{\rtf0\mac {\fonttbl} {\colortbl\red0\green0\blue0;\red255\green255\blue255;\red255\green0\blue0;\red0\green255\blue0;\red0\green0\blue255;\red0\green255\blue255;\red255\green0\blue255;\red255\green255\blue0;} \pgnstart1 \pard\ql\sl240\ri-720 \li0 \fi0 \plain\f4\fs18\cf0 \par \par +-------------------------------+\par | |\par | a. t. m. fRAUD mADE eASY |\par | |\par | SUMMARY AND RESEARCH BY |\par | cOUNT zERO |\par | |\par | (a chIna iNFO-nET pROD) |\par | |\par +-------------------------------+\par \par hAVE YOU EVER LOOKED LONGINGLY UPON THE SIGHT OF YOUR LOCAL pulse MACHINE AND\par THOUGHT, "tHERE MUST BE SOME WAY THAT i CAN MAKE SOME MONEY real EASY HERE."?\par \par wELL, THERE IS. bUT IT WON'T BE EASY. pROTECTION METHODS CAN BE OVERCOME,\par BUT THE TECHNOLOGY INVOLVED MUST BE UNDERSTOOD in its entirety BEFORE AN\par ATTEMPT AT ILLEGAL ACCESS IS TO BE MADE. tHERE ARE HUNDREDS OF PEOPLE,\par GUESTS OF THE STATE, THAT FIGURED THEIR PLANS INFALLIBLE, ONLY TO FALL VICTIM\par TO A WELL-HIDDEN CAMERA.\par \par tHIS ARTICLE WILL NOT BE A LESSON ON how TO BREAK INTO THE MACHINE, IT IS\par MERELY A SUMMARY OF THE OPERATIONS INVOLVED WITH A NORMAL atm TRANSACTION.\par tHIS INFORMATION IS BEING PRESENTED ON A "FOR INFORMATION'S SAKE"-ONLY BASIS.\par i, cOUNT zERO, DO NOT PROMOTE NOR REMOTELY CONDONE ANY ILLEGAL ACTS OF ANY\par SORT. sO THERE.\par \par i. magnetic strip format\par \par tHIS WOULD SEEM TO BE THE MOST EFFICIENT METHOD OF TRYING TO ACCESS ILLEGAL\par SUMS OF CASH. yOU COULD:\par \par A. STEAL SOMEBODY'S CARD AND pin CODE\par B. SYNTHESIZE A CARD\par C. ATTEMPT TO "JACKPOT" THE SYSTEM\par \par wE WILL ONLY LOOK AT OPTION b. aS "a" IS UP TO YOUR OWN DEVICES AND "c" HAS\par SEVERAL GOOD TEXT FILES WRITTEN ABOUT IT ALREADY. sO "b" IT IS.\par \par lET'S LOOK AT THE FORMAT OF THE DATA WRITTEN TO THE MAGNETIC STRIPS. tHIS\par HAS BEEN TAKEN FROM A RECENT hartwell, inc MANUAL.\par \par [ xx xx xx xx xx xx xx xx ] [ yyyy ] [ - 20 chars - ] [ zz zz zz ] [ cc cc ]\par \\-----------------------/ \\------/ \\--------------/ \\----------/ \\-------/\par yOUR INDIVIDUAL ACCT. pin nAME OF CARD bANK ROUTE chksum\par NUMBER/SERIAL CODE cODE ISSUEE CODE/REM.\par ACCESS #\par \par fOR VALIDATION, EACH ENTRY IS WRITTEN TWICE BUT NOT WRITTEN HERE FOR EASE OF\par TYPING. bUT IT IS REPEATED IN THE FORM OF: "acct num" "acct num" "pin code"\par "pin code" ETC...\par \par tHESE CODES MAY BE EXAMINED BY BUILDING A SIMPLE CODE-READER AS MANY HAVE\par DONE WHICH CAN BE EASILY INTERFACED TO YOUR ibm-pc. fULL PLANS TO BE PUT\par INTO A FUTURE chIna NEWSLETTER.\par \par iF YOU WERE TO ATTEMPT TO WRITE A MAGNETIC STRIP OR CHANGE A CURRENTLY\par EXISTING ONE, YOU WOULD NEED TO BE USING A HEAD-WRITE CIRCUIT BASED ON THE\par POPULAR mOTOROLA bcx119221-a...c SERIES OF HEAD CONTROL CHIPS.\par \par note: mAKE SURE TO CHANGE THE LAST 2 VALUES! tHEY CONSTITUTE THE CHECKSUM OF\par THE ENTRY. mERELY ADD ALL EXISTING CHARACTERS WRITTEN (ONLY THE FIRST ENTRY,\par NOT BOTH OF THEM) USING THE FOLLOWING CHART:\par \par character value\par ------------------------------\par 0..9 0..9\par a..z 10..36\par eol 37\par eot 38\par clr 39\par hmx 40\par ptt 41\par ria-1 42\par ria-2 43\par \par i DOUBT ANYONE IN THE COMMUNICATIONS BIZ NEEDS AN EXPLANATION OF THESE TERMS\par SO i'LL MOVE ON.\par \par \par ii. atm hardware\par \par uSUALLY CONSISTS OF:\par \par ------------------------------------\par | |\par \\-----\\ | b |\par | a | | |\par \\-----\\ ------------------------------------\par | |\par | ----------- /---/ e |\par | / / / / ---- |\par | / c / / d / f |\par | / / / / ---- |\par | ------------ /---/ |\par | |\par ------------------------------------\par \par \par a. cAMERA mOUNT\par b. hIDDEN vOICE-aCTIVATED RECORDER & PRINTOUT LINK\par c. dISPLAY mONITOR\par d. oPTIONS BUTTONS\par e. cARD sLOT\par f. rECEIPT sLOT\par \par yOUR MACHINE MAY VARY SLIGHTLY. bUT THE CONCEPT WILL ALMOST ALWAYS HOLD\par TRUE. sIMPLE RULES FOR EACH.\par \par a. wEAR A PAPER BAG OR MASK. sEE ALSO pART ii a\par b. dO not SPEAK. tHIS IS THE MOST CRUCIAL PART! sEE ALSO pART ii a\par c. nOTHING\par d. wEAR GLOVES\par e. sEE pART i\par f. take your receipt and burn it!!\par \par oNE OF THE NEAT FLAWS IN MANY MACHINES MADE PRIOR TO 1989 INVOLVED THE USE OF\par THE "cancel" BUTTON. tHIS BUTTON WAS MADE TO BE PRESSED WHEN THE USER\par DECIDED, AT ANY TIME DURING THE TRANSACTION, THAT HE DIDN'T WISH TO CONTINUE.\par tHE DISPLAY WOULD JUMP IMMEDIATELY TO:\par \par "transaction cancelled - choose another?"\par \par tHIS WAS ALL WELL AND GOOD, BUT THE MACHINES DID NOT DISABLE THIS FEATURE\par BETWEEN THE TIME YOUR CASH WAS DISPENSED AND YOU WERE PROMPTED FOR YOUR NEXT\par ACTIVITY. iN EFFECT, YOU COULD PUSH THE "cancel" BUTTON AFTER YOUR MONEY HAS\par BEEN WITHDRAWN AND IT WOULD NOT BE ADDED TO YOUR ACCOUNT RECORD!\par \par this still works in many places! over 85% of all machines made before mar.\par 1989\par still have not been upgraded.\par \par aLTHOUGH MOST MACHINES OF THAT PERIOD WOULD ONLY WORK IF YOU WERE WITHDRAWING\par AMOUNTS LARGER THAN $20 (USUALLY $25 IS THE NEXT POSSIBLE CHOICE!) tHIS IS\par IDEAL IF YOU ARE USING ANOTHER'S CARD!\par \par \par ii a. camera/sound hardware\par \par yOU CAN GO OTHER ROUTES WHEN DEALING WITH CAMERA SYSTEMS. yOU DO NOT HAVE TO\par WEAR A BAG ON YOUR HEAD (UNLESS THE COSMETIC IMPROVEMENT IS QUITE LARGE) tHIN\par ALLOY METAL SUCH AS COMMON ALUMINUM/TIN FOIL, WHICH ARE FULL OF IMPURITIES,\par REACT IN A BIZARRE WAY WHEN PHOTOGRAPHED THROUGH THE SPECIAL LENSES THAT ARE\par COMMONLY USED. tHE EFFECT IS TO "BLUR" OR "BLEED" THE IMAGE, RENDERING IT\par INDESTINGUISHABLE FROM AN ACCIDENT IN YOUR LOCAL sHERWIN-wILLIAMS STORE.\par mOST PEOPLE PREFER TO MAKE A "HEADBAND" OF THIS METAL, LINED WITH COPPER WIRE\par IN A SINE WAVE PATTERN WHEN ACCOSTING A MACHINE. yOU SHOULD SERIOUSLY\par CONSIDER THIS POSSIBILITY!\par \par fOR FURTHER READING ON THIS SUBJECT, CONSULT:\par \par banker's world - aPR 1989\par "wHERE hAVE aLL THE dOLLARS gONE?"\par PP 24-29\par \par p. i. - aPR 1989\par "tHE lAST sTRAW"\par PP 37-41 (P 38 IN PARTICULAR HAS A NICE\par DIAGRAM. fIG 1)\par \par \par sOUNDS, THESE ARTICLES ALSO SUGGEST AN INDIRECT METHOD OF DEALING WITH THE\par VOICE-ACTIVATED RECORDING DEVICE. oDDLY, A PURE SQUARE WAVE TONE (ROUGHLY\par AROUND 3100 HZ) WILL CAUSE A MAJOR SCREWUP IN THE SOUND-SENSING ABILITIES OF\par THE RECORDER. iT USUALLY WILL HAVE TO BE REPLACED. sUGGESTED VOLUME, GIVEN\par AT 6" RANGE IS 8.5+ DB. oBVIOUSLY, ANYTHING LOUDER WILL DO.\par \par aN INTERESTING SIDE-NOTE IS THAT THIS HAS BECOME A PAST-TIME OF SUBURBAN\par TEENAGERS!\par \par wELL, HOPE THIS GETS YOU STARTED! mORE WILL BE COMING IN THE NEXT EXCITING\par FILE!\par \par ---------------------------> over and out! -----------> count zero\par \par *************** tRACK lAYOUTS ************************\par \par tHIS IS OFF THE TOP OF MY HEAD, BUT IS 99% THERE. aLSO i'LL IGNORE SOME\par OBSOLETE STUFF.\par \par tHE PHYSICAL LAYOUT OF THE CARDS ARE STANDARD. tHE logical MAKEUP VARIES\par FROM INSTITUTION TO INSTITUTION. tHERE ARE SOME GENERALLY FOLLOWED LAYOUTS,\par BUT NOT MANDATORY.\par \par tHERE ARE ACTUALLY UP TO THREE TRACKS ON A CARD.\par \par tRACK 1 WAS DESIGNED FOR AIRLINE USE. iT CONTAINS YOUR NAME AND USUALLY YOUR\par ACCOUNT NUMBER. tHIS IS THE TRACK THAT IS USED WHEN THE atm GREETS YOU BY\par NAME. tHERE ARE SOME GLITCHES IN HOW THINGS ARE ORDERED SO OCCASIONALLY YOU\par DO GET "gREETINGS bILL sMITH dR." BUT SUCH IS LIFE. tHIS TRACK IS ALSO USED\par WITH THE NEW AIRLINE AUTO CHECK IN (psa, aMERICAN, ETC)\par \par tRACK 3 IS THE "off-line" atm TRACK. iT CONTAINS SUCH NIFTY INFORMATION AS\par YOUR DAILY LIMIT, LIMIT LEFT, LAST ACCESS, ACCOUNT NUMBER, AND EXPIRATION\par DATE. (aND USUALLY ANYTHING i DESCRIBE IN TRACK 2). tHE atm ITSELF COULD\par HAVE THE ABILITY TO REWRITE THIS TRACK TO UPDATE INFORMATION.\par \par tRACK 2 IS THE MAIN OPERATIONAL TRACK FOR ONLINE USE. tHE FIRST THING ON\par TRACK TO IS THE primary account number (pan). tHIS IS PRETTY STANDARD FOR\par ALL CARDS, THOUGH NO GUARANTEE. sOME ADDITIONAL INFO MIGHT BE ON THE CARD\par SUCH AS EXPIRATION DATE. oNE INTERESTING ITEM IS THE pin OFFSET. wHEN AN\par atm VERIFIES A pin LOCALLY, IT USUALLY USES AN ENCRYPTION SCHEME INVOLVING\par THE pan AND A SECRET key. tHIS GIVES YOU A "natural pin" (I.E. WHEN THEY\par MAIL YOU YOUR PIN, THIS IS HOW IT GOT GENERATED.) iF YOU WANT TO SELECT YOUR\par OWN pin, THEY WOULD PUT THE pin offset IN THE CLEAR ON THE CARD. jUST DO\par MODULO 10 ARITHMETIC ON THE nATURAL pin PLUS THE OFFSET, AND YOU HAVE THE\par SELECTED pin. your pin is never in the clear on your card. kNOWING THE pin\par offset WILL NOT GIVE YOU THE pin. tHIS WILL REQUIRED THE secret key.\par \par hOPE THAT ANSWERS YOUR QUESTION\par \par ************ dEPOSITS AT atmS ************************\par \par dEPOSITS ON atm:\par \par vARIOUS BANKS HAVE VARIOUS SYSTEMS. aS AN EXAMPLE, AT citiBANK A DEPOSIT WAS\par MADE TO A SPECIFIC ACCOUNT. yOUR ACCOUNT WAS UPDATED WITH A memo UPDATE,\par I.E. IT WOULD SHOW UP ON YOUR BALANCE. hOWEVER IT DID NOT BECOME available\par FUNDS UNTIL IT WAS VERIFIED BY A TELLER. oN THE ENVELOPE WAS cUSTOMER id\par NUMBER, THE ENVELOPE NUMBER AND THE eNTERED DOLLAR AMOUNT, THE BRANCH # AND\par THE mACHINE #.\par \par tHERE WAS ALSO A SELECTION FOR other payments. tHIS ALLOWED YOU TO DUMP ANY\par DEPOSIT INTO THE atm.\par \par wHAT ARE YOU ASSURED THEN WHEN YOU DEPOSIT TO AN atm ?\par \par 1) yOU HAVE A BANKING record (NOT A RECIEPT AT cITIBANK). iF YOU\par HAVE THIS RECORD, THERE IS A very HIGH PERCENTAGE THAT YOU\par DEPOSITED SOMETHING AT THAT atm.\par \par 2) sOME BANKS HAVE WAYS OF CREDITING YOUR DEPOSIT right now.\par tHIS COULD BE DONE BY A BALANCE IN ANOTHER ACCOUNT (I.E. A LONG\par TERM c.d. OR A LINE OF CREDIT.) tHAT WAY THEY CAN GET YOU IF\par YOU LIED.\par \par \par ************** atm sPLITTING A cARD IN HALF ***************\par \par i'VE WORKED WITH ABOUT 75% OF THE TYPES OF MACHINES ON THE MARKET AND none\par OF THEM SPLIT A CARD IN HALF UPON SWALLOW. hOWEVER, SOME networks HAVE A\par POLICY OF SLICING A CARD TO AVOID SECURITY PROBLEMS.\par \par tRUSTING AN atm. iNTRESTING YOU SHOULD BRING THIS UP, i'M JUST BRUSING UP A\par PAPER DESCRIBING A real SITUATION WHERE YOUR CARD AND pin ARE IN THE CLEAR.\par tHIS INVOLVES A CUSTOMER USING A BANK THAT IS PART OF A NETWORK. aLL THE\par INFORMATION WAS AVAILABLE TO FOLKS IN dp, IF THEY PUT IN SOME EFFORTS TO GET\par IT.\par \par \par mIS-iMPLEMENTATION OF AN atm pin SECURITY SYSTEM\par \par \par 1. sYNOPSIS\par \par iN AN eft (eLECTRONIC fUNDS tRANSFER) NETWORK, A SINGLE NODE WHICH DOES NOT\par IMPLEMENT THE PROPER SECURITY CAN HAVE EFFECTS THROUGHOUT THE NETWORK. iN\par THIS PAPER, THE AUTHOR DESCRIBES AN EXAMPLE OF HOW SECURITY FEATURES WERE\par IGNORED, NEVER-IMPLEMENTED, AND/OR INCORRECTLY DESIGNED. tHE HUMAN FACTORS\par INVOLVED IN THE FINAL IMPLEMENTATION ARE EXPLORED BY SHOWING SEVERAL MAJOR\par VULNERABILITES CAUSED BY A sAVINGS AND lOAN AND A REGIONAL eft NETWORK'S LACK\par OF VIGILANCE IN INSTALLING AN eft NETWORK NODE. wHILE USING AN eft SYSTEM AS\par AN EXAMPLE, THE CONCEPTS CAN BE EXTRAPOLATED INTO THE IMPLEMENTATION OF OTHER\par SECURED SYSTEMS.\par \par \par 2. bACKGROUND\par \par a SMALL sAVINGS AND lOAN WAS SETTING UP A SMALL (10 TO 16 atmS) PROPRIETARY\par aUTOMATIC tELLER mACHINE (atm) NETWORK. tHIS NETWORK WAS THEN INTENDED TO\par LINK UP TO A REGIONAL NETWORK. tHE MANUFACTURER OF THE INSTITUTION'S ONLINE\par BANKING PROCESSOR SENT AN ON-SITE PROGRAMMER TO DEVELOP THE REQUIRED\par INTERFACES.\par \par aN atm NETWORK CONSISTS OF THREE MAIN PARTS. tHE FIRST IS THE atm ITSELF.\par aN atm CAN HAVE A RANGE OF INTELLIGENCE. iN THIS CASE THE atm WAS ABLE TO\par DECODE A pin (pERSONAL iDENTIFICATION nUMBER) USING AN INSTITUTION SUPPLIED\par des (dATA eNCRYPTION sTANDARD) KEY. iT WAS THEN REQUIRED TO SEND A REQUEST\par FOR FUNDS TO THE HOST WHERE IT WOULD RECEIVE AUTHORIZATION.\par \par tHE SECOND PORTION OF THE NETWORK IS THE atm CONTROLLER. tHE CONTROLLER\par MONITORS THE TRANSACTION, AND ROUTES THE MESSAGE TO THE AUTHORIZATION\par PROCESSOR. tHE CONTROLLER WOULD ALSO GENERALLY MONITOR THE PHYSICAL DEVICES\par AND STATUSES OF THE atm.\par \par tHE THIRD PORTION OF THE NETWORK IS THE AUTHORIZATION SYSTEM. iN THIS CASE\par CUSTOMERS OF THE LOCAL INSTITUTION WOULD HAVE THE TRANSACTION AUTHORIZED ON\par THE SAME PROCESSOR. cUSTOMERS FROM FOREIGN (I.E. ONE THAT DOES NOT BELONG\par TO THE INSTITUTION THAT RUNS THE atm) INSTITUTIONS WOULD BE AUTHORIZED BY THE\par REGIONAL NETWORK. aUTHORIZATION COULD BE FROM A RUN-UP FILE WHICH MAINTAINS\par ESTABLISHES A LIMIT ON WITHDRAWALS FOR A GIVEN ACCOUNT DURING A GIVEN PERIOD.\par a BETTER METHOD IS AUTHORIZATION DIRECT FROM THE INSTITUTION WHICH ISSUED THE\par CARD.\par \par \par 3. sECURITY\par \par tHE SYSTEM HAS A TWO COMPONENT KEY SYSTEM TO ALLOW ACCESS TO THE NETWORK BY\par THE CUSTOMER. tHE FIRST IS THE PHYSICAL atm CARD WHICH HAS A MAGNETIC\par STRIPE. tHE MAGNETIC STRIPE CONTAINS ACCOUNT INFORMATION. tHE SECOND\par COMPONENT IS THE pERSONAL iDENTIFICATION nUMBER (pin). tHE pin IS HAND\par ENTERED BY THE CUSTOMER INTO THE atm AT TRANSACTION TIME. gIVEN THESE TWO\par PARTS, THE NETWORK WILL ASSUME THAT THE USER IS THE APPROPRIATE CUSTOMER AND\par ALLOW THE TRANSACTION TO PROCEED.\par \par tHE mAGNETIC STRIPE IS IN THE CLEAR AND MAY BE ASSUME TO BE REPRODUCIBLE\par USING VARIOUS METHODS, THUS THE pin IS CRUCIAL SECURITY.\par \par sECURITY pin SECURITY\par \par 3.1. pin SECURITY\par \par 3.1.1. pin KEY VALIDATION METHOD\par \par pinS CAN BE LINKED UP TO A PARTICULAR CARD IN A NUMBER OF WAYS. oNE METHOD\par PUTS THE pin INTO A CENTRAL DATA BASE IN A ONE-WAY ENCRYPTED FORMAT. wHEN A\par pin IS PRESENTED, IT WOULD BE ENCRYPTED AGAINST THE FORMAT IN THE DATA BASE.\par tHIS METHOD REQUIRES A METHOD OF ENCRYPTING THE pin GIVEN AT THE atm, UNTIL\par IT CAN BE VERIFIED AT THE CENTRAL SITE. pROBLEMS CAN ALSO OCCUR IF THE\par INSTITUTION WANTS TO MOVE THE pin DATA BASE TO ANOTHER PROCESSOR, ESPECIALLY\par FROM A DIFFERENT COMPUTER VENDOR.\par \par aNOTHER METHOD IS TO TAKE INFORMATION ON THE CARD, COMBINE IT WITH AN\par INSTITUTION pin ENCRYPTION KEY (pin KEY) AND USE THAT TO GENERATE THE pin.\par tHE INSTITUTION IN QUESTION USED THE pin KEY METHOD. tHIS ALLOWS THE\par CUSTOMER TO BE VERIFIED AT THE atm ITSELF AND NO TRANSMISSION OF THE pin IS\par REQUIRED. tHE RISK OF THE SYSTEM IS THE pin KEY MUST BE MAINTAINED UNDER THE\par TIGHTEST OF SECURITY.\par \par tHE pin KEY IS USED TO GENERATE THE NATURAL pin. tHIS IS DERIVED BY TAKING\par THE ACCOUNT NUMBER AND USING des UPON IT WITH THE pin KEY. tHE RESULTING\par NUMBER THEN IS DECIMIALIZED BY DOING A LOOKUP ON A 16 DIGIT DECIMALIZATION\par TABLE TO CONVERT THE RESULTING HEXADECIMAL DIGITS TO DECIMAL DIGITS. aN atm\par LOADED WITH THE APPROPRIATE pin KEY CAN THEN VALIDATE A CUSTOMER LOCALLY WITH\par NO NEED TO SEND pin INFORMATION TO THE NETWORK, THEREBY REDUCING THE RISK OF\par COMPROMISE.\par \par tHE pin KEY REQUIRES THE UTMOST SECURITY. oNCE THE pin KEY IS KNOWN, ANY\par CUSTOMER'S atm CARD, WITH CORRESPONDING pin CAN BE CREATED GIVEN A CUSTOMER\par ACCOUNT NUMBER. tHE atm ALLOWS FOR THE pin TO BE ENTERED AT THE atm IN TWO\par PARTS, THUS ALLOWING EACH OF TWO BANK OFFICERS TO KNOW ONLY ONE HALF OF THE\par KEY. iF DESIRED, A TERMINAL MASTER KEY CAN BE LOADED AND THEN THE ENCRYPTED\par pin KEY LOADED FROM THE NETWORK.\par \par tHE DECIMALIZATION TABLE USUALLY CONSISTS OF 0 TO 9 AND 0 TO 5, ("0" TO "f"\par IN HEXADECIMAL WHERE "f" = 15). tHE DECIMALIZATION TABLE CAN BE PUT INTO ANY\par ORDER, SCRAMBLING THE DIGITS AND SLOWING DOWN AN ATTACKER. (aS A SIDE NOTE,\par IT COULD BE NOTED THAT USING THE "STANDARD" TABLE, THE pin DIGITS ARE\par WEIGHTED TO 0 THROUGH 5, EACH HAVING A 1/8 CHANCE OF BEING THE DIGIT, WHILE 6\par THROUGH 9 HAS ONLY A 1/16 CHANCE.)\par \par wHEN HANDLING A FOREIGN CARD, (I.E. ONE THAT DOES NOT BELONG TO THE\par INSTITUTION THAT RUNS THE atm), THE pin MUST BE PASSED ON TO THE NETWORK IN\par ENCRYPTED FORM. fIRST, HOWEVER, IT MUST BE PASSED FROM THE atm TO THE atm\par CONTROLLER. tHIS IS ACCOMPLISHED BY ENCRYPTING THE pin ENTERED AT THE atm\par USING A COMMUNICATION KEY (COMMUNICATION KEY), tHE COMMUNICATION KEY IS\par ENTERED AT THE atm MUCH LIKE THE pin KEY. iN ADDITION, IT CAN BE DOWNLOADED\par FROM THE NETWORK. tHE pin IS DECRYPTED AT THE CONTROLLER AND THEN\par REENCRYPTED WITH THE NETWORK'S COMMUNICATION KEY.\par \par \par sECURITY\par pin SECURITY\par pin KEY VALIDATION METHOD\par \par \par mAINTAINING THE THE SECURITY OF THE FOREIGN pin IS OF CRITICAL IMPORTANCE.\par gIVEN THE FOREIGN pin ALONG WITH THE atm CARD'S MAGNETIC IMAGE, THE\par PERPETRATOR HAS ACCESS TO AN ACCOUNT FROM ANY atm ON THE NETWORK. tHIS WOULD\par MAKE TRACKING OF POTENTIAL ATTACKERS QUITE DIFFICULT, SINCE THE atm AND THE\par INSTITUTION THEY EXTRACT FUNDS FROM CAN BE COMPLETELY DIFFERENT FROM THE\par INSTITUTION WHERE THE INFORMATION WAS GLEANED.\par \par gIVEN THAT THE ENCRYPTED pin GOES THROUGH NORMAL COMMUNICATION PROCESSES, IT\par COULD BE LOGGED ON THE NORMAL i/o LOGS. sINCE IT IS SUBJECT TO SUCH LOGGING,\par THE pin IN ANY FORM SHOULD BE DENIED FROM THE LOGGING FUNCTION.\par \par \par 3.2. sECURITY vIOLATIONS\par \par wHILE THE eft NETWORK HAS POTENTIAL TO RUN IN A SECURED MODE GIVEN SOME OF\par THE PRECAUTIONS OUTLINED ABOVE, THE POTENTIAL FOR ABUSE OF SECURITY IS QUITE\par EASY. iN THE CASE OF THIS SYSTEM, SECURITY WAS COMPROMISED IN A NUMBER OF\par WAYS, EACH LEADING TO THE POTENTIAL LOSS OF FUNDS, AND TO A LOSS OF\par CONFIDENCE IN THE eft SYSTEM ITSELF.\par \par \par 3.2.1. vIOLATIONS OF THE pin KEY METHOD\par \par tHE TWO CUSTODIAN SYSTEM SIMPLY WASN'T PRACTICAL WHEN atmS WERE BEING\par INSTALLED ALL OVER THE STATE. tWO EXAMPLES SHOW THIS: wHEN ASKED BY THE\par DEVELOPER FOR THE pin KEY TO BE ENTERED INTO A TEST atm, THERE WAS FIRST A\par MASSIVE SEARCH FOR THE KEY, AND THEN IT WAS READ TO HIM OVER THE PHONE. tHE\par pin KEY WAS WRITTEN ON A SCRAP OF PAPER WHICH WAS NOT SECURED. tHIS IS THE\par pin KEY THAT ALL THE CUSTOMER pinS ARE BASED ON, AND WHICH COMPROMISE SHOULD\par REQUIRE THE REISSUE OF ALL pinS.)\par \par tHE IMPORTANCE OF A SYSTEM TO ENTER THE pin KEY BY APPROPRIATE OFFICERS OF\par THE BANK SHOULD NOT BE OVERLOOKED. iN PRACTICE THE atm INSTALLER MIGHT BE\par THE ONE ASKED TO ENTER THE KEYS INTO THE MACHINE. tHIS INDEED WAS\par DEMONSTRATED IN THIS CASE WHERE THE atm INSTALLER NOT ONLY HAD THE KEYS FOR\par THE sAVINGS AND lOAN, BUT ALSO FOR OTHER INSTITUTIONS IN THE AREA. tHIS WAS\par KEPT IN THE HIGH SECURITY AREA OF THE NOTEBOOK IN THE INSTALLER'S FRONT\par POCKET.\par \par hAVING A mASTER KEY ENTERED INTO THE atm BY OFFICERS OF THE BANK MIGHT ADD AN\par ADDITIONAL LAYER OF SECURITY TO THE SYSTEM. tHE ACTUAL pin KEY WOULD THEN BE\par LOADED IN ENCRYPTED FORM FROM THE NETWORK. iN THE EXAMPLE ABOVE, IF THE\par INSTALLER WAS AWARE OF THE TERMINAL MASTER KEY, HE WOULD HAVE TO MONITOR THE\par LINE TO DERIVE THE ACTUAL pin KEY.\par \par tHE USE OF A DOWNLINE ENCRYPTED KEY WAS NEVER IMPLEMENTED, DUE TO THE\par POTENTIAL COMPLICATIONS AND ADDED COST OF SUCH A SYSTEM. eVEN IF IT WAS,\par ONCE VIOLATED, SECURITY CAN ONLY BE REGAINED BY A COMPLETE REISSUE OF\par CUSTOMER pinS WITH THE RESULTING CONFUSION ENSUING.\par \par sECURITY\par sECURITY vIOLATIONS\par nETWORK VALIDATED pin sECURITY VIOLATIONS\par \par \par 3.2.2. nETWORK VALIDATED pin sECURITY VIOLATIONS\par \par gIVEN THE POTENTIAL FOR UNTRACED TRANSACTIONS, THE MAINTENANCE OF THE FOREIGN\par pinS SECURITY WAS EXTREMELY IMPORTANT. iN THE pin KEY EXAMPLE ABOVE, ANY\par VIOLATION WOULD DIRECTLY AFFECT THE INSTITUTION OF THE VIOLATORS. tHIS WOULD\par LIMIT THE SCOPE OF AN INVESTIGATION, AND ENHANCE THE CHANCE OF DETECTION AND\par APPREHENSION. tHE VIOLATION OF FOREIGN pin INFORMATION HAS A MUCH WIDER\par SPHERE OF ATTACK, WITH THE CORRESPONDING LOWER CHANCE OF APPREHENSION.\par \par tHE COMMUNICATION KEY ITSELF WAS NEVER SECURED. iN THIS CASE, THE DEVELOPER\par HANDED THE KEY TO THE BANK OFFICERS, TO ENSURE THE COMMUNICATION KEY DIDN'T\par GET MISPLACED AS THE pin KEY DID (tHIS WAY HE COULD RECALL IT IN CASE IT GOT\par LOST). gIVEN THE COMMUNICATION KEY, THE SECURITY VIOLATION POTENTIAL IS\par SIMPLE ENOUGH. tHE PROGRAMMER COULD SIMPLY TAP THE LINE BETWEEN THE atm AND\par THE CONTROLLER. tHIS INFORMATION COULD THEN GENERATE A SET OF pin AND CARD\par IMAGE PAIRS. hE WOULD EVEN HAVE ACCOUNT BALANCES.\par \par tAPPING THE LINE WOULD HAVE BEEN AN EFFORT, AND WORSE YET HE COULD GET\par CAUGHT. hOWEVER, HAVING THE i/o LOGS COULD SERVE THE SAME PURPOSE. wHILE\par ORIGINALLY DESIGNED TO OBSCURE pin INFORMATION IN THE i/o LOGS, THE FEATURE\par WAS DISABLED DUE TO PROBLEMS CAUSED BY THE REGIONAL NETWORK DURING TESTING.\par tHE i/o LOGS WOULD BE SENT TO THE DEVELOPER ANY TIME THERE WAS A PROBLEM WITH\par THE atm CONTROLLER OR THE NETWORK INTERFACE.\par \par tHE GENERATION OF pin AND CARD IMAGE PAIRS HAS A POTENTIAL FOR EVEN THE MOST\par SECURED SYSTEM ON THE NETWORK TO BE ATTACKED BY THE LAPSE IN SECURITY OF A\par WEAKER NODE. nEITHER THE COMMUNICATION KEY, NOR THE pin SHOULD EVER BE\par AVAILABLE IN THE CLEAR. tHIS REQUIRES SPECIAL HARDWARE AT THE CONTROLLER TO\par STORE THIS INFORMATION. iN THIS CASE, THE INSTITUTION HAD NO DESIRE TO\par INSTALL A SECURED BOX FOR STORING KEY INFORMATION. tHE COMMUNICATION KEY WAS\par AVAILABLE IN SOFTWARE, AND THE pin WAS IN THE CLEAR DURING THE PROCESS OF\par DECRYPTING FROM THE atm AND RE-ENCRYPTING WITH THE NETWORK KEY. aNY\par PROGRAMMER ON THE SYSTEM WITH ACCESS TO THE CONTROLLER COULD PUT IN A LOG\par FILE TO TAP OFF THE pinS AT THAT POINT.\par \par tHE LARGEST FAILURE OF THE SYSTEM, THOUGH, WAS NOT A RESULT OF THE ITEMS\par DESCRIBED ABOVE. tHE LARGEST FAILURE IN THE SYSTEM WAS IN THE METHOD OF\par ENCRYPTING THE pin BEFORE GOING TO THE NETWORK. tHIS IS DUE TO THE FAILURE\par OF THE NETWORK TO HAVE A SECURED KEY BETWEEN SITES. tHE pin WAS TO BE\par ENCRYPTED WITH A NETWORK KEY. tHE NETWORK KEY WAS SENT IN ENCRYPTED FORM\par FROM THE NETWORK TO THE atm CONTROLLER. hOWEVER, THE KEY TO DECRYPT THE\par NETWORK KEY WAS SENT ALMOST IN THE CLEAR AS PART OF THE START-OF-DAY SEQUENCE.\par \par aNY INFILTRATOR MONITORING THE LINE WOULD BE ABLE TO GET ALL KEY INFORMATION\par BY MONITORING THE START-OF-DAY SEQUENCE, DOING THE TRIVIAL DECRYPTION OF THE\par COMMUNICATION KEY, AND PROCEEDING TO GATHER CARD IMAGE AND pin PAIRS. tHE\par INFILTRATOR COULD THEN GENERATE CARDS AND ATTACK THE SYSTEM AT HIS LEISURE.\par \par sECURITY\par sECURITY vIOLATIONS\par nETWORK VALIDATED pin sECURITY VIOLATIONS\par \par \par tHE NETWORK-atm CONTROLLER SECURITY FAILURE IS THE MOST CRITICAL FEATURE\par SINCE IT WAS DEFINED BY A REGIONAL NETWORK SUPPORTING MANY INSTITUTIONS. tHE\par NETWORK WAS SUPPOSEDLY IN A BETTER POSITION TO UNDERSTAND THE SECURITY\par REQUIREMENTS.\par \par \par 4. tHE hUMAN fACTORS IN sECURITY vIOLATION\par \par iT IS IMPORTANT THE USERS OF A SYSTEM BE APPRAISED OF THE PROCEDURES FOR\par SECURING THE SYSTEM. tHEY SHOULD UNDERSTAND THE RISKS, AND KNOW WHAT THEY\par ARE PROTECTING. tHE BANK OFFICERS IN CHARGE OF THE PROGRAM HAD LITTLE\par EXPERIENCE WITH atm SYSTEMS. tHEY WERE NEVER FULLY INDOCTRINATED IN THE\par CONSEQUENCES OF A pin KEY OR COMMUNICATION KEY COMPROMISE. tHE OFFICERS\par SHOWED GREAT SURPRISE WHEN THE DEVELOPER WAS ABLE TO GENERATE pinS FOR\par SUPPLIED TEST CARDS. gIVEN THE POTENTIAL RISK, NOTHING MORE WAS DONE TO TRY\par TO CHANGE THE pin KEY, EVEN THOUGH, THEY WERE QUITE AWARE THAT THE pin KEY\par WAS IN THE DEVELOPER'S POSSESSION. tHEY ONCE EVEN CALLED THE DEVELOPER FOR\par THE pin KEY WHEN THEY WEREN'T ABLE TO FIND IT.\par \par tHE DEVELOPER HAD A DESIRE TO MAINTAIN A SMOOTH RUNNING SYSTEM AND CUT DOWN\par ON THE DEVELOPMENT TIME OF AN ALREADY OVER-BUDGET PROJECT. tOO MUCH\par SECURITY, FOR EXAMPLE MODIFYING i/o LOGS, COULD DELAY THE ISOLATION OR REPAIR\par OF A PROBLEM.\par \par tHE REGIONAL NETWORK WAS ACTUALLY A MARKETING COMPANY WHO SUBCONTRACTED OUT\par THE DATA PROCESSING TASKS. tHEY FAILED TO RECOGNIZED THE SECURITY PROBLEM OF\par SENDING KEY INFORMATION WITH EXTREMELY WEAK ENCRYPTION. tHE KEYS WERE ALL\par BUT SENT IN THE CLEAR. tHERE SEEMED TO BE A BELIEF THAT THE USE OF\par ENCRYPTION IN AND OF ITSELF CAUSED A NETWORK TO BE SECURED. tHE USE OF des\par WITH AN UNSECURED COMMUNICATION KEY GAVE THE APPEARANCE OF A SECURED LINK.\par \par tHE LACK OF AUDITS OF THE SYSTEM, BOTH IN DESIGN AND IMPLEMENTATION WAS THE\par FINAL SECURITY DEFECT WHICH ALLOWED THE SYSTEM TO BE COMPROMISED IN SO MANY\par WAYS. aN EXAMPLE OF THE sAVINGS AND lOAN'S INTERNAL AUDITORS FAILURE TO\par UNDERSTAND THE PROBLEMS OR TECHNOLOGY IS WHEN THE AUDITORS INSISTED THAT NO\par CONTRACT DEVELOPERS WOULD BE ALLOWED PHYSICALLY INTO THE COMPUTER ROOM. tHE\par FACT WAS, ACCESS TO THE COMPUTER ROOM WAS NEVER REQUIRED TO PERFORM ANY OF\par THE DESCRIBED VIOLATIONS.\par \par \par 5. sECURITY cORRECTIONS\par \par aS IN ANY SYSTEM WHERE SECURITY WAS REQUIRED, THE TIME TO IMPLEMENT IT IS AT\par THE BEGINNING. tHIS REQUIRES THE REVIEW OF BOTH IMPLEMENTATION ORMED TO\par VERIFY THAT THE PROCEDURES ARE FOLLOWED AS DESCRIBED IN THE PLAN. fINANCING,\par SCHEDULING AND MAN POWER FOR SUCH AUDITS MUST BE ALLOCATED SO SECURITY ISSUES\par CAN BE ADDRESSED.\par \par fOR THIS INSTITUTION, THE FIRST STEP WOULD HAVE BEEN TO INDOCTRINATE THE\par \par sECURITY cORRECTIONS\par \par BANKING OFFICERS OF THE RISKS IN THE atm NETWORK, THE VULNERABILITES, AND THE\par SECURITY MEASURES REQUIRED.\par \par \par cUSTODIANS OF ALL KEYS SHOULD BE WELL AWARE OF THEIR RESPONSIBILITIES FOR\par THOSE KEYS. a FALL BACK SYSTEM OF KEY RECOVERY MUST BE IN PLACE IN CASE AN\par OFFICER IS NOT AVAILABLE FOR KEY ENTRY.\par \par tHE COST OF INSTALLING HARDWARE ENCRYPTION UNITS AT THE HOST SHOULD BE\par INCLUDED IN THE COST OF PUTTING IN THE SYSTEM. tHE HOST UNIT COULD GENERATE\par DOWN-LINE KEYS FOR BOTH THE pin KEY AND THE COMMUNICATION KEY THUS MAKING IT\par MORE DIFFICULT TO DERIVE THESE KEYS WITHOUT COLLUSION FROM AT LEAST THREE\par PEOPLE.\par \par a SECURED COMMUNICATIONS KEY SHOULD BE ESTABLISHED BETWEEN THE nETWORK AND\par THE INSTITUTION. tHIS WOULD ALLOW FOR THE EXCHANGE OF WORKING COMMUNICATION\par KEYS. tHIS KEY SHOULD BE CHANGED WITH A REASONABLE FREQUENCY.\par \par aLL THESE AREAS SHOULD BE AUDITED IN BOTH THE SYSTEM SPECIFICATION AND\par IMPLEMENTATION TO MAKE SURE THEY ARE NOT BEING ABRIDGED IN THE NAME OF\par EXPEDIENCY.\par \par 6. sUMMARY\par \par iN THIS VIEW OF A SINGLE INSTITUTION, A NUMBER OF FAILURES IN THE SECURITY\par SYSTEM WERE SHOWN. tHERE WAS SHOWN A DEFINITE FAILURE TO APPRECIATE WHAT WAS\par REQUIRED IN THE WAY OF SECURITY FOR pinS AND KEYS USED TO DERIVE pin\par INFORMATION. aN AVOIDANCE OF UP FRONT COSTS FOR SECURITY LEAD TO POTENTIALLY\par HIGHER COST IN THE FUTURE. tHE KEY AREA WAS THE LACK OF AUDITS OF THE eft\par SYSTEM BY BOTH THE INSTITUTION AND THE NETWORK, CAUSING POTENTIAL LOSS TO ALL\par INSTITUTIONS ON THE NETWORK.\par \par fOR THOSE OF YOU WHO WOULD LIKE A DEEPER VIEW OF THES OF atm pin STUFF, i'M\par MERGING SOME PREVIOUS POSTINGS ALONG WITH A PAPER\par \par automatic transaction magnetic stripe format\par --------------------------------------------\par \par ansi x4.16 (1976) iso 3554\par \par \par ------------------------------------------------- <-- TOP EDGE OF CARD\par .223"\par ------------------------------------------------- <-----\par track 1 iata .110" |\par ------------------------------------------------- |\par track 2 aba .110" MAG STRIPE\par ------------------------------------------------- |\par track 3 thrift .110" |\par ------------------------------------------------- <-----\par \par \par track 1: DEVELOPED BY THE iNTERNATIONAL aIR tRANSPORTATION aSSOC. (iata),\par CONTAINS ALPHANUMERIC INFO FOR AUTOMATION OF AIRLINE TICKETING\par OR OTHER RESERVATION DATABASE APPLICATIONS.\par \par track 2: DEVELOPED BY THE aMERICAN bANKERS aSSOC. (aba), CONTAINS NUMERIC\par INFO FOR AUTOMATION OF FINANCIAL TRANSACTIONS.\par tHIS TRACK IS ALSO USED BY MOST SYSTEMS WHICH REQUIRE AN\par IDENTIFICATION NUMBER AND A MINIMUM OF OTHER CONTROL INFO.\par \par track 3: DEVELOPED BY THE tHRIFT iNDUSTRY, CONTAINS INFO, SOME OF WHICH\par IS INTENDED TO BE CHANGED (RE-RECORDED) WITH EACH TRANSACTION,\par E.G. CASH DISPENSERS WHICH CAN OPERATE "OFFLINE".\par \par \par DENSITY IN BITS CHAR LENGTH IN BITS INFO CONTENT\par PER INCH INCLUDING PARITY BIT\par --------------- -------------------- ------------\par \par \par track 1: 210 7 79 ALPHANUMERIC CHARS\par track 2: 75 5 40 NUMERIC CHARS\par track 3: 210 5 107 NUMERIC CHARS\par \par \par iNFORMATION IS READ RIGHT TO LEFT BEGINNING WITH THE sTART sENTINEL (ss)\par CHARACTER LOCATED AT THE RIGHT EDGE OF THE CARD.\par \par track 1:\par \par lrc | es | discretionary data | fs | name (26 CHAR MAX.) | ss\par (CODED CHAR SET: 6 BIT SUBSET OF ascii PLUS PARITY)\par \par track 2:\par \par lrc | es | discretionary data | fs | account number | ss\par (CODED CHAR SET: bcd 4 BIT SUBSET PLUS PARITY)\par \par track3:\par \par lrc | es | discret. data | as | use and security data | fs | account #\par | ss (CODED CHAR SET: bcd 4 BIT SUBSET PLUS PARITY)\par \par ss sTART sENTINEL\par fs fIELD sEPARATOR\par as aCCOUNT sEPARATOR\par es eND sENTINEL\par lrc lONGITUDINAL rEDUNDANCY cHECK\par \par fOR ERROR DETECTION AN ODD PARITY BIT IS INCLUDED IN EACH CHARACTER\par AND A LONGITUDINAL REDUNDANCY CHECK (lrc) CHARACTER IS ENCODED AFTER\par THE eND sENTINEL (es).\par }