MasterCard, Visa Warn of Processor Breach
krebsonsecurity.com
krebsonsecurity.com
Just in the past couple of months, we've seen online criminals try to:
* Run money laundering schemes by posting fake items for sale on a marketplace, and "purchasing" their own item using a stolen credit card.
* Create fake accounts from different browsers to get tons of free machine resources, which they then use for more nefarious purposes.
* Rent a bot net to run a distributed fraud ring from many different machines, in a way that's almost undetectable.
* fool SMS verification by setting up a Twilio server to make it look like they have a U.S. phone number.
You can imagine how fun it must be to outsmart them. :-)
By the way, if any of you are running online stores or marketplaces, and seeing a sudden spike of fraud or chargebacks from this breach, feel free to ping me (brandon@siftscience.com). We may be able to help.
To argue that $20 million is a small amount relative to Visa's total transaction volume, and consequently too little (!) as an arbitrary barrier to entry for startup companies, is puzzling. I don't know of any license fees that are calculated based on what the largest market participant could afford to pay as a percentage of revenue.
Different people have different value schemes. For instance, personal liberty is far more important to me than airport security. But in my value scheme, which I think is probably widely shared, the safety of consumer financial data is more important than whether it costs $500,000 or $20,000,000 to operate a payment processor at scale.
(I don't, for what it's worth, really believe that all new market entrants to payment processing have to pay 8 figure sums to launch).
Also: in case anyone's wondering, I've never worked for or with Greenspan, or even met him in person. I assume the history he's referring to is on HN.
Just to set the stage here, though: you're someone who wants it to be cheaper and easier to start payment processors, and I'm someone who gets paid to find vulnerabilities in complicated applications. Before you write a lot of paragraphs, know that I'm going to drive into specifics, and that I'm decently familiar with data security issues at transaction processors.
Why is chip-and-pin (which from what I understand would render ineffective this type of breach - track 1 + 2 card data) already common in Europe, but not the U.S.? [sincere question]
(It's funny that this comment was downmodded to grey on a thread about a breach at a giant payment processor who had one of the industry's best known firms as their QSA).
So why suppose that an arbitrary regulatory cost, whether a nominal fee or a more productive expense, would enhance security?
How do you strike a balance between that level of security and the current horrible (I think everyone realizes PCI is horrible) industry self-regulation?
a) PCI is lame.
b) Auditors audit according to lame PCI standards
c) The entire credit card payment scheme is insecure and broken
d) Larger companies (payment processors, Citi, or Sony PSN) make juicier targets
If you need $20mm to start, you're not likely to bootstrap your way into building a nationwide payment network that you run on rented VPS, but I'd argue that might not be such a bad thing.
China is said to be a "cash society". Quite interesting that (if I heard correctly) their biggest credit/debit card and online payment companies don't offer any protection to users - the biggest challenge payment processors face in the U.S.
If they know the processor was compromised what is the point of finding a common point of purchase? Is the common point of purchase where the criminals are extracting the money?
So they know who to notify. It isn't every US card holder that is at risk, so they want to know who is. The Gartner article says this:
> From what I hear, the breach involves a taxi and parking garage company in the New York City area so if you’ve paid a NYC cab in the last few months with your credit or debit card – be sure to check your card statements for possible fraud.
I think this blog post might have something to do with it. In it, she mentions that "she heard" that the breach had to do with taxi's and/or a parking garage in NYC.
The only thing I can think of is if bitcoin becomes really popular and lots of people use hosted wallets over the web. This will always have a certain amount of risk, after all who thought linode would get hacked? (seemingly from the inside).
The solution will probably be some kind of insurance, much like how gold is secured today. I can envision bitcoin savings wallets(which don't need to be online) being put into some kind of uber secure virtual vault.