Archive for December, 2013

More on the Target breach …

Posted: December 29, 2013 by IntentionalPrivacy in Security Breach
Tags: , , , ,

According to the NY Times, Target is partnering with a Verizon forensic team to investigate the breach, as well as the Secret Service and the Justice Department.

If you would like to learn more about PIN number analysis, read this article http://www.datagenetics.com/blog/september32012/. Nick Berry, the president of Datagenics, also gave a speech on July 23, 2013, on Ted Talks about how to use passwords and be safer on the Internet.

 

What to know about the Target breach …

Posted: December 27, 2013 by IntentionalPrivacy in Financial vulnerabilities, Identity theft, Security Breach, Tips, Vulnerabilities
Tags: , , , , , , ,

I shop at Target about once a week. Last Saturday, I was dismayed to discover that an estimated 40 million debit and credit cards used at Target had been stolen. This isn’t the first time my card number has been stolen, and it probably won’t be the last, unfortunately.

Many of those cards will be duplicate numbers, so the total number of cards stolen will probably be fewer than 40 million. Still, it is a very large breach, the second largest to date. The biggest breach—90 million credit/debit account numbers!—in the US occurred at TJX over a period of 18 months and was discovered on December 18, 2006 (TJX data theft).

First, let’s look at what happened:

  • On December 15, 2013, malware was discovered on Target’s point-of-sale systems at US stores. Target eliminated the malware, and notified card processors and payment card networks.
  • According to some sources (a Reuters story posted on Yahoo!), Target did not find the breach; it was discovered by a security researcher. That is worrisome.
  • According to Target, the issue only affected US stores; purchases made online at Target.com or in Canada were not part of the breach.
  • In their statement, Target explains the breach occurred between 11/27/2013 and 12/15/2013.
  • PIN data was stolen (Reuters – Target says PINs stolen, but confident data secure), but not the key, which according to Target’s statement, resides at the external card processing center. They are not giving out the name of their processing center. The PIN data is encrypted with Triple DES encryption.  To decrypt the PIN data, the thieves need the key.
  • There are 2 types of security codes used with credit/debit cards. Each card issuer calls the security codes by different names.
    • The first code is embedded in the magnetic stripe of the card and is used when you present the card to a merchant; it’s often called the CVV code. This one was included in the stolen data.
    • The second number, often called the CVV2 code, is not included in the magnetic stripe data and therefore was not stolen. This is the number used when you make card-not-present transactions, such as online or over the phone. American Express prints the four-digit number they use on the front side of the card, while most other issuers use a three-digit code printed on the back of the card next to the signature area.
  • The US Secret Service is investigating, as well as an unnamed outside investigator.
  • Stay tuned for more details. I don’t think investigators have a good handle on this theft yet, so the details are likely to change.

Note: PINs are not the safest way to protect your financial information; there are only 10,000 combinations (0000 to 9999). Europe uses electronic chips in their cards; another method is a dynamic pin generated through a text message or some other media, such as an RSA token. The problem with dynamic pins is that they’re slow and expensive.

According to Krebs on Security, stolen Target credit/debit card numbers are already being sold in underground black markets in batches of one million cards.

What to do?

  1. Monitor any account(s) used at Target at least daily for evidence of tampering.
  2. Check out the Target breach details.
  3. Get a copy of your credit report. You get 1 free credit report from each credit agency per year. https://www.annualcreditreport.com/index.action
  4. Target says they will pay for credit reporting; they will have more details later.
  5. Replace your card:
    • If you use a Target REDcard, contact Target for a replacement card.
    • Ask your bank or credit union to replace each card used at Target during the dates the breach occurred.
  6. If you choose not to replace your card, at least change your PIN number.
  7. When you choose a PIN, do not use your birth date or consecutive digits, such as “1234.”
  8. Some cards allow you to add an alert when it’s used; check with your card issuer to find out if they have this feature. The Target REDcard does give you this ability.
  9. Do not respond to any scam emails, texts, or phone calls asking for your PIN or your social security number or your credit card number.
  10. Some people suggest buying a prepaid credit card or using cash instead of using credit/debit cards. I’ve never used one, so I don’t know anything about costs, but I’m going to look into it.

If you notice fraudulent activity in your account:

  1. Notify your card issuer immediately at the number on the back of your card and cancel your card. This greatly limits the payment portion of fraud you’re responsible for.
  2. Put a block on your credit report at one of the three credit reporting agencies:
  3. Read the FTC’s tips for “Lost or Stolen Credit, ATM, and Debit Cards.”

Who pays the costs?

While it’s true that the banks and the merchant eat the losses initially; ultimately, we all pay the price of such theft through higher costs.

Codes and Ciphers

Posted: December 23, 2013 by uszik11 in Uncategorized

Codes and ciphers are about more than sending secret messages, though there is that.  When the first public key cryptosystems were being publicized in the 1970s, authentication was a suggested application.  How do you validate a digital signature?  If you have the answer to the public key question, then you must hold the authenticating string. Although the first Diffie-Hellman knapsack system was later exposed for weaknesses, the problem itself and the algorithms for instantiating it remain as possible platforms. Others have been invented since.

Whether or not you rely on cryptography, and independent of which (if any) system(s) you choose, codes and ciphers are in and of your daily world. They make credit card transactions and cellphone handshaking possible.  They allow the efficient compression of messages. In fact, the common zip command on your computer is one way to encipher any message. It is easy to break, but the message is no longer in plaintext. Many other simple systems are available, no better or worse than the Yale or Schlage lock on your front door, they do stop all honest people and many who are not.

This week, news about more of Edward Snowden’s leaks revealed that RSA (now an EMC label) took $10 million from the NSA and installed weaknesses to allow backdoors to its encryption.

Of all the secret messages from World War II, many remain unbroken. The need is gone. A code or cipher only needs to be as good as it needs to be.  Of all the “unbreakable” codes, the one-time pad and the dictionary code remain easy and effective.

Book cover "The Code Book" gray and black. Just words with random numbers no pictures.

All About Unbreakable Codes (1983)

 In the University of Texas library stacks, looking for the early history of word processors, I was in the Zs and discovered that my book on codes and ciphers was actually checked out.  It took three editions to get it right.  The first 3000 years were easy enough to understand. I wrote programs in Basic that transposed and substituted right up through the Playfair and Vigenere ciphers.  RSA was a tough nut to crack; and I finally just cut-and-pasted one of their own graphics and quoted their own abstract.

As the IBM-PC finally overtook the TRS-80, other amateur cryptographers published more complete books of programs for personal computers.  By 1993 or so, with Phil Zimmermann’s PGP becoming common in sig lines and footers, applied personal cryptography sped light years past high school algebra in Basic. PGP is now part of the Symantec suite.

– Michael E. Marotta (uszik11@gmail.com)