As I predicted in previous posts, the wave of card data breaches is growing and sweeping away everything (meaning, above all things, PCI-compliant merchants) in its path. Brian Krebs stated in his blog that the point of sale software, which is created by Signature Systems and used by Jimmy John's and other retailers for payment processing, was not PCI (PA-DSS) compliant as its formal validation expired in 2013. This fact can be a good excuse for PCI Security Council to blaim the merchants again and say that the breach was made possible because they were not PCI compliant. We all know this isn't true, and PCI compliance wouldn't help them to avoid the breach, as it didn't already for many others. In most cases, including those recent breaches, the attack is done using RAM scraping, aka memory parsing - a special technique that exploits the payment application vulnerability which cannot be mitigated by PCI standards.

My first take on Apple Pay security in this article published by VentureBeat.

Apple Pay is looking pretty attractive so far from a security perspective. But it’s tokens could be cause for concern...

The carding industry is constantly evolving and developing new methods of cashing out the stolen credit card data. In addition to standard ways described in my book Hacking Point of Sale, there are a couple of new techniques. Perhaps, those methods are  not exactly new but just recently came to my attention. 

1. Using gift card as a "new body" for stolen credit card (this information is received from the source working for one of the major payment brands).
The stolen track data is encoded into the plastic decorated as a gift card (or even original gift card is re-encoded with stolen track data). Most gift cards do not have any customer identification information and physical protection features of credit cards, so there is no way for store attendant to authenticate the cardholder. At the same time, gift cards are processed automatically by most point of sale systems in a way similar to credit cards. 

2. Using online affiliate programs to make purchases and earn commissions.
The stolen cards are used to purchase goods through online affiliate programs which are intended to sell various pills etc. The cashing out effect is achieved by carders working as affiliates and earning commissions on each such purchase made through their affiliate account.

This is good article comparing Apple Pay and digital wallet cards.
I had two comments, though.

1. There is another startup (in addition to Coin) that tries to capitalize on reanimation of dying magnetic stripe technology - Loop. I have published an article about Coin and Loop in VentureBeat:  

2. I have PayPal debit card (by the way, it is MasterCard, not Discover). Now, as soon as I get my new shiny iPhone 6, theoretically, I can add this card to Passbook and pay with my PayPal account through Apple Pay! Wouldn't it be cool and funny? However, I don't think Apple will allow this because it looks like they are going to control which issuers are participating. I don't think that this is the case with Coin and Loop - they would love to allow as much cards and issuers as possible. Not that I like the concept of Coin and Loop - I am against any attempts to reanimate the dying magnetic stripe technology (by the way, Apple Pay is also based on magnetic stripe cards, but it does it in elegant form, as always). So the important point is that Apple Pay can be limited according to Apple preferences. We have to have a common standard that would be based on Apple Pay technology.

The phrase "devalue the data" was used several times by new PCI SSC General Manager Steve Orfei in his keynote today during the PCI Community meeting in Orlando. I like the term - data devaluation - and that's obviously the right direction. It means that payment transaction data, even if intercepted and stolen by hackers, cannot be useful for processing new transactions. In payment card industry it can be achieved by using different technologies and their combinations: EMV, P2PE, and Tokenization. But it took the payment industry several decades to realize that the data must be devalued, and it will take many more years to fully implement such devaluation. Unlike PCI, Bitcoin and other crypto currencies are designed in a way that transaction data has not value by definition. So is it worth making efforts and trying to patch the old technologies in order to achieve the same level of security that new technologies already provide out of the box? 

I am getting a lot of questions about my opinion on Apple Pay which was announced this morning along with iPhone 6 and Apple Watch. So here are some first thoughts, very briefly. 

Regarding the technology - unfortunately, there is no much technical details released by Apple so far, so a serious thorough assessment is impossible right now. However, it looks like Apple Pay uses some form of tokenization, which means that breaches like Target or Home Depot will be impossible as merchants will not be exposed to the sensitive cardholder data. A token, which is generated by the device when you add new payment card to the Passbook, will be stored in the secure element and used instead of actual magnetic track of the card. So far so good.

As far as possible effect on the payment industry - it's still unclear whether this system is open or closed. As many Apple things it can be proprietary, so if others can only imitate it rather than follow, its mainstream acceptance can be limited. NFC is open standard, but NFC is just a communication part of it. There are recent precedents, however, when Apple created a relatively open standard in retail - iBeacon. 

And finally, like many things made by Apple - it's simple, elegant, and convenient.

Anyway, I am going to try it as soon as I get my iPhone 6.

It becomes more and more difficult to comment on card data breaches. The news about another attack on US merchant – similar to recent Home Depot card data breach -- are coming almost every day. The scenarios of attacks -- as well as the tools used to penetrate the merchant network and retrieve the sensitive cardholder data -- are always the same or very similar. The security solutions -- which could potentially prevent those breaches but have never been tried -- also remain the same. And nothing changes, so there is no much to talk about...

When you swipe your card in retail store anywhere in the US, the possibility to lose your money today is higher than when you gamble in Las Vegas. Unlike casino, however, in many cases, eventually you can get your money back (I can't tell the same about the merchant though). It's like a total loss insurance play: you recover your money (at least, partially) but never get your beloved car back. And so there are things -- including consumers' trust and confidence in card payment system -- that will never return to the original state.
   
So what's next - are we going to move back to cash? I doubt it. Plastic cards are too convenient to be abandoned. For many people paying with credit card became a habit so strong that it would require a treatment similar to the one necessary to quit smoking. I don't use credit cards (whenever it’s possible) because I think the idea of paying with credit for day-to-day things is totally wrong. But I still use debit card everywhere. And it is much more convenient than constantly taking care of carrying significant amount of cash which is necessary for daily life activities.

So it looks like finding solution for payment card security problem is inevitable. EMV (chip cards) and Bitcoin (crypto currency) technologies partially solve this problem for brick-and-mortar and online transactions respectively. Since EMV cards are still vulnerable when used for online purchases (and sometimes in physical store as well!), and Bitcoin currently is not suitable to be used in brick-and-mortar merchants, there is no ultimate solution. Perhaps, we should wait until next emerging technology that would combine all the good features of EMV and Bitcoin while being as convenient as plastic cards.