not_me · HackerTrans

Also as an addendum; the thought process about hardware reversing is not entirely correct. You will run into things like can't build a device that can sniff that fast without a substantial budget; how much is that microscope? That just have no real parallel in software

not_me

15 anni fadiscuss

I think you sorta misunderstood, and but also possibly hold some misguided beliefs (like i dont?).

The first thing is, there's a lot of things Square could do, and we could both live on the moon eventually also. Their current implementation is a skimmer with all of the logic and safety in the software with all the guarantees of PCI network security beyond that (lol, i bet its salesforce or ec2). On Verifone's end, it's not like we're talking some software-based encraption. Think hardware based asset tags to compliment client certs. Surely it's self-evident that the ease of obtaining what at the moment at best could be a client certificate from a phone and recovering the information from a tamper-resistant device that goes dark if you take it offline too long (rendering the information useless). If they took their device and made it less like a mouse and more like something that tried to tunnel through the stupidest medium ever, I could live with it a little more and see the 'they are stupidly insecure' argument as fud.

Second, you realize it took 1 person about a week to reverse, document and develop the PoC for blocking skype (me) and not much longer for a crypto-library from it (accuvant ryan)? A year is a vast over-estimate and im pretty slow at it.

If the overall debate pertains to whether verifone did this right or not, I'd agree with you. Although, I have to admit cheering for them with their 'and we will prove it with an app@#@!' part-- if they were consultants they wouldve gotten invited to speak at blackhat.

If I had to take a stab at it, after looking at square a little bit. I'd say that if they made the honest argument, Square would try to throw lawyers at them. The honest argument is, 'have you looked at these guys? they're bordering on a criminal-enterprise-by-design, albeit rubber stamped by PCI'. I mean seriously? a point and a half more if I don't have the card and want to enter it on your website instead?

(Also the hubris in their research & disclosure policy made my blood boil)

not_me

15 anni fadiscuss

Thomas,

You're sorta not understanding what goes on in a verifone device. I would advise actually constructing and inserting a rogue verifone PED, it is non-trivial.

First, understand that when you swipe your card at mcdonalds, you're not trusting the guy behind the counter, the manager, the district or anyone else physically present or even mcdonalds. you're not trusting their malware laiden office computers, nor their network, et cetera. You're trusting the terminal. And the terminals, depending on model and service/etc, all have cryptographic MAC addresses "that are burned in" (lol), and they're externally by verifone. So first hurdle is that you can't just get a job at mcdonalds and ebay your way to a better life, when you switch out the device, it gets detected and blocked, and i imagine once the burger flippers figure out that its not broken and someone tried to own them, they pull the cameras, et cetera.

Next, the device has a myriad of tamper-detection qualities which make it non-trivial to get into and still have the damned thing still function. This is again, dependent on which device is in play and so on-- getting in successfully obviously can be done, but you're getting sorta specialized. Next, the card details/pin/etc all get encrypted at the device never to see plain-text again until it's "safely in the cloud".

That's the theory anyways, there's some problems but it's not that joe bubblegum is gonna download an 'app' and extract my credit card details from his employers iphone. If pressed for an opinion, I'd say the entire idea of getting people used to paying by swiping their cards through some guys phone is maligned and going to be horribly problematic. This is sorta like SSL, there's another maligned trust heirarchy that exists and makes sense sorta.

So, basically my point is, verifone is not entirely incorrect here. It's not that "a little white card skimmer dongle is trivial to construct" or any other hyperbole. A PED or other input device that I can dump my card info from is a problem.

There's another entire trust relationship going on here which everyone seems to skip: the most common use-case of dealing with a representative of a third-party who is less trustworthy than the third-party itself ('Alice meet George, embassary of Bob, don't mind the collasped veins, he's legit!').

comments