Don't Overestimate EMV Protections, Underestimate Card Thief Sophistication

Even in the wake of massive breaches and losses from credit card merchants and processors, many security practitioners today still hold a lot of misconceptions about how credit card processing systems and protection mechanisms work. Next month at Black Hat, one researcher plans to hold a crash course for security professionals that debunks some commonly held fallacies and clears up why card thieves have been so successful even as card security awareness has risen in the era of PCI.

"I'd say the biggest misconceptions in the security community [are] an overestimation of the protection that EMV provides, an underestimation of the skill of the attackers and a lack of understanding about how many systems that card data passes through when they're processed that are vulnerable to interception of data," says Lucas Zaichkowsky, enterprise defense architect for the forensics and security firm AccessData, who will lead a talk on point-of-sale (POS) architecture and security.

In particular, Zaichkowsky will dedicate a significant chunk of time in his briefing discussing EMV chips, the successor to the traditional magnetic stripes; EMV was introduced in recent years to lower the rate of card fraud.

"Everyone talks about how EMV will save the day, but the truth is that the primary purpose of EMV is just to make it so that the card cannot be cloned. When you do an EMV read of a card on a POS terminal, it will pass your card number and expiration in plain text, your name in plain text," he says, "and even the track two data is almost exactly the same as a mag stripe card, with the only difference being that three-digit CVV code in the middle of the track data."

As he explains, that's not a flaw or an exploitation, it is just how it works by design. To demonstrate this, he'll plan on doing live demos during his talk of magnetic card swipes compared to EMV card swipes and how they look on the back end.

"This is not some kind of big vulnerability that no one knows about," he says. "The proponents of EMV either don't understand it or they're some special interest group that's pushing it through because that's their job and they just kind of skirt around telling people that by the way, you should encrypt this stuff because it has the card number and expiration data in plain text."

He'll also offer up some visual charts of how the data flow works, from USB-powered card reader to POS terminal, to back-end store servers, to processing company systems and HSM modules, to card company systems and finally to banks, and all the way back through the chain again that data must flow through in order for a card to be processed for any given transaction. Through that explanation, he'll point out the weakest points in the ecosystem and sometimes even some strong points that security professionals may not be aware of. For example security pros may not know that PIN pad devices are actually extremely secure on the merchant side because that data is strongly encrypted and the keys are not stored with the merchant but instead are in a hardware security module (HSM) held by the card processor.

However, if attackers can find a way to attack that card processor's HSM, they may hold keys for all of the merchant PIN data held by the processor.

And that's often the exact tack that many sophisticated card-thieving criminals will take, illustrating one of Zaichkowsky's other big points of the briefing. A good example of how this can happen is the breach at RBS Worldpay, where attackers brute-force attacked the HSM there to gain access to PINs processed for customers.

"These criminals understand all this stuff and how these payment system components interoperate," he says. "They get how these HSMs are designed, they'll get the manuals for these components, read them, program to them and they understand point-of-sale environments very well. They're highly skilled and they know what they're doing."