Book Review: Hacking Point of Sale 56
benrothke (2577567) writes "The only negative thing to say about Hacking Point of Sale: Payment Application Secrets, Threats, and Solutions is its title. A cursory look at it may lead the reader that this is a book for a script kiddie, when it is in fact a necessary read for anyone involved with payment systems. The book provides a wealth of information that is completely pragmatic and actionable. The problem is, as the book notes in many places, that one is constantly patching a system that is inherently flawed and broken." Keep reading for the rest of Ben's review.
Often after a major information security breach incidents, a public official (always in front of cameras and with many serious looking people standing in the wings) will go on TV and say something akin to "we have to make sure this never happens again". | Hacking Point of Sale: Payment Application Secrets, Threats, and Solutions | |
| author | Slava Gomzin |
| pages | 312 |
| publisher | Wiley |
| rating | 10/10 |
| reviewer | Ben Rothke |
| ISBN | 978-1118810118 |
| summary | Superb book on POS, PCI and payment security |
Last year, Target was the major victim. This month, it's eBay. But after hundreds of millions of records breached, it's not that anyone is saying it won't happen again. Rather, it's inevitable it will happen many more times.
There are a number of good books on PCI, but this is the first one that looks at the entire spectrum of credit card processing. Author Slava Gomzin is a security and payments technologist at HP and as evident in the book, he lives and breathes payment technology and his expert knowledge is manifest in every chapter. His technical expertise is certain to make the reader much better informed and understand the myriad issues involved.
The book provides an excellent overview to the workings of payment systems and Gomzin is not shy about showing how insecure many payment systems are. Its 9 chapters provide a good combination of deep technical and general detail.
The reader comes out with a very good overview of how payment systems work and what the various parts of it are. For many people, this may be the first time they are made aware of entities such as processors, acquirers and gateways.
An interesting point the book raises is that it has been observed there are less breaches in Europe since they use EMV (also known as chip and pin) instead of insecure magnetic-stripe cards which are used in the US. This leads to a perception that EMV is by default much stronger. But the book notes that EMV was never designed to secure the cardholder data after the point of sale. The recent breaches at Target and Neiman Marcus were such that cardholder data was pilfered after it was in the system.
Another major weakness with EMV is it doesn't provide added security to web and online transactions. When a customer goes to a site and makes a transaction with an EMV card, it is fundamentally the same as if they would have used a magnetic stripe card. What many people don't realize also is that EMV is not some new technology. It's been around for a while. What it did was reduce the amount of fraud for physical use amongst European merchants. But the unintended consequence was that it simply moved the fraud online, where EMV is powerless.
As noted, the book provides the details and vulnerabilities of every aspect of the life of a payment card, including physical security. In chapter 4, he notes that there are numerous features that are supposed to distinguish between a genuine payment card from a counterfeited one. These include logo, embossed primary account number (PAN), card verification values and ultraviolet (UV) marks. Each one of them has their own set of limits. For the supposed security of UV marks, these are relatively easily replicated by a regular inkjet printer with UV ink.
In fact, Gomzin writes that all payment cards as they are in use today are insecure by design due to the fact that there are multiple physical security features that don't provide adequate protection from theft, and that the sensitive cardholder data information is encoded on a magnetic strip in clear text.
Gomzin has numerous PCI certifications and with all that, doesn't see PCI as the boon to payment card security as many do. He astutely observes that PCI places a somewhat myopic approach that data at rest is all that matters. Given that PCI doesn't require payment software vendors or users to encrypt application configuration data, which is usually stored in plaintext and opened to uncontrolled modification; this can allow payment application to be compromised through misconfiguration.
Even with PCI, Gomzin shows that credit card numbers are rather predictable in that their number space is in truth rather small, even though they may be 15-19 digits in length. This is due to the fact that PCI allows the first 6 and last 4 digits to be exposed in plaintext, so it's only 6 digits that need to be guessed. This enables a relatively easy brute force attack, and even easier if rainbow tables are used.
The Target breach was attributed to memory scraping and the book notes that as devastating an attack memory scraping is, there are no existing reliable security mechanisms that would prevent memory scraping.
The appendix includes a POS vulnerability rank calculator which can provide a quick and dirty risk assessment of the POS and associated payments application and hardware. The 20 questions in the calculator can't replace a formal assessment. But the initial results would likely mimic what that formal assessment would enumerate.
So what will it take to fix the mess that POS and payment systems are in now? The book notes that the system has to be completely overhauled for POS security to truly work. He notes that point-to-point encryption is one of the best ways to do that. What is stopping that is the huge costs involved in redoing the payment infrastructure. But until then, breaches will be daily news.
Hacking Point of Sale is an invaluable resource that it highly relevant to a wide audience. Be it those in compliance, information security, development, research or in your payment security group. If you are involved with payment systems, this is a necessary book.
When an expert like Slava Gomzin writes, his words should be listened to. He knows that payment breaches are inevitable. But he also shows you how to potentially avoid that tidal wave of inevitability.
Reviewed by Ben Rothke."
You can purchase Hacking Point of Sale: Payment Application Secrets, Threats, and Solutions from amazon.com. Slashdot welcomes readers' book reviews (sci-fi included) -- to see your own review here, read the book review guidelines, then visit the submission page.
Re: (Score:2, Offtopic)
No idea, but the summary mentions PCI a number of times, so at least you know you can still use your old PCI cards with it. No idea if it supports AGP though.
Re: (Score:1)
No idea, but the summary mentions PCI a number of times, so at least you know you can still use your old PCI cards with it. No idea if it supports AGP though.
PCI means PCI-Compliance, in the most regard, it is VERY strict but 95% of dealers refuse to follow it's laws and conduct.
Re: (Score:2)
I still don't know what "PCI" means in this context.
Re: (Score:1)
Payment Card Industry [wikipedia.org]
Re: (Score:1)
The usage of the apostrophe is VERY complicated, and 95% of people refuse to understand that it's means it is.
Re: (Score:2)
Re:POS (Score:4, Insightful)
No idea, but the summary mentions PCI a number of times, so at least you know you can still use your old PCI cards with it. No idea if it supports AGP though.
PCI means PCI-Compliance, in the most regard, it is VERY strict but 95% of dealers refuse to follow it's laws and conduct.
Whooosh.
That was the sound of you failing joke compliance.
The article never explains what PCI is, so to the average reader it could be Peripheral Component Interconnect, the Presbyterian Church in Ireland, the Pharmacy Council of India or maybe, just maybe Payment Card Industry.
Re: (Score:2)
No idea, but the summary mentions PCI a number of times, so at least you know you can still use your old PCI cards with it. No idea if it supports AGP though.
PCI means PCI-Compliance, in the most regard, it is VERY strict but 95% of dealers refuse to follow it's laws and conduct.
Whooosh. That was the sound of you failing joke compliance. The article never explains what PCI is, so to the average reader it could be Peripheral Component Interconnect, the Presbyterian Church in Ireland, the Pharmacy Council of India or maybe, just maybe Payment Card Industry.
The title "Hacking POS" should give a hint to the intended audience who would (or dare I say should) not confuse POS (Point-of-Sale) with you know what.
Hacking, in particular when discussed on a news-for-nerds site, should evoke the notion of a broad topic known as "computer security". That should lead the intended average reader (or one with google-fu skills) to know (or find) that POS stands for Point-of-Sale. 2+2=4 and the intended average reader (or one with sufficient technical acumen, like the one
Re: (Score:2)
Never, ever make your reader search for information. If you use acronyms, define what it is the first time you use it, such as "Point of sale (POS)".
What's better: having the author take two more seconds to do that, or let your thousands or readers search for the information?
Re: (Score:2)
Windows POSReady = A version of Windows meant for a POS system (usually XP or 7).
PCI = Security guidelines that are supposed to protect debit/credit card information.
Re: (Score:1)
POS = Any point of sale (eg. cash register) system.
And in terms of current implementations, there is the more well-known usage of these letters: POS=Piece of S***
Re: (Score:2)
You forgot the other definition of POS, the one that always pops into my mind before the others :)
Re: (Score:2)
POS = Any point of sale (eg. cash register) system.
Windows POSReady = A version of Windows meant for a POS system (usually XP or 7).
PCI = Security guidelines that are supposed to protect debit/credit card information.
Having dealt with a lot of POS systems including Windows POSReady, the other definition, Piece Of Shit is also applicable.
In my experience, you dont need to bother trying to crack a 6 digit code on a credit card in order to get the number, most stores dont bother following any security guidelines, let alone strict ones like PCI (Payment Card Industry, not Peripheral Component Interconnect).
The worst I've seen is PCEFTPOS on an unpatched Windows XP machine (this was in 2012, they're probably still runn
Re: (Score:2)
I know one POS system used by a big box home hardware and home remodeling corporation was using TSO while I was shoulder surfing the clerk. Which I found interesting as I assume it must be running a Z series on the back end. Since TSO and Z series information is very specialized I assume few would actually know how to crack it. Security through obscurity. Others from the UI I have seen looked like MS UI or a Gnome variants.
Open-source tool to read PIN and Chip (Score:1)
It used to be quite a 'closed' field, but there are now more and more open source tools to 'hack' and 'explore' payment systems.
Get a card reader and check out cardpeek [pannetrat.com]: a tool that will read every detail of a PIN and Chip card. It also works with NFC cards, work on Linux like a charm (and Win7 and OsX).
Re: (Score:2)
EMV doesn't require NFC. I'm unaware of any EMV implemented using NFC, in fact. EMV uses a chip that requires physical contacts.
And EMV terminals can be circumvented with a shim, fooling the acquirer into treating the transaction as genuine while faking the chip into offline mode. Overly simplified, but the result is the same.
And as is pointed out elsewhere on this thread, EMV solved nothing for internet transactions, all card -not-present environments. And once the data is on the merchant or acquirer sys
i'm so *old* i recall when hacking meant... (Score:2)
...making something functional with less than optimum resources (cf MacGyver, bodge-up, gerryrig, uzw). which preceded the notion of "one who gains unauthorized access to computers" by oh... perhaps a whole !@#n seven years.
here's another current worthy tome which supports that earlier notion, and thus causes undue confusion: Hacker's Delight [hackersdelight.org], which gets down to the hardware bits with some amazing cycle optimizations
Re: (Score:2)
PCI Standards... heh. (Score:1)
If the NSA hadn't broken encryption while still in the box, there would be less low hanging fruit. If the POS industry didn't hold such high expectation of a $10-$15/HR techs, the deployments would be much more secure. I don't believe there has been enough attention placed upon the banks and the processors, and for the most part the one's that can actually afford to upgrade their systems a couple times a year, instead they push the cost to the end user and laugh all the way back to their office while the
Re: (Score:1)
Take a close look at the RSA not so random number generator while understanding these are very thorough people acting under orders, and not just FBI type orders as there is a distinct difference between DOD and DOJ, drink in what happened to Phillip Zimmerman with the FBI and PGP, realize we ants are not allowed to have encryption unless it is broken. It hasn't worked out so well for bank cards, but it would seem it has done wonders for the black budget. There really isn't any way around it with the fear
Re: (Score:2)
PCI isn't the be-all and end-all, but I have to say that it's a set of metrics that a least prevent stores from assuming that everyone else is storing their PAN's in plaintext, etc.
I consider it like restaurant health inspections. Doesn't mean the restaurant can't poison you, but a lot less food poisoning occurs because of it.
Security isn't always worth it... (Score:2)
I'm all in favor of security, but before we rip stores for bad security, I think we need to understand that many stores don't spend a fortune on security for the same reason we don't hire armed guards for our home. The cost simply isn't worth the decreased risk. And quite frankly, if we received a $100 bill for every credit card we owned to pay for that security, people would have a fit.
We'll get high security once the public is willing to pay for it, and not a moment sooner. Until that point, stores wil
Very Easy (Score:2)
Re: (Score:2)
I agree with you.
The issue thought is that these ‘purpose designed networks’ can at limited times, be created with a small set of requirements (purposes).
But in large e-commerce settings, with multiple suppliers, inputs, etc., the purpose expands significantly, with complexity that quickly becomes unmanageable; and quickly insecure.
Re: (Score:2)
An odd angle to why Target got hit with such a huge data loss breach was the fact that they were getting too nosy about their custom
Re: (Score:2)
Excellent points.
When it comes to targeted advertising and big data analytics, seems like security will always get the short shrift.
Torching the house rather than lighting a candle.. (Score:1)
Re: (Score:2)
Interesting point.
But that is the same admonition was used when the first ‘Hacking Exposed’ book came out. Which is similar to the argument that terrorists will use strong encryption.
Ultimately, it simply makes it that the white hats should read these books more of an imperative.
Full list of the series here:
http://www.amazon.com/s/?_enco... [amazon.com]
Re: (Score:2)
>> how many scammers will use this as a guidebook for looting
Probably zero.
>> Gomzin shows that credit card numbers are rather predictable in that their number space is in truth rather small, even though they may be 15-19 digits in length. This is due to the fact that PCI allows the first 6 and last 4 digits to be exposed in plaintext, so it's only 6 digits that need to be guessed. This enables a relatively easy brute force attack, and even easier if rainbow tables are used.
Yeah...try brute for