep a low balance on it so if it ever gets compromised I won't be out very much. However, the over $5 a month charge is a pain and I'm looking for something similar but cheaper.
- ianhawes 13y ago
  You're almost never liable for any fraudulent charges made on your credit card or debit card. Provided you notify your bank, the standard procedure is to issue you a new card and reverse the charges. While it's not convenient, I'd gladly trade the convenience of paying with plastic over cash. Additionally, any situation where you COULD pay in cash, you're not providing billing information to the merchant, so there's no risk of information compromise (aside from your name).
  - wdewind 13y ago
    Not only that, if you're paying back your credit card every month you're getting some kind of points/rewards thing which definitely covers the risk of inconvenience if your number is stolen.
    - deveac 13y ago
      And cards like Amex can come with their own unconditional return policies that are more generous then those if the retailer you purchased from. There are a lot of pro-consumer reasons to use a card. That, the ability to execute chargebacks in disputes, and rewards make for an attractive package. I personally get about 3.5 flights a year off of a credit mechanism that needs to be employed regardless, so not bad. Usually have fraudulent charges show up at least once a year though.
eliteraspberrie 13y ago
This is the new model for non-petty theft. Rather than target individual credit card holders, just target the watering holes -- which, like credit cards themselves (in the US) have near zero security.
- sigkill 13y ago
  To be fair, technology makes it easy to firehose-vacuum data for both the government and civilians if you know how to wield that power. The government needs to supply a letter stating that they're 'quartering troops' in your datacenters in an abstract manner (bureaucratic exploit) while the normal user learns the intricacies of the system and uses that (technological exploit). It so happens that fixing bureaucratic 0days are harder than fixing tech. 0days.
DocG 13y ago
After I have seen how irresponsibly companys handle these situations, I wonder is it possible to sue them if there is a damage done. Same if someone has identity theft. Can the information "leaker" be taken accountable for such thing? Is there a precedent on this?
- ljd 13y ago
  I used to work on a credit card processing system for a large ecommerce company where my code and I were audited on an annual basis. The fear was always, if there were a breach on our several hundred thousand credit card database it would be trivial to find out that it came from us and it would be VISA that would start litigation against us. I'm lucky enough to never have had a credit card system that I wrote broken into so I couldn't tell you first hand. If anyone wants to know how to make a secure credit card system, it's pretty simple: 1. Don't be creative - there are plenty of rock solid boring implementations that will encrypt your cards. 2. Don't get fancy with encryption or key storage and use strong encryption and a salt and you'll be fine. 3. Limit physical and administrative access to the servers to as few humans as possible. 4. Let the only code that decrypts the cards be the code that is literally right before your call to the gateway. 5. Tokenize your cards, even if it's for an internal project where you think everyone can be trusted. EDIT: As a note, just follow PCI[0] to the letter and you'll end up pretty safe. [0]https://www.pcisecuritystandards.org/documents/pci_dss_v2.pdf https://www.pcisecuritystandards.org/documents/pci_dss_v2.pd...
  - jimktrains2 13y ago
    The better option, for most places, is to use some form of tokenization where your CC processor stores the CC numbers and hands you an opaque token to store. Much less to worry about on your end as the tokens have no meaning outside the tokenization service. Also, just to reïterate the point: When it comes to security, and you're not a crypto or security person, don't be creative and don't be fancy. Use what works.
lvs 13y ago
I think we're going to have to face the music soon: credit cards are a broken transaction mechanism. They have a basic security model that's decades old, with only a few patches over time. The truth is that a credit card has no inherent security once you know a few essentially public things about it. Insert cryptocurrency endorsement here -- or at least something else, because the current tech has hit a wall.
- ljd 13y ago
  Chip & Pin [0] as well online authentication challenges such as 3-D Secure [1] have already solved these issues but the United States has been slow to picking them up. [0] http://en.wikipedia.org/wiki/Chip_and_PIN http://en.wikipedia.org/wiki/Chip_and_PIN [1] http://en.wikipedia.org/wiki/3-D_Secure http://en.wikipedia.org/wiki/3-D_Secure
  - lvs 13y ago
    It seems like yet another bandage on the current model, no? http://en.wikipedia.org/wiki/EMV#Vulnerabilities http://en.wikipedia.org/wiki/EMV#Vulnerabilities
    - raverbashing 13y ago
      It may have some vulnerabilities, however the biggest vulnerability is still the backwards compatible magnetic stripe EMV is a more secure than a trivially copyable magnetic stripe. And 3-D Secure is a JOKE.
      - dmishe 13y ago
        So for pin, you really only need to hack the keyboard right? Either malware in existing one or setup a fake? Is it really that more secure than magnet strip then? I.e. if you have access to install a malicious strip reader, you surely can get access to pin keyboard?
        deleted 13y ago
kevinpet 13y ago
Not surprising considering the geniuses at the CA DMV think that "Who did you vote for in the last presidential election?" is a good security question. I write about six checks a year. Two of them are auto registration because their site is so horribly broken when it could be so amazingly easy. These people are able to send me a piece of paper in the mail with an access code. It should take 30 seconds to pay my registration online.
- existencebox 13y ago
  Not that I have any particularly related thoughts, but my most recent interaction with a DMV was them refusing my birth certificate as a valid form of ID because "It's printed on paper" and "what's a notary." (It was a formally notarized copy, which AFAIK is the only way to get a copy from records, you can no longer get an original if you've lost it; and this was the DMV MANAGER I was speaking to.) The entire DMV system has been so backwards I don't even know where I would start addressing it.
reustle 13y ago
Ever since I started using Simple, I haven't worried too much about my card info getting stolen and used without me realizing. I instantly get a push notification whenever my card is charged, so I am mentally confirming every time I spend.
- ketralnis 13y ago
  Knowing that it happened isn't the same as having a system that's resistant to it happening
  - stcredzero 13y ago
    In some cases, it's the only viable option.
- ianhawes 13y ago
  Not that I don't like what Simple is doing, but American Express, Bank of America, Wells Fargo, etc.. all have the capability to receive an email when your card is charged either by swipe or electronically.
- prostoalex 13y ago
  What happens when you travel abroad and have no data plan there?

65 points by ssclafani 13y ago

I heard a commercial for Lifelock the other day. The hook was something like "Big news in identity theft! There hasn't been a major breach in a couple weeks..." Something needs to be done to prevent this. I wonder if it would be feasible for the Credit card companies to do all the storage of card data as a service for retailers. Retailers would just store a reference token. Until then my credit is frozen[1] 1. http://www.clarkhoward.com/news/clark-howard/personal-finance-credit/credit-freeze-and-thaw-guide/nFbL/ http://www.clarkhoward.com/news/clark-howard/personal-financ...

Cherian_Abraham 13y ago
What you are talking about is essentially the tokenization concept which should become real in 2014. All retailers such as Amazon would become Token requestors in this concept. Advantages would be to essentially make these breaches irrelevant as tokens could be invalidated quickly by the card issuers easily. Further, for merchants - the advantage would be reduced fraud and hopefully better interchange economics.
- jimktrains2 13y ago
  A lot of processors have offered that service for years. Amazon, being their own processor, probably stores their own numbers, but if Visa themselves would start tokenizing, that would be huge and awesome.
- Varcht 13y ago
  Good to hear, I sincerely hope that can get it right.
KMag 13y ago
It would be tragically easy for each credit card company to give each retailer a different Curve25519 public key and keep all of the private keys. The retailer could immediately encrypt the CC number using Curve25519 and AES-256 as soon as they got it, requiring 48 bytes of storage. One or two more bytes (or a variable-length integer) would store which credit card company the token is good for. That way, each merchant can generate its own tokens without having to interact with the credit card companies, and any stolen tokens can only be used to make fraudulent charges with the same merchant from which they were stolen.
- hga 13y ago
  I would add in all seriousness that: "It would be tragically easy for many retailers to not immediately encrypt the CC number using Curve25519 and AES-256 as soon as they got it, or take years to move to this, etc." Although anything that, if properly used, would massively decrease the attack surface and localize the consequence of a breach, would be fantastic. Right now the attack surface is just too damned big. Hmmm, to prevent another Target, wouldn't each POS card acceptor need firmware or hardware changes to do this action "immediately"?
  - jimktrains2 13y ago
    The issue with target wasn't someone intercepting between the reader and the terminal. The terminal, or heck, even the store's servers, could do the encryption and it wouldn't be terribly difficult or time consuming to do (as opposed to firmware upgrades).
- kabdib 13y ago
  "Tragically easy" in the case of a large government deployment of software probably means "a few years of study, about a hundred consultants, and a bunch of custom COBOL and Java written by people who can't spell XOR and think that ROT13 is overkill." The encryption algorithms you use are the least interesting piece of the puzzle: Just use something strong enough. It's the key management, data flow, storage and access security (both physical and via computer) that this kind of thing falls apart on. You really need security all the way from the reader, which is (sort of) what chip-and-PIN is.
superuser2 13y ago
The security of credit card information isn't the consumer's problem, thanks to zero fraud liability policies. The worst that happens is you have to use your debit card for a few days while a new credit card comes in the mail. It's typical of the HN ethos to want to take heroic steps to safeguard your personal data and to demand better of the people who handle it, but in the case of credit card numbers, it's really the industry's problem, not ours.

yukichan 13y ago

I'm going to start paying cash everywhere. I already use cash at point of sale at regular stores, and I've limited my online exposure to Amazon, Netflix, Google and PayPal. Insecurity is sending me back into the 70's with financial technology. I don't even want to use checks. I went to H&R block, tried to pay with a check to avoid giving my credit card details and they scanned the check's routing and bank number and stored that! Losing your bank info is more severe than credit card data because you have to close your account. Seriously bringing like a wad of cash next time I go to H&R block.

re_todd 13y ago
As for Amazon, I've been paying cash for the Amazon gift cards at the local grocery store. For other sites, I'm using GreenDot, a debit card that can be used online like a credit card. I can keep a low balance on it so if it ever gets compromised I won't be out very much. However, the over $5 a month charge is a pain and I'm looking for something similar but cheaper.
ianhawes 13y ago
You're almost never liable for any fraudulent charges made on your credit card or debit card. Provided you notify your bank, the standard procedure is to issue you a new card and reverse the charges. While it's not convenient, I'd gladly trade the convenience of paying with plastic over cash. Additionally, any situation where you COULD pay in cash, you're not providing billing information to the merchant, so there's no risk of information compromise (aside from your name).
- wdewind 13y ago
  Not only that, if you're paying back your credit card every month you're getting some kind of points/rewards thing which definitely covers the risk of inconvenience if your number is stolen.
  - deveac 13y ago
    And cards like Amex can come with their own unconditional return policies that are more generous then those if the retailer you purchased from. There are a lot of pro-consumer reasons to use a card. That, the ability to execute chargebacks in disputes, and rewards make for an attractive package. I personally get about 3.5 flights a year off of a credit mechanism that needs to be employed regardless, so not bad. Usually have fraudulent charges show up at least once a year though.

eliteraspberrie 13y ago

This is the new model for non-petty theft. Rather than target individual credit card holders, just target the watering holes -- which, like credit cards themselves (in the US) have near zero security.

sigkill 13y ago
To be fair, technology makes it easy to firehose-vacuum data for both the government and civilians if you know how to wield that power. The government needs to supply a letter stating that they're 'quartering troops' in your datacenters in an abstract manner (bureaucratic exploit) while the normal user learns the intricacies of the system and uses that (technological exploit). It so happens that fixing bureaucratic 0days are harder than fixing tech. 0days.

DocG 13y ago

After I have seen how irresponsibly companys handle these situations, I wonder is it possible to sue them if there is a damage done. Same if someone has identity theft. Can the information "leaker" be taken accountable for such thing? Is there a precedent on this?

ljd 13y ago
I used to work on a credit card processing system for a large ecommerce company where my code and I were audited on an annual basis. The fear was always, if there were a breach on our several hundred thousand credit card database it would be trivial to find out that it came from us and it would be VISA that would start litigation against us. I'm lucky enough to never have had a credit card system that I wrote broken into so I couldn't tell you first hand. If anyone wants to know how to make a secure credit card system, it's pretty simple: 1. Don't be creative - there are plenty of rock solid boring implementations that will encrypt your cards. 2. Don't get fancy with encryption or key storage and use strong encryption and a salt and you'll be fine. 3. Limit physical and administrative access to the servers to as few humans as possible. 4. Let the only code that decrypts the cards be the code that is literally right before your call to the gateway. 5. Tokenize your cards, even if it's for an internal project where you think everyone can be trusted. EDIT: As a note, just follow PCI[0] to the letter and you'll end up pretty safe. [0]https://www.pcisecuritystandards.org/documents/pci_dss_v2.pdf https://www.pcisecuritystandards.org/documents/pci_dss_v2.pd...
- jimktrains2 13y ago
  The better option, for most places, is to use some form of tokenization where your CC processor stores the CC numbers and hands you an opaque token to store. Much less to worry about on your end as the tokens have no meaning outside the tokenization service. Also, just to reïterate the point: When it comes to security, and you're not a crypto or security person, don't be creative and don't be fancy. Use what works.

lvs 13y ago

I think we're going to have to face the music soon: credit cards are a broken transaction mechanism. They have a basic security model that's decades old, with only a few patches over time. The truth is that a credit card has no inherent security once you know a few essentially public things about it. Insert cryptocurrency endorsement here -- or at least something else, because the current tech has hit a wall.

ljd 13y ago
Chip & Pin [0] as well online authentication challenges such as 3-D Secure [1] have already solved these issues but the United States has been slow to picking them up. [0] http://en.wikipedia.org/wiki/Chip_and_PIN http://en.wikipedia.org/wiki/Chip_and_PIN [1] http://en.wikipedia.org/wiki/3-D_Secure http://en.wikipedia.org/wiki/3-D_Secure
- lvs 13y ago
  It seems like yet another bandage on the current model, no? http://en.wikipedia.org/wiki/EMV#Vulnerabilities http://en.wikipedia.org/wiki/EMV#Vulnerabilities
  - raverbashing 13y ago
    It may have some vulnerabilities, however the biggest vulnerability is still the backwards compatible magnetic stripe EMV is a more secure than a trivially copyable magnetic stripe. And 3-D Secure is a JOKE.
    - dmishe 13y ago
      So for pin, you really only need to hack the keyboard right? Either malware in existing one or setup a fake? Is it really that more secure than magnet strip then? I.e. if you have access to install a malicious strip reader, you surely can get access to pin keyboard?
      - deleted 13y ago

kevinpet 13y ago

Not surprising considering the geniuses at the CA DMV think that "Who did you vote for in the last presidential election?" is a good security question. I write about six checks a year. Two of them are auto registration because their site is so horribly broken when it could be so amazingly easy. These people are able to send me a piece of paper in the mail with an access code. It should take 30 seconds to pay my registration online.

existencebox 13y ago
Not that I have any particularly related thoughts, but my most recent interaction with a DMV was them refusing my birth certificate as a valid form of ID because "It's printed on paper" and "what's a notary." (It was a formally notarized copy, which AFAIK is the only way to get a copy from records, you can no longer get an original if you've lost it; and this was the DMV MANAGER I was speaking to.) The entire DMV system has been so backwards I don't even know where I would start addressing it.

reustle 13y ago

Ever since I started using Simple, I haven't worried too much about my card info getting stolen and used without me realizing. I instantly get a push notification whenever my card is charged, so I am mentally confirming every time I spend.

ketralnis 13y ago
Knowing that it happened isn't the same as having a system that's resistant to it happening
- stcredzero 13y ago
  In some cases, it's the only viable option.
ianhawes 13y ago
Not that I don't like what Simple is doing, but American Express, Bank of America, Wells Fargo, etc.. all have the capability to receive an email when your card is charged either by swipe or electronically.
prostoalex 13y ago
What happens when you travel abroad and have no data plan there?