Subject: Credit card sniffing and yellow jackets

From: "Nadav Har'El" <[email-masked]>
Date: Sun, 25 Dec 2005 14:01:22 +0200

In his book "A Devil Chaplain", Richard Dawkins recounts in one of the
chapters a TV interview of a scientist researching some controversial matter
(I think it was cloning).
To "counter" the scientist's "scientific" views, the interviewer invited
a priest and a rabbi to explain the religious view. Dawkins laments this,
and says that unlike the scientist who proved his connection to the discussed
subject (in years of research), the priest and the rabbi had no expertise
on this subject. If anything, the interviewer should have looked for someone
who has been researching moral issues surrounding cloning; But knowledge in
holy scriptures doesn't mean you know anything about cloning.

Unfortunately, there's a similar phenomemon in the world of security, both
of computer systems and real-world security: Whenever somebody states that
a given measure or rule is done "for the sake of security", people just
accept this edict as correct, not questioning for a moment whether the
person who made this statement actually knows what he's talking about,
or whether he has actually done any research about the implications of his
idea.

I'm sure you all saw the latest example of this phenomenon, straight from
the Israeli government: the yellow jackets that we now (from January 2006)
all have to put in our car, supposedly for our own security.
How does this measure give us more security? What's the point of wearing a
yellow jacket also in broad daylight? Why limit yellow jackets only to car
owners and not to padestrians and bicyclists? Why do I need the jacket if
I'll just use my cellphone to call the leasing company anyway and I don't
know how to fix any car problem on my own? Nobody in the government cares.
Someone said it will promote security, so this law passed. Nobody cares if
it will actually promote security, or just cause a few manufacturers to get
rich, and all Israeli's glove compartments to suddenly be unsuable because
of the jacket in them...

A classic example of damaging security through idiotic security measures is
the reason why credit card number sniffing is so easy:

"Bad Guys" have been trying for years to steal credit-card numbers from
unsuspecting people giving them away on the Internet. Originally, the bad
guys tried to capture unencrypted numbers as they pass through the internet,
but now that SSL is prevalent, they moved to worms that capture key stokes
to look for credit card numbers.
But how do the bad guys recognize credit card numbers? After all, a series
of digits can easily be something else, like a phone number, a series of
spreadsheet entries, and so on? Well, it's easy, thanks to the credit card
companies! Credit card numbers have a check-digit (sifrat bikoret), which
makes it trivial to recognize a niddle in haystack - a credit card number in
a pile of other random digits...
And why do credit card numbers have a check digit in the first place?
You guessed it - "for the sake of security". Some "expert" in the credit
card company said, long ago, that it is needed to prevent people from
inventing real-looking credit-card numbers; After all, criminals can't
calculate these check-digits in their head! Forget the fact that criminals
always had a paper-and-pen or a slide-rule to their disposal, and today they
have a computer that can calculate these check digits in microseconds,
who cares. The credit card CEO covered his ass by listening to the "security
experts" and the "security experts" covered their asses by warning about
every conceivable attack, whether likely or not.

And don't even get me started on issues surrounding passwords, and rules
on which passwords are acceptible and how often to change them, which have
been causing much more harm than good...

Damn the "cover your ass" syndrome, making people look for "experts" and
listening to them, even if these experts don't know anything about the
subjects they are supposedly experts in :(

-- 
Nadav Har'El                        |      Sunday, Dec 25 2005, 24 Kislev 5766
[email-masked]             |-----------------------------------------
Phone +972-523-790466, ICQ 13349191 |The two rules for success are: 1. Never
http://nadav.harel.org.il           |tell them everything you know.

---

From: "ik_5" <[email-masked]>
Date: Sun, 25 Dec 2005 13:36:02 -0000

> been causing much more harm than good...

What about Man in the Middle attacks ? There "evil" attacker can
pretend to be the web site, and still your information ?

It's much easier to write rules to the file hosts (like www.google.com
will point to www.msn.com) then to start calculating some credit card
numbers.

Or to find some Cross Site scripting or SQL Injection on the web site,
and get a list of the credit cards, or just making the data sent to a
different location ...

There are so many ways to get credit card numbers.
Here is one example: http://blogs.securiteam.com/index.php/archives/22 :)

There was on CSI once an episode of a person that placed camera next
to ATM and recorded key strokes of the secret number and other useful
information. 

And the list goes on...

BTW there is a scheme that causes people to give their credit cards
and bank account numbers (in the process) by giving you for "free" a
CD, and all they need is your credit card to make sure you will not
get it twice (or something like that).

> nyh@m...             |-----------------------------------------

---

From: "Nadav Har'El" <[email-masked]>
Date: Sun, 25 Dec 2005 15:52:37 +0200

> and get a list of the credit cards, or just making the data sent to a

You're not contradicting anything that I said...
I didn't say that there aren't *other* ways to steal your credit card number.

I just said that the credit card companies made one particular attack (sniffing
keystrokes using a worm) very easy, when the particular feature that makes
this easy was actually designed "for security's sake". I was trying to explain
how not everything that every idiot invents "for security's sake" actually
improves security.

By the way, the benefit of using a worm is that it's almost impossible to
trace it back to the person who started the worm. If you run a spoofed site,
or do a physical scam (like put a camera on an ATM), it's easier to catch
the crook.

-- 
Nadav Har'El                        |      Sunday, Dec 25 2005, 24 Kislev 5766
[email-masked]             |-----------------------------------------
Phone +972-523-790466, ICQ 13349191 |Tea or coffee? Coffee, without cream. It
http://nadav.harel.org.il           |will be without milk, we have no cream.

---

From: Eran Tromer <[email-masked]>
Date: Sun, 25 Dec 2005 17:08:08 +0200

Hi Nadav,

You seem to be confusing several few different meaning of "security".
The examples you gave indeed don't quality as "preventing determined
malicious people from doing harm", but certainly qualify as "reducing
the chance of harm". To wit:

On 2005-12-25 14:01, Nadav Har'El wrote:
> yellow jacket also in broad daylight? 

It quite obvious of using a strong and easily-recognizable visual queue
will help drivers recognize pedestrians in an unexpected place (such as
the middle of a highway). The question is, as always: to what degree,
and how much does it cost (in terms of expenses, inconvenience etc.).
I have no idea if the tradeoff is worthwhile, but it doesn't seem as
ludicrous as you put it.

> Why limit yellow jackets only to car owners and not to padestrians and
> bicyclists?

For pedestrians, the cost (in expenses and especially inconvenience) is
much higher. Bicyclists are also more sensitive to extra baggage, and
when dismounted are less likely than car owners to walk around on the
road or very close to its border, or to step out from behind large
visibility obstacles (such as a car with its engine hood open).

> know how to fix any car problem on my own? 

You're still likely to hang *around* the car, aren't you?

> Someone said it will promote security, so this law passed. 

Just wondering -- how do you know that someone didn't based his saying
on proper evidence or analysis (unlikely as that is)?

> You guessed it - "for the sake of security". 

Sure, it does nothing to help against the determined thief, but does
help against the casual teenager trying to get a free pizza order. It
also helps against non-malicious communication errors (typos, illegible
handwriting, verbal misunderstandings etc.). Isn't that worth something,
especially in an off-line world? And what exactly is the cost? The
effect on key-logging is negligible, since credit card numbers easily
recognized anyway based on other criteria (how often does the typical
user type in a 16-digit number, especially with one of the few common
prefixes). Not to mention that the decision to use a check digit was
taken long before key logging was an imaginable issue, and many legacy
systems will break if you change it now.

> been causing much more harm than good...

Surely overdoing things has taken us past the point of optimality, but
overall more harm than good? I disagree. Despite the horrible practices
people use to cope with current password requirements, you can't get
worse than the previously common practice of using "123" (or equivalent)
for all your passwords.

Also, there's a prisoners' dilemma at work here: the security of each
service, by itself, usually *is* improved by reasonable strengthening of
the password requirements. It's the overwhelming *combined* requirements
of all the services a typical person uses that's causing most of the ill
effects. Each firm 's security expert tries to make the rational
economical decision, in the absence of a way to coordinate with other
firms (well, Microsoft tried that...).

> subjects they are supposedly experts in :(

None of your examples demonstrates that.

The truth of the matter is security is hard - it requires evaluating all
risks, present and future, and all costs, presents and future, and then
balancing between the two. Sure, organizations often make dumb decisions
and err on the side of ass cov^H^H^H^H^H^H^Hsafety, but even the best
expert will often make well-considered but retrospectively wrong
choices, and even a good choice may look silly if you're not aware of
all considerations. So it's fine, well and often justified to criticize,
but assuming by default that the decisions were taken by morons won't
get you far in terms of insightful criticism.

  Eran

---

From: "Nadav Har'El" <[email-masked]>
Date: Sun, 25 Dec 2005 17:44:38 +0200

> I have no idea if the tradeoff is worthwhile, but it doesn't seem as

Indeed, it's always a question of tradeoff. For example, imagine that this
new law will somehow save the life of one person a year, but will cost
50 million shekels to implements (just invented a number that makes sense).
Just imagine how many lives you could have saved with 50 million shekels
in more efficient ways - by funding more medicines, funding more police
presense, funding battered-wives homes, funding "witness protection programs",
or who knows what.

So these so-called "security measures" always solve 0.001% of the security
program. The question is what new problems they cause, and what you could
have done instead that would be far more efficient.

> on proper evidence or analysis (unlikely as that is)?

I have no evidence that they don't have evidence. But I find it highly
unlikely. The number of people getting killed every year from this specific
scenario (being hit by a passing car) is (according to what I see on the
news) relatively small, say 5 per year. In most of these situations the
problem wasn't that the person wasn't visible (e.g., because of the car
itself was very visible) but rather that he "jumped" into the road to quickly
or the driver wasn't paying attention (e.g., sometimes the driver hit the
entire standing car, not just the passenger). So I can't believe this will save
more than 1-2 people a year. Which sounds great ("he who saves one life..."),
but when you consider other things you could have done with the money, or
other ways people can watch out from being run over while on the side of
the rode, it doesn't sund so smart any more.

> especially in an off-line world? And what exactly is the cost? The

Such an "off-line world" doesn't exist any more, and hasn't existed for a
very very long time. Sellers always check the validity of the number they are
given immediately, by connecting to the credit card companies. Those that
don't make sure they don't have any errors by using "gihutz" (copying the
credit card, and not just asking for a number).

-- 
Nadav Har'El                        |      Sunday, Dec 25 2005, 24 Kislev 5766
[email-masked]             |-----------------------------------------
Phone +972-523-790466, ICQ 13349191 |And now for some feedback:
http://nadav.harel.org.il           |EEEEEEEEEEEEEEEEEEEEEEEEEEE

---

From: Tal Kelrich <[email-masked]>
Date: Sun, 25 Dec 2005 14:37:28 +0200

On Sun, 25 Dec 2005 14:01:22 +0200
"Nadav Har'El" <[email-masked]> wrote:

> Well, it's easy, thanks to
> the credit card companies! Credit card numbers have a check-digit
> (sifrat bikoret), which makes it trivial to recognize a niddle in
> haystack - a credit card number in a pile of other random digits...
> You guessed it - "for the sake of security". Some "expert" in the

Those are actually useful for checking the credit card number before
running a transaction against the credit card company.

-- 
Tal Kelrich
PGP fingerprint: 3EDF FCC5 60BB 4729 AB2F  CAE6 FEC1 9AAC 12B9 AA69
Key Available at: http://www.hasturkun.com/pub.txt
----
'Course, that doesn't work when 'a' contains parentheses. -- Larry Wall
in <[email-masked]> ----

---

From: Arik Baratz <[email-masked]>
Date: Sun, 25 Dec 2005 14:25:28 -0800

> a pile of other random digits...

This is not a security measure... it's called a check digit and it's
part of a well-known algorithm which your Israeli ID is also
verifiable with, called 'mod 10' or something. The algorithm is very
simple:

1. Take all the digits of the number
2. Multiply every odd digit by 2
3. Sum the digits (after multiplication)

If it's divisible by 10, the number is correct. Try it on your Israeli
ID, and if it doesn't work prepend a 0 to it and try again.

This was meant to prevent some of the most common KEYBOARD INPUT
mistakes, not to help security in any way. Originally credit cards
were imprinted on paper, and someone had to take all those paper slips
and punch the numbers into large IBM machines that did the actual
billing. Most common typing mistakes - omitting a digit, transposing
two adjacent digits - are detectable with this system.

-- Arik