Re: FV Demonstrates Fatal Flaw in Software Encryption of Credit Cards

Congratulations to FirstVirtual for having taken key-capture techniqures
that everyone has known about forever, and skillfully propagandizing it as
a 'fatal flaw in software encryption' playing on the technophobia of the
masses, who are afraid of computers already ("INFORMATION IS INSECURE THE
MOMENT YOU TOUCH A KEY". snork), to engeder widespread fear in encryption
("ENCRYPTING CREDIT CARDS ON THE DESKTOP IS NOT ONE OF THE SAFE
MECHANISMS"), thereby (hopefully) enhancing market share of FV, which
doesn't use encryption.

1) I remember Mr. Borenstein saying a year or two ago, something like "We
have nothing against encryption; we're just using a non-encrypting
technique for the moment, becuase it can be quickly, easily, and safely
deployed by us. Eventually,  we'll probably use encryption."    Apparently,
this propaganda piece marks a change of strategy.

2)  This is the first net distributed "security alert" distributed that
I've noticed, with almost no real content.  No one who knows a bit about
computer security learned anything they didn't already know from that
"alert".  Rather, it was distributed in the _form_ of a CERT-like alert,
but with the purpose and effect that is almost solely marketting of FV.
I'm sure we can expect many more now that FV has pioneered the
propaganda-as-alert technique--people are really scared about virus and
security risks, since they know nothing about them, and will pay a lot of
attention to them (witness "Good Times")--much more attention then they'd
normally pay an advertisement.  This masquerading advertisement is akin to
the advertisements masquerading as editorial content that you see in many
magazines not respectable enough to prohibit such things.

3)  I believe that FV works by assigning the user some sort of id number.
They send the id accross the net, FV has a database with "FV-ID" <->
credit-card-number correspondences, the merchant sends FV the id, FV bills
your card and pays the merchant.  Now, if I'm correct about how FV works,
we could clearly write a program that searches your HD for FVs data files,
extracts your FV-ID from it, and steals it.  It could be a virus, it could
send the FV accross the net, whatever.  We could then use your FV-ID to
make fraudulently make purchases through the FV system that would be billed
to you.  This is essentially the same attack as FV "demonstrates" against
software encrypted credit cards over the net: that is, the "You have an
insecure system and if we can put evil software on it, we can get you."
attack.

True, we wouldn't have your credit card number, and we couldn't order stuff
from LL Bean billed to you.  We could just order stuff from FV merchants.
So maybe it's marginally better.  Maybe.  But I can't see any way FV could
be immune to an attack of this sort.  I believe that all they do is give
you a first virtual ID number sent accross the net (in the clear!) in lieu
of your card number.      With an insecure PC as an assuption (and it is
probably a good one, actually), I can't see how FV could be immune from an
attack of this sort.   If Mr. Borenstein or anyone else thinks it is,
please explain how.

Sigh.

Excerpts from mail: 29-Jan-96 Re: FV Demonstrates Fatal F.. Jonathan
Rochkind@cs.obe (3157*)

> 1) I remember Mr. Borenstein saying a year or two ago, something like "We
> have nothing against encryption; we're just using a non-encrypting
> technique for the moment, becuase it can be quickly, easily, and safely
> deployed by us. Eventually,  we'll probably use encryption."    Apparently,
> this propaganda piece marks a change of strategy.

No, what it marks is a growing understanding.  When I said that, over a
year ago, I still thought that software encryption of credit card
numbers could be a workable solution.  I no longer do, based primarily
on my very recent realization that we could mount a multi-stage fully
automated attack on such systems.

> 3)  I believe that FV works by assigning the user some sort of id number.
> They send the id accross the net, FV has a database with "FV-ID" <->
> credit-card-number correspondences, the merchant sends FV the id, FV bills
> your card and pays the merchant.  Now, if I'm correct about how FV works,
> we could clearly write a program that searches your HD for FVs data files,
> extracts your FV-ID from it, and steals it.  It could be a virus, it could
> send the FV accross the net, whatever.  We could then use your FV-ID to
> make fraudulently make purchases through the FV system that would be billed
> to you.  This is essentially the same attack as FV "demonstrates" against
> software encrypted credit cards over the net: that is, the "You have an
> insecure system and if we can put evil software on it, we can get you."
> attack.

This is wrong on two main counts:  the ID's are harder to find than
credit cards, and they're not as directly useful as credit cards.  These
two facts combine to make the attack more or less irrelevant to FV.

First of all, the Virtual PIN (FV-ID) is much harder to extract from a
large data stream because it is arbitrary text, unlike credit card
numbers, which are self-identifying.

Second, a Virtual PIN is not a one-way payment instrument, like a credit
card.  To use FV to buy something on your credit card, you need to
combine the theft of a Virtual PIN with the compromise of the buyer's
email account, for confirming transactions.  We all know this can be
done -- we actually even spell out how to do it in our paper, "Perils
and Pitfalls of Practical CyberCommerce" -- but it is very hard to
combine these steps on the large scale that would be needed to mount an
automated attack, which is the most serious threat to the credit card
system.

> True, we wouldn't have your credit card number, and we couldn't order stuff
> from LL Bean billed to you.  We could just order stuff from FV merchants.
> So maybe it's marginally better.  Maybe.  But I can't see any way FV could
> be immune to an attack of this sort.  I believe that all they do is give
> you a first virtual ID number sent accross the net (in the clear!) in lieu
> of your card number.      With an insecure PC as an assuption (and it is
> probably a good one, actually), I can't see how FV could be immune from an
> attack of this sort.   If Mr. Borenstein or anyone else thinks it is,
> please explain how.

I hope that I jut did.  My guess is that you didn't understand the email
confirmation that is required for every purchase in the FV system.  For
more information, please see our web pages at http://www.fv.com.  --
Nathaniel
--------
Nathaniel Borenstein <nsb@fv.com>
Chief Scientist, First Virtual Holdings
FAQ & PGP key: nsb+faq@nsb.fv.com

Nathaniel Borenstein wrote:
> This is wrong on two main counts:  the ID's are harder to find than
> credit cards, and they're not as directly useful as credit cards.  These
> two facts combine to make the attack more or less irrelevant to FV.
> 
> First of all, the Virtual PIN (FV-ID) is much harder to extract from a
> large data stream because it is arbitrary text, unlike credit card
> numbers, which are self-identifying.
> 
> Second, a Virtual PIN is not a one-way payment instrument, like a credit
> card.  To use FV to buy something on your credit card, you need to
> combine the theft of a Virtual PIN with the compromise of the buyer's
> email account, for confirming transactions.  We all know this can be
> done -- we actually even spell out how to do it in our paper, "Perils
> and Pitfalls of Practical CyberCommerce" -- but it is very hard to
> combine these steps on the large scale that would be needed to mount an
> automated attack, which is the most serious threat to the credit card
> system.

  It would not be much harder than the demonstrated keyboard attack
to create a hacked version of winsock that would implement an
attack against First Virtual.  If the attacker had a list of web
pages that accept FV payments it would be very easy to collect
the ID numbers.  There is no need to attack the large datastream
of keyboard input when the search can be easily narrowed.  Since
FV doesn't use encryption the attack could easily be implemented
in winsock, making it independent of any client software.  A version
that infected the win95 IP stack could be quite effective.  The list
of FV accepting sites would be easily obtainable via a query of
altavista.  Since the infected system is on the internet and has
to periodically send its results to the attacker, it could download
an updated list of FV pages at the same time.  

  Attacking the e-mail verification step of the FV system could also
be accomplished via a hacked winsock.  A bit of POP3 aware code
in the winsock could intercept the verification messages and keep
the e-mail client from ever seeing them.  It could automatically
generate "Yes" responses for all such messages.

  I believe that FV is just as vulnerable to these types of
attacks as any of the encryption based credit card schemes, if
not more so.  The thing that really protects FV is that it can
only be used to buy bit, not real goods, and the bad guys don't
generally care about stealing bits.  This is also what makes FV
not generally useful to people who want to shop over the internet.

	--Jeff

-- 
Jeff Weinstein - Electronic Munitions Specialist
Netscape Communication Corporation
jsw@netscape.com - http://home.netscape.com/people/jsw
Any opinions expressed above are mine.

So there you have it - FV offers "security through irrelevancy"

> This is the first net distributed "security alert" distributed that
> I've noticed, with almost no real content.  No one who knows a bit about
> computer security learned anything they didn't already know from that
> "alert".  Rather, it was distributed in the _form_ of a CERT-like alert,

This sort of remark is just uncalled for.  The point NSB made in his
message was precisely that the average person does NOT know anything
about computer security.

While his alert is not necessarily designed for the audience on this
list, it is worth paying attention to because it brings up issues
which this list has had to deal with many times in the past.  One
classic example is usability of PGP.  If PGP is so good for the
masses, why aren't they just flocking to it.  The problem is that it
is more than just point and click.  User interfaces designed for the
masses go through endless hours of reviews dealing with "one click
or two" issues.  We can up the snobbery level and say, "if you
cannot take the time to protect your E-mail, then you deserve to
have your mail spied upon."

But I was under the impression that cypherpunks are supposed to lead
the way, not cut loose and run.

Ern