🚀 go-pugleaf

In article <1992Sep8.115050.8694@cl.cam.ac.uk>, rja14@cl.cam.ac.uk (Ross Anderson) writes:

|> This sort of `false terminal attack' was first reported in the USA in
|> about 1988. You'd think the banks would warn people about it, but
|> instead they seem determined to introduce PIN pads in retail outlets 
|> here. The idiots seem to believe that this will cut fraud from the 
|> current \pounds 200 million plus, but in practice it means that every 
|> bent merchant in the country will be able to collect card and PIN data.

This type of attack has been going on for a lot longer than that, and it
doesn't require a fraudulent merchant to perpetrate.  There were a couple of
cases in the late 70s/early 80s of someone building a bogus ATM machine and
placing it directly in front of a real bank ATM machine.  I believe one case
was in New York and the other in Italy, but my memory may be flakey on this 
point.

This points up the need for one of the B2 and up security measures from
the orange book - namely trusted path.  There must be a way for the user
to authenticate to the system, but there must also be a way for the system
to authenticate itself to the user, so that user knows that this is the
real bank ATM or terminal or workstation or whatever...

In article <1992Sep8.164652.1780@osf.org> karger@osf.org (Paul A. Karger) writes:

! This points up the need for one of the B2 and up security measures from
! the orange book - namely trusted path.  There must be a way for the user
! to authenticate to the system, but there must also be a way for the system
! to authenticate itself to the user, so that user knows that this is the
! real bank ATM or terminal or workstation or whatever...

It just shows that the current idea of an 'ATM card' is no good. We need
intelligent tokens and pretty damn fast. By 'intelligent token' I mean
a card that can be challenged by the computer of the bank. I've seen this
talked about in many books, so it's nothing new. What I would like to know
is that how soon such devices will be available? Will the patents on
public encryption prevent such devices for another 10 years?
--
...............................................................................
Ari Huttunen   			       Any similarity to other alien life forms
				          is purely coincidental.
					      <Alien 3 misquote>

In article <ARI.HUTTUNEN.92Sep9013737@supergirl.hut.fi>,
Ari.Huttunen@hut.fi (Ari Juhani Huttunen) wrote:
> 
> 
> It just shows that the current idea of an 'ATM card' is no good. We need
> intelligent tokens and pretty damn fast. By 'intelligent token' I mean
> a card that can be challenged by the computer of the bank. I've seen this
> talked about in many books, so it's nothing new. What I would like to know
> is that how soon such devices will be available? Will the patents on
> public encryption prevent such devices for another 10 years?


It's not patents that holding up smart ATM cards, it's cost and benefits.
In order to find the *maximum* amount that any rational bank[1] would spend
on a smart ATM card, divide the amount of fraud that you expect that
technology to prevent by the number of cards outstanding.  The last I
heard, for the kinds of things that smart cards might possibly prevent,
this amounted to about $0.10 per card.

-- Jim Lyon                          "... where the work is NonStop,
   Lyon_Jim@Tandem.Com                    and we do everything twice."

[1]  A contradiction in terms, I know.

In article <1992Sep8.115050.8694@cl.cam.ac.uk> rja14@cl.cam.ac.uk (Ross Anderson) writes:

   A new type of ATM fraud has just arrived in London.

   An auction was advertised at which video cassette recorders and other
   consumer electronic goods were for sale at very low prices. A lot of
   people turned up and were asked to provide identification at the door -
   this is normal enough at auctions in Britain - and the preferred means
   of identification was a bank or credit card (you had to swipe it in a 
   reader and enter your PIN at a nearby keypad).

A much simpler (and successful) fraud is to steal someone's wallet or
purse. This usually yields the victim's phone number as well as ATM
cards. The fraudster then calls the victim claiming to be a police
officer or bank security official and asks for the PIN number for
"verification" or "for their report".

   What's the point of designing wonderful cryptographic systems when the
   customer corporations think they know it all and build implementations 
   that are trivial to break even without cryptanalysis?

Indeed. The UK banks do tell customers to keep PIN numbers secret, but
they don't properly explain why this is necessary. Even so, it is
disgraceful that their systems fail to take account of the possibility
that the key becomes compromised. This is not an unreasonable
assumption given human nature - witness the scams above or the stories
about people who write down their PINs.

		Jim

In article <ARI.HUTTUNEN.92Sep9013737@supergirl.hut.fi> Ari.Huttunen@hut.fi
(Ari Juhani Huttunen) writes:

>It just shows that the current idea of an 'ATM card' is no good. We need
>intelligent tokens and pretty damn fast. By 'intelligent token' I mean
>a card that can be challenged by the computer of the bank. I've seen this
>talked about in many books, so it's nothing new. What I would like to know
>is that how soon such devices will be available?

Once upon a time I worked for a bank.  I read a report estimating
losses on credit cards from fraud vs. other causes, as well as
detailing some of the security measures on today's cards.

The long and the short of it is:  Losses due to fraud are currently
an order of magnitude less than losses due to simple non-payment
of what's owed.

Until fraud becomes a more significant problem, there is little
motivation to invest resources into reducing fraud when the same
resources could be used to try and reduce non-payment of debts.


At the same unnamed bank, we were required to use smart cards for
some things, and heavily encouraged to use them in some pilot
customer-type projects.  This was two years ago, and maybe state
of the art has improved, but the smart cards we were using had a
lot of reliability problems (chip popping out of card, not working
after you sat on your wallet, not surviving exposure to water,
etc.).  Customers already get very upset when their mag-stripe
cards stop working, and replacing them with something that is much
more fragile doesn't seem like a good idea.


So smart cards are likely to be delayed until costs fall nearer to
the costs of making a mag-stripe card, and reliability increases
to a level similar to a mag-stripe card.

Or until fraud becomes a more serious problem...

- Paul Colley
University:  colley@qucis.queensu.ca
Home:        pacolley@ember.uucp   watmath!ember!pacolley  +1 613 545 3807
<Ring> [...] "Sorry, I'm all booked up." "Who was that?" "The library." - B.C.

In article <JIM.92Sep9125700@hunter.cs.strath.ac.uk> jim@cs.strath.ac.uk (Jim Reid) writes:
>Indeed. The UK banks do tell customers to keep PIN numbers secret, but
>they don't properly explain why this is necessary.

Even if they did, there's no way to write the necessary warning.

"Keep the PIN secret" can not mean "refuse to enter it on any keypad,
no matter how official looking".

One point worth making.  Even with an ATM card that challenges the 
machine to see if it is authentic, an individual could either tap
the keyboard and appropriate elements to find out who belongs
to the pin number.  Or design a front that records what is
going on and relays it to a a working secure machine.

In article <7161518255083@c00506-119rd.eos.ncsu.edu>, cddukes@c00506-119rd.eos.ncsu.edu (PakRat's Anonymous) writes:
|> One point worth making.  Even with an ATM card that challenges the 
|> machine to see if it is authentic, an individual could either tap
|> the keyboard and appropriate elements to find out who belongs
|> to the pin number.  Or design a front that records what is
|> going on and relays it to a a working secure machine.
|> 

All true - this is why the smart ATM card needs its own keyboard
and on-board encryption device.  Then the bi-directional challenges
are fully encrypted, and a completely bogus machine cannot interfere.
What this means is something like a credit-card sized calculator.

Certainly the ATM cards typically in use today in the US are insufficient.
Some of the European smart cards are approaching what is required, but
the real issue is building a smartcard with a keyboard that can survive
in a person's wallet or purse or whatever and doesn't cost significantly
more than current mag-stripe ATM cards.   This is a major engineering
challenge to the power and packaging people!!

Surely those of us that know about the banks electronic security measures (and
often shocking lack of them) have known that this could happen at any time. There
must be hundreds of variations on this scam!

Unfortunately the banks are not interested in security. I was involved at one
time in a project with the UK banks to provide point-of-sale use of swipe cards
(the project/company etc will remain nameless). The project provided a high
degree of security (physical and electronic) to prevent fraud on the part of the
retailer and the customer (and to some extent the bank!). The banks were simply
not interested in bearing the cost of the fraud protection, they wanted to pass it
on to someone. The project collapsed!

A similar system with much poorer security exists called SWITCH. Despite having a
card to access this system (it's just my bank card), I will not use it! Typing my
PIN in at a terminal in a supermarket knowing that it is not properly secure, even
with  the added security of those bits of paper banks love, is not something I am
willing to do.

The only security a bank customer has is the security of his PIN. The banks do
say "TREAT THIS CARD LIKE CASH" (from an ATM here); they don't provide advice on
keeping your PIN safe though. The naivete of Joe Public is immense, as is
illustrated by password/PIN frauds; but the banks and others must have some duty
of care surely? Why don't they provide more advice on when to use your PIN and
when not to? How to prevent the guy behind you in the ATM queue from seeing your
PIN?


Simon Read
----------
Simon.Read@umist.ac.uk

Disclaimer: The above expresses my *personal* opinion. Not necessarily those of 
            any organisation I currently work for or have worked for in the past.

 Jim> In article <1992Sep8.115050.8694@cl.cam.ac.uk>
 Jim> rja14@cl.cam.ac.uk (Ross Anderson) writes:

 Jim>    A new type of ATM fraud has just arrived in London.

 Jim> A much simpler (and successful) fraud is to steal someone's
 Jim> wallet or purse. This usually yields the victim's phone number
 Jim> as well as ATM cards. The fraudster then calls the victim
 Jim> claiming to be a police officer or bank security official and
 Jim> asks for the PIN number for "verification" or "for their
 Jim> report".

An *even* simpler fraud than that is the following. Place the
following advertisement in any large metropolitan or national
newspaper (names etc. paraphrased):

			 Sally Sue Cosmetics
	     Receive $89.99 worth of name brand cosmetics
			  for only $19.99!!!
		       Visa/MasterCard Accepted
			 Call 1-800-555-5555
			  6-8 weeks delivery

Then contract with any telephone order service (basically an answering
service) to collect name, address, credit card number, telephone, etc.
The order service will deliver to your doorstep a list (on tape,
printout, whatever) with all the suckers that called in. While your
"customers" are waiting for their order, you can rob them blind. By
the time they've noticed the problem, you're long gone. 

This is a true story, reported in a recent 60-minutes (a U.S. news
show). The perpetrator was a prisoner, awaiting trial for murder. And
while he was waiting, he ran this and other successful telephone scams
right from his cell.

Face it, no matter how sophisticated you make your authentication
scheme, if the end user doesn't know how to take adavantage of it,
they're going to get ripped off. You are much better off trying to
educate them (a lost cause, but far cheaper than technological slight
of hand), in hopes that someone learns something.

Ken
--

Ken Mayer (ken@visix.com)
Visix Software Inc./703.758.8230
  Bene Vivere Ultio Optima --- Living Well is the Best Revenge

In article <1992Sep14.085441.28829@nessie.mcc.ac.uk>, Simon Read writes:
>
> Unfortunately the banks are not interested in security. [project story deleted]

Of course they are, but if they don't loose anything (themselves) they cannot
secure that <nothing>, can they?  :-)   I guess what we need is some legal
case, some really bad publicity (on the behalf of banks) and maybe a law or
two to make this security "worth the cost" for banks. Who should pay the cost,
however, the customers or the owners, that's outside the charter of this group
to discuss.

> The only security a bank customer has is the security of his PIN. The banks do
> say "TREAT THIS CARD LIKE CASH" (from an ATM here); they don't provide advice on
> keeping your PIN safe though. The naivete of Joe Public is immense, as is
> illustrated by password/PIN frauds; but the banks and others must have some duty
> of care surely? Why don't they provide more advice on when to use your PIN and
> when not to? How to prevent the guy behind you in the ATM queue from seeing your
> PIN?

Well, why don't CNN or any other tv station make some feature on the topic?
The naive Joe Public v. the "hear no evil, see no evil, say no evil" banks
should make an interesting show.

(For a good story about a related problem, read Forbes Magazine, Aug. 3, 1992.)


In article <BuL2pH.6s3@visix.com>, Ken Mayer writes:
>
> Face it, no matter how sophisticated you make your authentication
> scheme, if the end user doesn't know how to take adavantage of it,
> they're going to get ripped off. You are much better off trying to
> educate them (a lost cause, but far cheaper than technological slight
> of hand), in hopes that someone learns something.

That's maybe a related problem to the above. John Doe doesn't understand
how "open" the system is today, and there's a limit to how advanced the
systems can be before he's unable to use them.


Btw., can anybody out there give one or two really good reasons for using
only 4 digit PINs? Why do all these cards have 4 digit PINs? Even my one
time password cards use a 4 digit PIN. (Ok, I wouldn't feel much safer
with a 6 digit PIN. Maybe there's some logic there after all - at least
the public isn't fooled into believing that a longer PIN would be safer.)

---
Haakon Styri				*** std. disclaimer applies  ***
Norwegian Telecom Research

segr@nessie.mcc.ac.uk (Simon Read) writes:
> Why don't they provide more advice on when to use your PIN and
>when not to? How to prevent the guy behind you in the ATM queue from seeing your
>PIN?

The design of the machine's keyboards makes it virtually impossible to
prevent people from seeing you enter your PIN if they really want to.

In article <unruh.716579030@physics.ubc.ca>, unruh@physics.ubc.ca (William Unruh) writes:
|> segr@nessie.mcc.ac.uk (Simon Read) writes:
|> 
|> The design of the machine's keyboards makes it virtually impossible to
|> prevent people from seeing you enter your PIN if they really want to.

-- 
As you can see below, I work for a place that has a lot of security measures
in use. One of these is a keypad for entering PIN like identification numbers.
You press a start button which randomly enumerates the keypad with a different
 sequence each time, thereby eliminating the over-the shoulder eavesdropper.
You also have to be pretty much dirrectly in front of the keypad to view the
numbers.
I'm sure these are more costly than the standard telephone type keypads, but
would not expect them to be cost prohibitive, if the ATM company wished to
advertise this exceptionally good machine design.
                                                                      
=======================================================================
Wm David Collins	BSEE, EMT-Cardiac, ACLS, KC4YYX, T191 SM
Naval Surface Warfare Center
Dahlgren Division
Code E-41, Networks Branch
Dahlgren, VA   22448-5000
W(703) 663-8246, DSN 249-8246, H(703) 775-5627
DDN mail: wcollin@relay.nswc.navy.mil
=======================================================================

In article <1992Sep15.185901.15924@relay.nswc.navy.mil>, wcollin@relay.nswc.navy.mil (Dave Collins - E41) writes:

|> As you can see below, I work for a place that has a lot of security measures
|> in use. One of these is a keypad for entering PIN like identification numbers.
|> You press a start button which randomly enumerates the keypad with a different
|>  sequence each time, thereby eliminating the over-the shoulder eavesdropper.
|> You also have to be pretty much dirrectly in front of the keypad to view the
|> numbers.

So, how do blind people use this keypad?

The challenge is not to create such a device at all, but to create one
that is (1) secure, (2) cost-effective, and (3) can be used by people
with disabilities (because of the Americans With Disabilities Act, the
latter is now _legally required_, not just a "nice extra").

Disabilities include but are not limited to:

- blindness (braille or fixed-entry format required)
- sight-imparied (braille not ok, requires high-contrast, large characters,
	wide range of sight angles, etc.)
- may be in a wheelchair
- etc.

Oh, yes, you also can't just have a closed booth that people go into.
That would create a security hazard (both for the money and the people
inside).

Craig

In article <1992Sep15.185901.15924@relay.nswc.navy.mil> 
wcollin@relay.nswc.navy.mil (Dave Collins - E41) writes: 

> [...] [A] keypad for entering PIN like identification numbers.  You
> press a start button which randomly enumerates the keypad with a
> different sequence [...] You also have to be pretty much dirrectly
> in front of the keypad to view the numbers.

Heck, they have one of these guarding the door to the main machine
room (dinosaur pen) at SUNY-Binghamton where I went for undergrad.

Last year, after instrument thefts, they got one for the musical
instrument room!

I can't imagine that these cost too much, they're really simple!

But remember: Banking losses due to fraud are dwarfed by banking
losses due to non-payment of debts.  Why should a bank spend ten
gazillion dollars to stop a million a year in thefts from ATMs, when
they could spend a mere zillion dollars on a good commercial loan
officer and get millions more?

(Note that a gazillion is 'much more than a zillion'.)


-- 
Daniel F. Boyd -- boyd@cs.buffalo.edu  "My editor can emulate your editor."
---------------------------------------------------------------------------
"It's not a System called 'X-Windows', it's a window system named 'X',
after the owl on 'Mister Rogers' Neighborhood'".