Hacker News new | past | comments | ask | show | jobs | submit login
Outdated payment protocols expose customers and merchants (srlabs.de)
35 points by max0563 on Dec 28, 2015 | hide | past | favorite | 8 comments



Well that article was completely devoid of information.

Here's the post by the researchers themselves: https://srlabs.de/pos-vulns/

tldr: POS card readers have poor security - their HSMs leak their keys, and many of them don't have unique keys so you can impersonate them



The guys have also done a presentation on this in Hamburg a couple of days ago: https://events.ccc.de/congress/2015/Fahrplan/events/7368.htm...

Cannot find a recording yet


Recording is here: https://streaming.media.ccc.de/32c3/relive/7368/

But warning! This is pure stream dump, don’t expect high quality yet.



It's not my job to defend the payments industry - I think it's full of dinosaurs putting out bad code slowly - but I will say that the flaws here are not universal.

I've worked on the security systems for some reader/terminal devices that contain their own master keys in wipe-on-tamper memory, and use various key-derivation techniques to derive (and then immediately discard) per-transactions keys to protect transaction information, PINs etc.

So it's not all as bad as this. However things like ISO-8583, better described as a protocol family or meta-specification than a single protocol, probably are rife with poor implementation choices.



The raw stream dump from the CCC talk is available at https://streaming.media.ccc.de/32c3/relive/7368/

You should jump to 17:45 in that video for the start of the talk.




Consider applying for YC's W25 batch! Applications are open till Nov 12.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: