I thought we were removing the need for the cheque in the electronic age.
Apparently not, ‘check’ out this link on Engadget.
This is our place on the Internet.
I thought we were removing the need for the cheque in the electronic age.
Apparently not, ‘check’ out this link on Engadget.
This is Great, I want one of these cards and a list of ATM’s.
|Steve: It’s like, oh, goodness, yeah. It’s quite something. So the big news, though, I just sort of had to kind of smile because I told all of our listeners this was going to happen. I said just wait, this is a bad idea, we’re going to see how bad it is. Trojans have – Trojan software has been found in ATMs located in Eastern Europe.|
|Leo: Oh. Oh.|
|Steve: From many different vendors.|
|Leo: Oh, dear.|
|Steve: But what one thing do all of the trojan-infected ATMs have in common, Leo?|
|Leo: Let me guess.|
|Steve: Windows XP.|
|Leo: Ai yi yi.|
|Steve: The LSASS service is the manager of protected content in the system. It’s not quite the right acronym. I can’t think of what it is right now. But it’s like the main security service. And fake ones have been found in the Windows directory. The LSASS EXE normally lives in the Windows System32 directory. They were written in Borland’s Delphi.|
|Leo: You’re kidding.|
|Leo: Well, that’s kind of sophisticated for a hacker. Wow.|
|Steve: And it’s considered, I mean, it’s commercial-grade code. It’s good code.|
|Leo: Oh, boy.|
|Steve: These are not remote installation Trojans. It’s believed that somebody had to have access to the machines.|
|Leo: Oh, even worse.|
|Steve: But they have special credit cards. When they swipe the special credit card in the infected machine, it accesses the trojan software, which among other things allows them to dump out all the cash from the machine. But in the meantime it’s logging all of the users’ information and PINs, which it’s able to dump out encrypted with DES encryption from the printer, from the ATM printer in the front of the machine.|
|Steve: So the – and anyway, so it’s interesting to me. Again, it’s, you know, people defended the idea of implementing these things that I contend should never have been written in Windows. They say, well, but it’s easier to write them. And it’s like, yes.|
I was asked on another post relating to DUKPT to provide some backgound. Given I have lots of material on the subject, I thought I would create this thread. Link
I will come back at some stage and expand on this when I get time.
Transaction Process narrative:
The diagram describes a mobile terminal/ATM is described using the a AS2805 (‘2805’) message type and 3DES DUKPT and dual direction auth SSL from the terminal to the aquirer (transaction switch).
A good explanation of DUKPT can also be found at Wikipedia.
The aquirer may terminate the the SSL connection on a hardware device such as a CISCO Content Service Switch (CSS), or equivalent instead of the design described in the diagram which terminates onto a SSL session server/gateway (Possibly including a Certificate Authority) or on the aquirer transaction switch.
When PIN blocks are received by the aquirer processing centre, the PIN encryption is translated from the terminal key to the Local Master Key (LMK) by the Host Security Modules (HSM).
When the message is sent on the upstream bank interchange link to the issuer or gateway , the aquirer HSM translates the encrypted PIN block from the LMK to the Zone Master Key (ZMK) of the aquirer interchange link. The PIN block is always encrypted using DEA3 (3DES) whenever outside of the Terminal or ATM.
I was asked some time ago to provide a list of things which may be considered when looking at Internet Banking.
Below is the list. It was just a brain dump and as such may not be complete.
Don’t underestimate the value of standards for your infrastructure, website configuration, database engine configuration/architecture,staging environment and development/QA environments.
– And all the other things expected for a remote login session (forced password changes, aging, etc))
– Tools such as Brutus may be use to brute force hack authenticated sessions.
– These may be server side, client side, cookie based, etc.
– Get someone to check the development methodologies and the code being used.
– Database query strings can be placed into test entry fields, allowing table dumps to browser.
– Check all pages served are secure and contain user authentication flags.
– A different segment to the main banking system.
– Separate private and public network cards, monitoring/backup/administration
– Infrastructure set-up to explicitly deny inbound/outbound ports, private IP & monitoring escaping from the network.
– This may be a staging environment. i.e. no the main banking system.
– This usually allows for transactions to appear real time to the customer.
– Many transactions may be batched in reality. (internal or external to the bank)
– There should be inbound and outbound rules on firewalls and filtering routers.
– Use the serial console port to connect to a server or back-end terminal server.
– These should be disabled.
– Investigate the reasons for all open ports.
– Look for real-time monitoring and alerting.
– Look for responsibility matrix.
– Look for ownership of issues.
– Helpdesk procedures and policies and/or alternate technologies (Caller ID, Gateway IP, etc.).
– Digital cert, IP address locked to account, etc.
– Consider use of CVV or CVN for bank issued cards.
– Plain text email, telephone, etc.
– Can passwords be changed online?
– Look at SWIFT, RTGS, inter-bank transfers, access to credit cards, etc.
– If an attacker does get in, what can the do?
– These are flags that can be set within pages.
– Normally SSL is cached, but some proxy vendors have been playing with techniques to do so.
– Caching of SSL pages on the client system can be turned on on some browsers.
– May banks use a Java (or similar) applet for all customer interaction, restricting all caching issues.
– I’ve seen statements like “use this system at your own risk, responsibility for any liability or claim will NOT……”
– Not very customer focused, but that’s what their legal department recommended.
All of the above can effect the security and/or operation of an on-line banking system.
Other things to consider:
When considering Mobile Banking security and the associated risks, an assessment approach depends greatly on the solution being created or provided.
Generally the approach is based on layered standards, supporting and surrounding the technologies and techniques used.
Here are some things to consider.
Security assessments generally focuses on two main things.
1/ Sensitivity of the data
What is being sent. eg. Pin, credit card numbers, account balance, home address, bank account number, etc.
Data may not be sensitive to the bank, but may be considered by the client as sensitive.
2/ Opportunity to access the data.
What medium is being used?
Is it technology/technique easy or trivial to hack?
What encryption is being used?
Are all data paths secure (client and back end)?
Is there a 3rd party involved in the switching of the transactions?
Things to consider:
Below is an article I found recently. This one of the most comprehensive descriptions of PIN Verification Value (PVV) hacking.
I thought I would replicate it here for my local reference.
As comments have been made regarding the grammar used in the original text, I have corrected some of the obvious errors whilst maintaining the context of the original material.
——– Original Text ———-
Have you ever wonder what would happen if you lose your credit or debit card and someone finds it. Would this person be able to withdraw cash from an ATM guessing, somehow, your PIN? Moreover, if you were who finds someone’s card would you try to guess the PIN and take the chance to get some easy money? Of course the answer to both questions should be “no”. This work does not deal with the second question, it is a matter of personal ethics. Herewith I try to answer the first question.
All the information used for this work is public and can be freely found in Internet. The rest is a matter of mathematics and programming, thus we can learn something and have some fun. I reveal no secrets. Furthermore, the aim (and final conclusion) of this work is to demonstrate that PIN algorithms are still strong enough to provide sufficient security. We all know technology is not the weak point.
This work analyses one of the most common PIN algorithms, VISA PVV, used by many ATM cards (credit and debit cards) and tries to find out how resistant is to PIN guessing attacks. By “guessing” I do not mean choosing a random PIN and trying it in an ATM. It is well known that generally we are given three consecutive trials to enter the right PIN, if we fail ATM keeps the card. As VISA PIN is four digit long it’s easy to deduce that the chance for a random PIN guessing is 3/10000 = 0.0003, it seems low enough to be safe; it means you need to lose your card more than three thousand times (or losing more than three thousand cards at the same time 🙂 until there is a reasonable chance of losing money.
What I really meant by “guessing” was breaking the PIN algorithm so that given any card you can immediately know the associated PIN. Therefore this document studies that possibility, analyzing the algorithm and proposing a method for the attack. Finally we give a tool which implements the attack and present results about the estimated chance to break the system. Note that as long as other banking security related algorithms (other PIN formats such as IBM PIN or card validation signatures such as CVV or CVC) are similar to VISA PIN, the same analysis can be done yielding nearly the same results and conclusions.
VISA PVV algorithm
One of the most common PIN algorithms is the VISA PIN Verification Value (PVV). The customer is given a PIN and a magnetic stripe card. Encoded in the magnetic stripe is a four digit number, called PVV. This number is a cryptographic signature of the PIN and other data related to the card. When a user enters his/her PIN the ATM reads the magnetic stripe, encrypts and sends all this information to a central computer. There a trial PVV is computed using the customer entered PIN and the card information with a cryptographic algorithm. The trial PVV is compared with the PVV stored in the card, if they match the central computer returns to the ATM authorization for the transaction. See in more detail.
The description of the PVV algorithm can be found in two documents linked in the previous page. In summary it consists in the encryption of a 8 byte (64 bit) string of data, called Transformed Security Parameter (TSP), with DES algorithm (DEA) in Electronic Code Book mode (ECB) using a secret 64 bit key. The PVV is derived from the output of the encryption process, which is a 8 byte string. The four digits of the PVV (from left to right) correspond to the first four decimal digits (from left to right) of the output from DES when considered as a 16 hexadecimal character (16 x 4 bit = 64 bit) string. If there are no four decimal digits among the 16 hexadecimal characters then the PVV is completed taken (from left to right) non decimal characters and decimalizing them by using the conversion A->0, B->1, C->2, D->3, E->4, F->5. Here is an example:
Output from DES: 0FAB9CDEFFE7DCBA
The strategy of avoiding decimalization by skipping characters until four decimal digits are found (which happens to be nearly all the times as we will see below) is very clever because it avoids an important bias in the distribution of digits which has been proven to be fatal for other systems, although the impact on this system would be much lower. See also a related problem not applying to VISA PVV.
The TSP, seen as a 16 hexadecimal character (64 bit) string, is formed (from left to right) with the 11 rightmost digits of the PAN (card number) excluding the last digit (check digit), one digit from 1 to 6 which selects the secret encrypting key and finally the four digits of the PIN. Here is an example:
PAN: 1234 5678 9012 3445
Key selector: 1
Obviously the problem of breaking VISA PIN consists in finding the secret encrypting key for DES. The method for that is to do a brute force search of the key space. Note that this is not the only method, one could try to find a weakness in DEA, many tried, but this old standard is still in wide use (now been replaced by AES and RSA, though). This demonstrates it is robust enough so that brute force is the only viable method (there are some better attacks but not practical in our case, for a summary see LASEC memo and for the dirty details see Biham & Shamir 1990, Biham & Shamir 1991, Matsui 1993, Biham & Biryukov 1994 and Heys 2001).
The key selector digit was very likely introduced to cover the possibility of a key compromise. In that case they just have to issue new cards using another key selector. Older cards can be substituted with new ones or simply the ATM can transparently write a new PVV (corresponding to the new key and keeping the same PIN) next time the customer uses his/her card. For the shake of security all users should be asked to change their PINs, however it would be embarrassing for the bank to explain the reason, so very likely they would not make such request.
Preparing the attack
A brute force attack consists in encrypting a TSP with known PVV using all possible encrypting keys and compare each obtained PVV with the known PVV. When a match is found we have a candidate key. But how many keys we have to try? As we said above the key is 64 bit long, this would mean we have to try 2^64 keys. However this is not true. Actually only 56 bits are effective in DES keys because one bit (the least significant) out of each octet was historically reserved as a checksum for the others; in practice those 8 bits (one for each of the 8 octets) are ignored.
Therefore the DES key space consists of 2^56 keys. If we try all these keys will we find one and only one match, corresponding to the bank secret key? Certainly not. We will obtain many matching keys. This is because the PVV is only a small part (one fourth) of the DES output. Furthermore the PVV is degenerated because some of the digits (those between 0 and 5 after the last, seen from left to right, digit between 6 and 9) may come from a decimal digit or from a decimalized hexadecimal digit of the DES output. Thus many keys will produce a DES output which yields to the same matching PVV.
Then what can we do to find the real key among those other false positive keys? Simply we have to encrypt a second different TSP, also with known PVV, but using only the candidate keys which gave a positive matching with the first TSP-PVV pair. However there is no guarantee we won’t get again many false positives along with the true key. If so, we will need a third TSP-PVV pair, repeat the process and so on.
Before we start our attack we have to know how many TSP-PVV pairs we will need. For that we have to calculate the probability for a random DES output to yield a matching PVV just by chance. There are several ways to calculate this number and here I will use a simple approach easy to understand but which requires some background in mathematics of probability.
A probability can always be seen as the ratio of favorable cases to possible cases. In our problem the number of possible cases is given by the permutation of 16 elements (the 0 to F hexadecimal digits) in a group of 16 of them (the 16 hexadecimal digits of the DES output). This is given by 16^16 ~ 1.8 * 10^19 which of course coincides with 2^64 (different numbers of 64 bits). This set of numbers can be separated into five categories:
Those with at least four decimal digits (0 to 9) among the 16 hexadecimal digits (0 to F) of the DES output.
Those with exactly only three decimal digits.
Those with exactly only two decimal digits.
Those with exactly only one decimal digit.
Those with no decimal digits (all between A and F).
Let’s calculate how many numbers fall in each category. If we label the 16 hexadecimal digits of the DES output as X1 to X16 then we can label the first four decimal digits of any given number of the first category as Xi, Xj, Xk and Xl. The number of different combinations with this profile is given by the product 6 i-1 * 10 * 6j-i-1 * 10 * 6k-j-1 * 10 * 6 l-k-1 * 10 * 1616-l where the 6’s come from the number of possibilities for an A to F digit, the 10’s come from the possibilities for a 0 to 9 digit, and the 16 comes from the possibilities for a 0 to F digit. Now the total numbers in the first category is simply given by the summation of this product over i, j, k, l from 1 to 16 but with i < j < k < l. If you do some math work you will see this equals to the product of 104/6 with the summation over i from 4 to 16 of (i-1) * (i-2) * (i-3) * 6i-4 * 16 16-i ~ 1.8 * 1019.
Analogously the number of cases in the second category is given by the summation over i, j, k from 1 to 16 with i < j < k of the product 6i-1 * 10 * 6j-i-1 * 10 * 6k-j-1 * 10 * 616-k which you can work it out to be 16!/(3! * (16-13)!) * 103 * 6 13 = 16 * 15 * 14/(3 * 2) * 103 * 613 = 56 * 104 * 613 ~ 7.3 * 1015. Similarly for the third category we have the summation over i, j from 1 to 16 with i < j of 6 i-1 * 10 * 6j-i-1 * 10 * 616-j which equals to 16!/(2! * (16-14)!) * 102 * 614 = 2 * 103 * 615 ~ 9.4 * 1014. Again, for the fourth category we have the summation over i from 1 to 16 of 6i-1 * 10 * 616-i = 160 * 615 ~ 7.5 * 1013. And finally the amount of cases in the fifth category is given by the permutation of six elements (A to F digits) in a group of 16, that is, 616 ~ 2.8 * 1012.
I hope you followed the calculations up to this point, the hard part is done. Now as a proof that everything is right you can sum the number of cases in the 5 categories and see it equals the total number of possible cases we calculated before. Do the operations using 64 bit numbers or rounding (for floats) or overflow (for integers) errors won’t let you get the exact result.
Up to now we have calculated the number of possible cases in each of the five categories, but we are interested in obtaining the number of favorable cases instead. It is very easy to derive the latter from the former as this is just fixing the combination of the four decimal digits (or the required hexadecimal digits if there are no four decimal digits) of the PVV instead of letting them free. In practice this means turning the 10’s in the formula above into 1’s and the required amount of 6’s into 1’s if there are no four decimal digits. That is, we have to divide the first result by 104, the second one by 103 * 6, the third one by 102 * 62 , the fourth one by 10 * 63 and the fifth one by 64 . Then the number of favorable cases in the five categories are approximately 1.8 * 1015, 1.2 * 1012, 2.6 * 1011 , 3.5 * 1010, 2.2 * 109 respectively.
Now we are able to obtain what is the probability for a DES output to match a PVV by chance. We just have to add the five numbers of favorable cases and divide it by the total number of possible cases. Doing this we obtain that the probability is very approximately 0.0001 or one out of ten thousand. Is it strange this well rounded result? Not at all, just have a look at the numbers we calculated above. The first category dominates by several orders of magnitude the number of favorable and possible cases. This is rather intuitive as it seems clear that it is very unlikely not having four decimal digits (10 chances out of 16 per digit) among 16 hexadecimal digits. We saw previously that the relationship between the number of possible and favorable cases in the first category was a division by 10^4, that’s where our result p = 0.0001 comes from.
Our aim for all these calculations was to find out how many TSP-PVV pairs we need to carry a successful brute force attack. Now we are able to calculate the expected number of false positives in a first search: it will be the number of trials times the probability for a single random false positive, i.e. t * p where t = 2^56, the size of the key space. This amounts to approximately 7.2 * 10^12, a rather big number. The expected number of false positives in the second search (restricted to the positive keys found in the first search) will be (t * p) * p, for a third search will be ((t * p) * p) * p and so on. Thus for n searches the expected number of false positives will be t * p^n.
We can obtain the number of searches required to expect just one false positive by expressing the equation t * p^n = 1 and solving for n. So n equals to the logarithm in base p of 1/t, which by properties of logarithms it yields n = log(1/t)/log(p) ~ 4.2. Since we cannot do a fractional search it is convenient to round up this number. Therefore what is the expected number of false positives if we perform five searches? It is t * p^5 ~ 0.0007 or approximately 1 out of 1400. Thus using five TSP-PVV pairs is safe to obtain the true secret key with no false positives.
Once we know we need five TSP-PVV pairs, how do we get them? Of course we need at least one card with known PIN, and due to the nature of the PVV algorithm, that’s the only thing we need. With other PIN systems, such as IBM, we would need five cards, however this is not necessary with VISA PVV algorithm. We just have to read the magnetic stripe and then change the PIN four times but reading the card after each change.
It is necessary to read the magnetic stripe of the card to get the PVV and the encrypting key selector. You can buy a commercial magnetic stripe reader or make one yourself following the instructions you can find in the previous page and links therein. Once you have a reader see this description of standard magnetic tracks to find out how to get the PVV from the data read. In that document the PVV field in tracks 1 and 2 is said to be five character long, but actually the true PVV consists of the last four digits. The first of the five digits is the key selector. I have only seen cards with a value of 1 in this digit, which is consistent with the standard and with the secret key never being compromised (and therefore they did not need to move to another key changing the selector).
I did a simple C program, getpvvkey.c, to perform the attack. It consists of a loop to try all possible keys to encrypt the first TSP, if the derived PVV matches the true PVV a new TSP is tried, and so on until there is a mismatch, in which case the key is discarded and a new one is tried, or the five derived PVVs match the corresponding true PVVs, in which case we can assume we got the bank secret key, however the loop goes on until it exhausts the key space. This is done to assure we find the true key because there is a chance (although very low) the first key found is a false positive.
It is expected the program would take a very long time to finish and to minimize the risks of a power cut, computer hang out, etc. it does checkpoints into the file getpvvkey.dat from time to time (the exact time depends on the speed of the computer, it’s around one hour for the fastest computers now in use). For the same reason if a positive key is found it is written on the file getpvvkey.key. The program only displays one message at the beginning, the starting position taken from the checkpoint file if any, after that nothing more is displayed.
The DES algorithm is a key point in the program, it is therefore very important to optimize its speed. I tested several implementations: libdes, SSLeay, openssl, cryptlib, nss, libgcrypt, catacomb, libtomcrypt, cryptopp, ufc-crypt. The DES functions of the first four are based on the same code by Eric Young and is the one which performed best (includes optimized C and x86 assembler code). Thus I chose libdes which was the original implementation and condensed all relevant code in the files encrypt.c (C version) and x86encrypt.s (x86 assembler version). The code is slightly modified to achieve some enhancements in a brute force attack: the initial permutation is a fixed common steep in each TSP encryption and therefore can be made just one time at the beginning. Another improvement is that I wrote a completely new setkey function (I called it nextkey) which is optimum for a brute force loop.
To get the program working you just have to type in the corresponding place five TSPs and their PVVs and then compile it. I have tested it only in UNIX platforms, using the makefile Makegetpvvkey to compile (use the command “make -f Makegetpvvkey”). It may compile on other systems but you may need to fix some things. Be sure that the definition of the type long64 corresponds to a 64 bit integer. In principle there is no dependence on the endianness of the processor. I have successfully compiled and run it on Pentium-Linux, Alpha-Tru64, Mips-Irix and Sparc-Solaris. If you do not have and do not want to install Linux (you don’t know what you are missing 😉 you still have the choice to run Linux on CD and use my program, see my page running Linux without installing it.
Once you have found the secret bank key if you want to find the PIN of an arbitrary card you just have to write a similar program (sorry I have not written it, I’m too lazy 🙂 that would try all 10^4 PINs by generating the corresponding TSP, encrypting it with the (no longer) secret key, deriving the PVV and comparing it with the PVV in the magnetic stripe of the card. You will get one match for the true PIN. Only one match? Remember what we saw above, we have a chance of 0.0001 that a random encryption matches the PVV. We are trying 10000 PINs (and therefore TSPs) thus we expect 10000 * 0.0001 = 1 false positive on average.
This is a very interesting result, it means that, on average, each card has two valid PINs: the customer PIN and the expected false positive. I call it “false” but note that as long as it generates the true PVV it is a PIN as valid as the customer’s one. Furthermore, there is no way to know which is which, even for the ATM; only customer knows. Even if the false positive were not valid as PIN, you still have three trials at the ATM anyway, enough on average. Therefore the probability we calculated at the beginning of this document about random guessing of the PIN has to be corrected. Actually it is twice that value, i.e., it is 0.0006 or one out of more than 1600, still safely low.
It is important to optimize the compilation of the program and to run it in the fastest possible processor due to the long expected run time. I found that the compiler optimization flag -O gets the better performance, thought some improvement is achieved adding the -fomit-frame-pointer flag on Pentium-Linux, the -spike flag on Alpha-Tru64, the -IPA flag on Mips-Irix and the -fast flag on Sparc-Solaris. Special flags (-DDES_PTR -DDES_RISC1 -DDES_RISC2 -DDES_UNROLL -DASM) for the DES code have generally benefits as well. All these flags have already been tested and I chose the best combination for each processor (see makefile) but you can try to fine tune other flags.
According to my tests the best performance is achieved with the AMD Athlon 1600 MHz processor, exceeding 3.4 million keys per second. Interestingly it gets better results than Intel Pentium IV 1800 MHz and 2000 MHz (see figures below, click on them to enlarge). I believe this is due to some I/O saturation, surely cache or memory access, that the AMD processor (which has half the cache of the Pentium) or the motherboard in which it is running, manages to avoid. In the first figure below you can see that the DES breaking speed of all processors has more or less a linear relationship with the processor speed, except for the two Intel Pentium I mentioned before. This is logical, it means that for a double processor speed you’ll get double breaking speed, but watch out for saturation effects, in this case it is better the AMD Athlon 1600 MHz, which will be even cheaper than the Intel Pentium 1800 MHz or 2000 MHz.
In the second figure we can see in more detail what we would call intrinsic DES break power of the processor. I get this value simply dividing the break speed by the processor speed, that is, we get the number of DES keys tried per second and per MHz. This is a measure of the performance of the processor type independently of its speed. The results show that the best processor for this task is the AMD Athlon, then comes the Alpha and very close after it is the Intel Pentium (except for the higher speed ones which perform very poor due to the saturation effect). Next is the Mips processor and in the last place is the Sparc. Some Alpha and Mips processors are located at bottom of scale because they are early releases not including enhancements of late versions. Note that I included the performance of x86 processors for C and assembler code as there is a big difference. It seems that gcc is not a good generator of optimized machine code, but of course we don’t know whether a manual optimization of assembler code for the other processors (Alpha, Mips, Sparc) would boost their results compared to the native C compilers (I did not use gcc for these other platforms) as it happens with the x86 processor.
Here is an article where these techniques may have been used.
The Financial Institution which holds the Merchant Account partaking in a financial transaction, typically the first bank involved in the processing of a payment.
A small computer program which facilitates the performance of particular tasks.
The capacity of a server to carry or process information. The higher the bandwidth the faster graphics-laden web pages will download.
Short for Web browser, a software application used to locate and display Web pages. The two most popular browsers are Netscape Navigator and Microsoft Internet Explorer. Both of these are graphical browsers, which means that they can display graphics as well as text. In addition, most modern browsers can present multimedia information, including sound and video, though they require plug-ins for some formats.
The automatic copying and storage of frequently used information onto a computer system “ Typically caching is seen whilst surfing the internet (graphics, etc.) and used by Internet Services Providers (ISP’s) to reduce the amount of data requested from the user onto the internet.
The Financial Institution which issued the cardholder’s account and card.
The individual participating in the financial transaction whose card is being credited or debited.
Card Verification Data
The additional information printed on the card to be processed. This is used to verify if the card was present when the transaction was initiated.Â This is the additional digits imprinted on the card usually on the reverse side for VISA & Mastercard and on the front for AMEX.
An x.509 certificate used to authenticate entities such as Merchants and Payment Gateways. Certificates can be used to identify and/or encrypt sensitive data such as card numbers and personal cardholder information.
Common Gateway Interface: A protocol that allows a Web page to run a program on a Web server. Forms, counters, and guest books are common examples of CGI programs.
Any piece of software can be a CGI program if it handles input and output according to the CGI standard. Usually a CGI program is a small program that takes data from a web server and does something with it, like putting the content of a form into an e-mail message, or turning the data into a database query. CGI “scripts” are just scripts which use CGI. CGI is often confused with Perl, which is a programming language, while CGI is an interface to the server from a particular program.
A computer or software that requests a service of another computer system or process (a “server”). For example, a workstation requesting the contents of a file from a file server is a client of the file server. A web browser is commonly referred to as a client.
Clients and Servers
In general, all of the machines on the Internet can be categorised as two types: servers and clients. Those machines that provide services (like Web servers or FTP servers) to other machines are servers. And the machines that are used to connect to those services are clients.
When you connect to Yahoo at www.google.com to read a page, Google is providing a machine (probably a cluster of very large machines), for use on the Internet, to service your request. Google is providing a server. Your machine, on the other hand, is probably providing no services to anyone else on the Internet. Therefore, it is a user machine, also known as a client. It is possible and common for a machine to be both a server and a client !
A file sent by some web servers to your computer’s hard drive to enable you to quickly and easily return to particular sites. Cookies give rise to privacy concerns as they are often used to store information used for marketing purposes.
The main purpose of cookies is to identify users and possibly prepare customised Web pages for them. When you enter a Web site using cookies, you may be asked to fill out a form providing such information as your name and interests. This information is packaged into a cookie and sent to your Web browser which stores it for later use. The next time you go to the same Web site, your browser will send the cookie to the Web server. The server can use this information to present you with custom Web pages. So, for example, instead of seeing just a generic welcome page you might see a welcome page with your name on it.
The Customer Receipt Number (CRN) is used to assist the card holder, the payment gateway and the transaction acquirer to confirm the transaction has been processed and to track the transaction throughout the end-to-end transaction process. This is often used when making enquiries about a transaction or for transaction tracking.
Bad faith, abusive domain name registration. Cybersquatters register company and product names as domain names with a view to selling them at inflated prices to the rightful owners.
The additional information printed on the card to be processed. This is used to verify if the card was present when the transaction was initiated. This is the additional digits imprinted on the card usually on the reverse side for VISA & Mastercard and on the front for AMEX.
A collection of data: part numbers, product codes, customer information, etc. It usually refers to data organised and stored on a computer that can be searched and retrieved by a computer program.
A hypertext link directly to a web page, often bypassing home pages or other identifying pages.
A pop up window that allows you to identify the level of encryption used to secure a particular web site.
A complex numeric “signature” designed to be used, in conjunction with special software, to authenticate the sender of a message and guarantee that the contents of the message have not been altered during transmission to the recipient. The EU has adopted legislation which makes electronic signatures legally valid. The Electronic Transaction Bill (Cth) 1999 has the same effect in Australia.
The plain English name given to a host destination on the Internet, for example, www.madrock.net. The suffix, dot.com is known as the generic top level domain, the prefix madrock. The domain name forms part of the Internet Address or URL.
A name that identifies one or more IP addresses. For example, the domain name microsoft.com represents about a dozen IP addresses. Domain names are used in URLs to identify particular Web pages. For example, in the URL http://www.madrock.net, the domain name is madrock.net.
To transfer information from one computer to your computer.
Dynamic web page
A web document that is created from a database in real-time or “on the fly” at the same time it is being viewed, providing a continuous flow of new information and giving visitors a new experience each time they visit the web site.
Dynamic web sites offer the user the ability to interact with the web site. This interaction can take place in the form of a search for products, a questionnaire that automatically posts results or online polls. Basically, dynamic web pages and content are generated from the input of the user.
Often referred to as simply e-commerce, business that is conducted over the Internet using any of the applications that rely on the Internet, such as e-mail, instant messaging, shopping carts, Web services, and FTP, among others. Electronic commerce can be between two businesses transmitting funds, goods, services and/or data or between a business and a customer.
The Electronic Commerce Indicator (ECI), is used to determine the source of the original transaction request. This is a program that the banks have developed and have mandated itâ€™s use.
Electronic Data Interchange (EDI)
Systems set up by businesses, which facilitate the electronic exchange of information.
The process of scrambling data to prevent it being viewed by unauthorized persons.
The date printed on the card indicating when the card will expire. Not to be confused with the card issue date found on some cards.
An electronic security barrier and/or traffic filter.
Forms are web pages comprised of text and “fields” for a user to fill in with information. They are an excellent way of collecting and processing information from people visiting a web site, as well as allowing them to interact with web pages. Forms are written in HTML and processed by CGI programs.
A means of dividing a web screen into a number of compartments. Frames may give rise to legal disputes if web sites created by third parties are framed as your own.
One of the oldest of the Internet services, File Transfer Protocol makes it possible to move one or more files securely between computers while providing file security and organisation as well as transfer control.
1. Process of supplying goods after an order has been received.
2. Process of reacting to a customer’s request, covering everything that has to happen from the time the customer places an order until they are completely satisfied.
Any computer on a network that provides services or information to other computers on the network. A host is also called a server.
The software and/or business processes which combine the Merchant’s (website, back office, etc.) order processing system with the EFT Network Electronic Payment System.
Every computer connected to the Internet is assigned a unique number known as an Internet Protocol (IP) address. Since these numbers are usually assigned in country-based blocks, an IP address can often be used to identify the country from which a computer is connecting to the Internet.
A system allowing incompatible computer networks to send and receive information.
HTML (Hypertext Markup Language)
Language used to translate text documents into a form which can be sent over the web.
A highlighted phrase in a document which permits linking to another document or part of a document.
Internet Content Host (ICH)
Those who host or propose to host content on the Internet. Anybody who is responsible for a web site, news group or bulletin board that contains articles, graphics or other internet content provided by others. The host may/may not also produce their own content and/or provide access to the Internet through a carriage service, ie they may also be an ISP.
Internet Service Provider (ISP)
A company that provides an Internet connection through some kind of Internet carriage service, for example Sprint, Chello Broadband, Telstra Bigpond, Adam Internet, Internode. ISP’s may/may not also be ICHs.
Almost as ubiquitous and crucial as Web servers, mail servers move and store mail over corporate networks (via LANs and WANs) and across the Internet.
This is an account set up with a bank to process credit card orders from customers.
The entity receiving payments for goods and/or services.
The merchant’s account into which transactions are credited or debited.
The software installed on the Merchant’s web sites or back office system to enable real-time or batched processing of financial transactions.
Merchant Server Administrator
The individual(s) responsible for the maintenance of the Merchant Server, including issuing and importing merchant certificates.
Merchant Transaction Layer (MTL)
Primary Account Number (PAN) is the number printed on the customers card to reference the cardholder’s financial account. This is typically the card number.
The Payment Gateway provides a central point of contact/transaction switching with the banking network for the Merchant Server software or devices. The EFT Networks Payment gateway provides advanced integrated reporting, merchant integration services (Mainframe, Mini, Windows, UNIX, OS400, Desktop/Server, EFT PoS Terminals. Loyalty systems, etc.) and Merchant/Bank customised solutions not offered by regional or global banking institutions.
An online system for real-time charging of credit cards when a customer places an order. Normally requires a merchant account.
A common question from merchants is “Do we have to change banks to use payment gateways?”
The answer is NO!Â – All you need to do is open a merchant facility with one of the supported banks, EFT Networks can ensure you open the correct one for your transaction needs. The merchant facility is then linked to a nominated bank account for example: Bank of New Zealand, ANZ, St George Bank, NAB, Commonwealth, Westpac, Bank of America, Bank of Scotland, Barclay’s, Bank of Queensland, etc. The money is then transferred at the end of each day from your merchant account to your nominated account.
“Pretty Good Privacy”
A type of encryption program used to scramble data.
A site that gathers together many sites under a common branding, for example, Yahoo and Excite.
The password which permits information to be decoded in a public key encryption system.
The password which is used to send a secure message in a public key encryption system.
A document that is used to certify that a user or organisation is who they say they are. They contain information about who it belongs to, who it was issued by, expiry date and information that can be used to check out the contents of the certificate. It is as an important part of the SSL system for establishing secure connections.
A computer that provides a service to other computers (known as clients) on a network.
A shopping cart is a piece of software that acts as an online store’s catalogue and ordering process. Typically, a shopping cart is the interface between a company’s Web site and its deeper infrastructure, allowing consumers to select merchandise; review what they have selected; make necessary modifications or additions; and purchase the merchandise.
Shopping carts can be sold as independent pieces of software so companies can integrate them into their own unique online solution, or they can be offered as a feature from a service that will create and host a company’s e-commerce site.
The use of email or newsgroups to send unsolicited information.
Short for Secure Sockets Layer, a protocol developed by Netscape for transmitting private documents via the Internet. SSL works by using a private key to encrypt data that’s transferred over the SSL connection. Both Netscape Navigator and Internet Explorer support SSL, and many Web sites use the protocol to obtain confidential user information, such as credit card numbers. By convention, URLs that require an SSL connection start with https: instead of http:.
Letting your customers know that you have SSL protection gives your site credibility and may encourage customers to deal with you in confidence.
A security protocol used to protect information – typically used between the cardholder’s web browser and the merchant’s webserver and throughout the transaction processing process. 128bit SSL is typical used as a minimum level within the Payment & Financial industries.
A Secure Server uses an SSL certificate. It is generally a piece of web space that can only be dealt with by using SSL ensuring that data transferred between the web space and the browser is encrypted.
Static web page
In web site terms, static means web pages that are not interactive. Because the web site visitor does not have any control over the information provided, the pages and information do not change with each visit. There is not a two-way communication between the user (client) and the web site (server) in a static page.
Uniform Resource Locator (URL)
An Internet address.
A specific group of related files on the web, which is usually viewed as a single document.
At its core, a Web server serves static content to a Web browser by loading a file from a hard disk and serving it across the network to a user’s Web browser. This entire exchange is mediated by the browser and server talking to each other using HTTP.
A collection of web pages stored on a file server.
Guardian Technology Pages
28 September 2006
“Your card has been declined.”
“What? No way, there’s plenty of money in that account!”
“I’m sorry, madam, but it’s refusing the transaction.”
“It’s your card reader, that card worked fine in Boots five minutes ago.”
“The card has been declined. Do you have another one?”
The casual eavesdropper might infer that I – the protesting woman in that dialogue – am financially irresponsible, that my credit card is maxed out or my debit card has reached its overdraft limit. In fact, it’s far more likely that the reader on the chip and pin machine is throwing a strop. There is a machine at WH Smith in North End Road, Fulham, that hates my debit card and never accepts it. I’ve given up trying there. But it’s not the only one.
Self-service machines have sprung up everywhere, sprouting card readers and keypads. But watch closely and you will find that more often than not, there is an angry person muttering and swearing at the machine while a queue forms. Watch a little longer and you’ll see that queue evaporate – and reform at the counter in front of a human being.
This happened to me and my partner in France recently when we pulled into a petrol station in Epernay. In our desperation, we pulled up at an empty pump, wondering vaguely why it had no queue while others did.
Why? Because before it would dispense petrol, it wanted a credit card and pin. We fed it mine and I keyed in the number, only for it to be spat out with terrifying admonitions in French about the card being refused. I wiped the strip and tried again. Same reaction, causing a moment’s panic: we’d spent a bit on that card – did my bank think it was stolen? Was it blocked?
So we tried my partner’s card. Same thing. And then the penny dropped that the pumps with the queues were the old-fashioned ones where you fill the car up and then pay at the till. Clearly the locals knew all about these pumps.
Mind you, it was a miracle we got to France at all. When we arrived at the Eurotunnel terminus we joined a queue of cars for the automatic check-in. I am not the most patient of queuers and within a short time I was railing about how slowly it was moving. A man in a bright yellow jacket was buzzing about from car to car. Finally we got to the head of the queue and fed in the card that was used to book the shuttle online.
It didn’t want to know. It spat the card out. We tried again and got as far as tapping in our reservation number. It spat it out again. The chap in the high-visibility jacket buzzed over to us and rolled his eyes, saying: “It’s been playing up all day.” He went into the booth with the card – and then we heard him saying over his radio that the whole system had gone down in protest.
As an idea, the technology is great. In practice, we have a long way to go before we can dispense with human beings who can override systems when good card readers go bad. Kate Bevan
Â© Copyright 2006. The Guardian. All rights reserved.