IFPI, UK Police, Credit Card Companies Push People To Pirate Music, Rather Than Pay For It

from the did-they-really-do-that? dept

Bizarre move out of the IFPI. It's gleefully announced a new deal, in conjunction with the London Police and Visa and MasterCard to cut off credit card services to online music stores who the IFPI accuses of selling infringing MP3s. This is really targeting sites like MP3Fiesta, which is sort of a modern version of Allofmp3.com. Of course, what they seem to be missing is that both of these sites were examples of people, who would otherwise likely be downloading totally unauthorized versions, being willing to pay for MP3s at a much more reasonable price. What I never understood was why the music industry never realized that these sites actually showed a business model that worked. Tons of people were happy to pay for the music when the prices seemed much more reasonable. What these services really showed was how much the industry has artificially inflated the price of music.

But, of course, in cutting off credit cards to those sites, two simple things are likely to happen in response: first, those sites will simply find alternative payment means. That may still limit some, but it hardly stops these sites from existing. But, more importantly, if people can't get music at these prices, it seems a lot more likely that they'll shift to totally free options, rather than go back to paying $0.99 per song (or more!). So, effectively, all this move really does is drive more people to stop paying for music. Is that what the record labels pay the IFPI to do these days?

Filed Under: credit cards, liability, piracy, uk
Companies: ifpi, mastercard, visa

Financial Industry Favors Security Through Obscurity; Demands Cambridge Censor Paper Detailing Weaknesses

from the that'll-work dept

The chip and PIN system that is used for financial transactions throughout large parts of Europe and Canada (still surprised that it hasn't really come to the US...) has numerous vulnerabilities that have been detailed over the years. In the past year alone, there have been a number of problems and weaknesses highlighted with the system. Apparently, the financial industry isn't happy about this, but rather than fixing the problems it's reacting in the usual way: going after the messenger. Slashdot points us to the news that the UK Cards Association -- a trade group representing banks and credit card companies -- has asked Cambridge researchers to remove a thesis which highlights some of the vulnerabilities.

You can see the demand letter embedded below, but it's fairly amusing. The letter claims that the publication (which you can read about on the author's (Omar Choudary) website, where he describes a device for intercepting, monitoring and modifying such data) "oversteps the boundaries of what constitutes responsible disclosure." In other words, they're not happy about it, so Cambridge should force the student to shut up. Of course, what's amusing is that after chiding Cambridge University for such irresponsible publishing, the Association then tries to downplay the significance of the whole thing anyway:

Fortunately, the type of attack described in the research is difficult to undertake and is unlikely to carry a sufficient risk-reward ratio to interest genuine fraudsters. And, in the unlikely event that such an attack were to take place in the UK marketplace, the banking industry's fraud prevention systems would be able to detect when such an attack had happened.

So why take it down?

Nevertheless, publication of such details could encourage nuisance attacks on the payment card systems, undermine public confidence in them and/or give organised crime access to material they might be able to develop further.

This, of course, is the very definition of an organization that thinks security through obscurity works. The thing is, if these students figured out these problems, it's pretty damn likely that organized crime already had figured out the same thing and probably have already developed the idea much further. Pretending otherwise is simply naive.

The UK Cards Association then goes on to lecture Cambridge University on its standards of what should be considered publishable, and worries about "future research." The response from Ross Anderson at Cambridge (linked above) is pretty straightforward, basically saying, yes, you absolutely should be worried about it:

The bankers also fret that "future research, which may potentially be more damaging, may also be published in this level of detail". Indeed. Omar is one of my coauthors on a new Chip-and-PIN paper that's been accepted for Financial Cryptography 2011. So here is our Christmas present to the bankers: it means you all have to come to this conference to hear what we have to say!

A note to the financial industry: perhaps instead of worrying about student papers, you should worry about a system that is vulnerable to so many problems.

Filed Under: banks, cambridge, chip and pin, credit cards, obscurity, security, uk

Company That Had The Largest Ever Credit Card Data Breach... Apparently Breached Again [Update]

from the hits-you-in-the-heartland dept

Remember Heartland Payment Systems? It's the giant credit card clearinghouse that was involved in the largest ever security breach in terms of the number of credit card numbers exposed. They were successfully targeted by the same guys who had also set the previous record for largest credit card data breach, so you could question whether the issue was just a sophisticated group of hackers or poor security at Heartland (or, possibly, a combination of both). Either way, it looks like Heartland may still have some issues. Carlo sends over the news that a new security breach has been discovered at a restaurant in Austin, Texas that appears to involve someone hacking into the network between the restaurant and Heartland. It's not yet clear if this goes beyond that one restaurant, but this can't look good for Heartland.

Update: Heartland got in touch to let us know that this appears to be an issue outside of Heartland's system, and that Heartland is not the target of the investigation into the breach. Heartland's press release is basically pointing out that the weakness was with the restaurant's credit card security, not its own.

Filed Under: breach, credit cards, security
Companies: heartland payment systems

The Story Behind The Hackers Behind The Largest Credit Card Number Heist

from the soon-to-be-a-movie? dept

A few years ago, the story broke about how TJX, the corporate parent of a series of retail stores, including TJ Maxx and Marshalls, had suffered a huge data breach, after some hackers had accessed its computer network via an insecure wireless connection at one of the stores. A year and a half later, we wrote about the arrests of some of those involved. The following year, we wrote about another hack, at Heartland Payment Systems, that had the potential to surpass the TJX hack as "the largest ever" in terms of the number of records accessed. It later came to light that both hacks were actually done by the same guys, supposedly led by Albert Gonzalez, a hacker who was actually on the government payroll at the time (after turning informant upon being caught a few years earlier standing in front of an ATM with a handful of fake ATM cards).

Back in March, Gonzalez received a twenty year sentence for the crime -- the longest sentence for "hacking"-related crime in the US. Others involved in the deal have been sentenced to shorter terms recently as well. Now, Danielle Alvarez, from the Miami New Times, points us to an article written by the paper that details the story behind the hacking, and the folks involved -- including the news (which I hadn't seen elsewhere in following this story -- Update: a few people have pointed to this story that Wired had last year, which I had not seen before) that one suspect end up killing himself after hearing of Gonzalez's arrest. It's a long story, but reads like something that will get turned into a movie at some point. Of course, the study plays down the security flaws at the companies, like TJX, which sent unencrypted credit card data over its network (a point Gonzalez's legal team tried to make in properly calculating how much "damage" he did). Still, it's a fascinating story about a group of young hackers, who wanted to "get rich or die trying," and how at least one of them succeeded at the latter.

Filed Under: credit cards, hacking
Companies: heartland payment systems, tjx

NYC Cabbies Who Resisted Credit Card Machines... Now Making More Money Because Of Them

from the resisting-technology dept

A rather common theme around here is how often various industries resist the use of new technologies, fearing that those technologies will somehow harm or even destroy the industry. And yet, before too long, the opposite turns out to be true. Remember how Jack Valenti declared the VCR to be the "Boston Strangler" to the movie industry? Just a few years later, revenue from VCR rentals and sales represented a massive part of the movie business's yearly income. It happens over and over again. The NY Times has a different kind of example of the same basic thing. Two years ago, Mayor Bloomberg in NY pushed for taxis to be required to take credit cards. The cabbies resisted, complaining that it would cause all sorts of problems. They even went on strike over the issue.

And yet, two years later, having easy to use credit card readers in the back of every cab means that more people are taking cabs, because it's easier, and they tend to tip more as well. Part of that is because the machines have "preset" tip suggestions that many riders use, which often result in higher tips than average. While the article still quotes a few angry cab drivers who insist that higher tips aren't true, the reporter was able to review the receipts from a few cabs and found that the average tip was 18%, with the preset tip suggestions being used more than half the time. While it's still early, it certainly seems like this was yet another overreaction to new technology that has actually ended up helping, rather than hurting.

Filed Under: cabs, credit cards, nyc, technology

Looks Like The Guy Who Set The Record For Largest Credit Card Breach Was Breaking His Own Record

from the raising-the-bar dept

Back in January, we noted that it looked like there might be a new winner in the battle to see who was responsible for the largest ever credit card breach. Until that time, the honor had gone to a series of department stores owned by TJX (TJ Maxx, Marshalls, etc.). That involved info on 94 million credit card holders. Not bad. But the newer deal, involving Heartland Payment Systems appeared to effect well over 100 million. Now, you may have seen the news reports this week that have upped that total to 130 million, as part of the announcement of indictments against three individuals for illegally accessing the data. But, what's fascinating is that the one guy in custody, Albert Gonzalez, was already in custody for his role in the TJX hack (along with some other retailers). Oh, and there's also the tidbit about how he was a government informant, handing over info on (you guessed it) the underworld involved in stolen credit card numbers.

Filed Under: albert gonzalez, breach, credit cards
Companies: heartland payment systems, tjx

The Fact That A Credit Card Is Patented Is A Selling Point?

from the what-has-the-world-come-to dept

In the (snail) mail this week I happened to get an ad for the Visa Black Card, which Visa is pitching as "exclusive," though I'm guessing that exclusivity is mostly based on finding enough suckers to pay a $500 annual fee for the card. Anyway, as I was tossing the application into the shredder, one thing caught my eye. The pamphlet cover lists out six marketing bullet points, with the fourth one being that the card is "patent pending." This struck me as odd on a couple of fronts:

1. Why is the fact that it's patent pending a marketing point? I could maybe sorta barely understand it if it was an issued patent. But a pending one? That means next to nothing other than that you spent some money to file a patent application. To me, that means you may have wasted a lot of money -- which could explain the $500 fee.
2. A patent on what? On the idea of a "black card" or some other swanky exclusive credit card? Or on the physical card itself?

So, I did a little Googling, and turned up the following: apparently the patent filing (at the time of this announcement, just a provisional patent filing) is is on the physical card itself because it includes "carbon and/or carbon based material." I guess if you're the sort of person interested in spending so much money on a credit card, perhaps you'll pay extra to have carbon in your credit card. Still doesn't make much sense here...

Filed Under: black card, carbon, credit cards, patents
Companies: visa

Visa Tests New Anti-Fraud Card Device, But What About The Data Leaks?

from the finger-in-the-dike dept

Visa is testing a new type of credit card that's got additional security measures built in as a means of cutting down on "card not present" (CNP) fraud -- the fraudulent sales rung up using stolen credit-card numbers and the security codes that are normally printed on the cards. Visa's new cards have a small screen on the back that displays a six-digit code when the cardholder enters a PIN on the card's keypad, making it sound like Visa has basically built in a tiny version of something akin to the SecurID, a popular two-factor authentication device for corporate computer networks. The devices generate an additional one-time password using an algorithm synced with the system on the other end; the user enters this password when they attempt to log on, or in Visa's case, make a CNP transaction. If the passwords match, the transaction goes ahead. It sounds like a good way to cut down on CNP fraud, but is it just a way to try and gloss over the massive data leaks that see millions of credit-card numbers lost out into the world? It almost seems that if these new anti-fraud cards make it to market, the party line will be "the data leaks don't matter anymore" -- but criminals will still be able to obtain credit-card numbers and make fake cards with the stolen info (for card-present fraud). It might make criminals' lives a little more difficult, but it won't make credit-card fraud impossible. Raising the level of security on credit cards is, without question, a good thing. But unless it involves doing more to stop massive data leaks, it's not enough.

Filed Under: anti-fraud, credit cards, fraud
Companies: visa

Making Credit-Card Payments More Secure By Making Breaches More Expensive

from the aligning-incentives dept

It seems that hardly a month goes by without news of yet another credit-card data breach. Based on this, it seems fairly clear that the industry largely sees these breaches and the fallout from them as a cost of doing business, and one that's preferable to the cost of securing and monitoring their systems effectively. The industry has come up with a security compliance framework, but such rules have a history of being ignored. Even if they aren't ignored, though, they're so full of loopholes that they're fairly worthless. As the original poster, Andrew Conry-Murray, puts it, "It's not about security. It's about an industry covering its ass." Basically, the compliance system exists not to truly protect data, but rather to ward off government intervention.

Conry-Murray's contention is that the compliance system is far too easy to game, particularly because it only checks companies' systems once per year. His suggestion is to force all merchants and processors to comply, and check their systems regularly. Companies could opt out, but by doing so, they would be agreeing to significantly higher fees and penalties in the case of a breach. As he notes, these fees would have to be high enough to where they would make devoting more resources to security a more desirable option. This idea, and indeed any that dramatically increases the cost of breaches, is worth mulling over as a way to encourage companies to increase their security. As long as the fallout from data breaches isn't enough to make companies sit up and take notice -- and change their behavior -- there won't be any real change.

Filed Under: credit cards, security breach

SMS Alerts Over Credit Card Transactions? Patented! Visa Sued

from the innovation-at-risk dept

Let's say you were an engineer at a major credit card company like Visa, and put in charge of watching over new technologies, and thinking about ways that you could make the credit card process better and more secure for card holders. It probably wouldn't take you all that long to come up with a variety of useful measures for checking to make sure certain transactions were legit -- such as alerting cardholders to transactions via SMS. That's nothing particular special or unique, but it's a nice obvious addition, thanks to the fact that SMS text messaging has now become popular. So, you go ahead and implement it... and promptly get sued by some small company that claims a patent on the "invention" of alerting cardholders of transactions by SMS. I'm sure the angry patent system defenders will be quick to show up in the comments claiming that Visa "stole" this "invention," but I'm having a really difficult time understanding how you can support innovation and allow this sort of result to happen.

Filed Under: credit cards, patents, sms alerts
Companies: cnsc, visa