3D Secure online payment system not secure, researchers say
- 28 January, 2010 00:54
- Comments (25)
A widely deployed system intended to reduce on-line payment card fraud is fraught with security problems, according to University of Cambridge researchers.
The system is called 3-D Secure (3DS) but known better under the names Verified by Visa and MasterCard SecureCode. Implemented and paid for by e-commerce vendors, the systems require a person to enter a password or portions of a password to complete an on-line purchase.
As a reward for investing in the systems, merchants are less liable for fraudulent transactions and are stuck with fewer chargebacks. But banks such as the Royal Bank of Scotland are now holding consumers to a higher level of liability if fraudulent transactions occur using either system, said Steven J. Murdoch, a security researcher at the University of Cambridge.
That is despite what Murdoch and security engineering professor Ross Anderson contend are several flaws with 3DS. They wrote a seven-page paper on the topic, which Anderson presented on Tuesday at the Financial Cryptography and Data Security conference in Tenerife on Spain's Canary Islands.
One of their main points is how 3DS is integrated into Web sites during a transaction. E-Commerce Web sites display 3DS in an iframe, which is a window that brings content from one Web site into another.
The e-commerce Web site connects directly to a bank, which solicits a person's password in the iframe. If the password is right, the transaction is complete. But the researchers argue that since there's no URL displayed with the iframe, it's difficult to tell whether it's genuine or not.
3DS also allows people to set their password immediately as they enroll in the system, a process called "activation during shopping" (ADS). The ADS enrollment will ask for some other piece of information, such as a birth date, in order to confirm the setting of the password. That's a security issue since birth dates are easily obtainable, the researchers argue.
Since the password is also solicited during a transaction, people are less likely to carefully select one since they're more eager to complete the transaction, Murdoch and Anderson wrote. 3DS is vulnerable to phishing, where fraudsters use various methods such as spurious e-mails in order to elicit a person's password.
Customers are also unlikely to closely read the terms and conditions, which means customers could end up paying for bad transactions using their card. Murdoch said he hasn't heard, however, of a customer being held liable for a fraudulent 3DS transaction.
Murdoch said there are other systems on the market that guarantee that the person who is doing a transaction is who they say they are by using their mobile phone.
Those systems can involve generating one-time passcodes on a person's mobile phone that are entered as part of an e-commerce purchase. Another method is sending a SMS (short message service) verification to a person's mobile phone along with a one-time passcode that can be entered during the e-commerce transaction.
However, "most banks have chosen to go for passwords than anything better," Murdoch said. "Passwords are really cheap."
Merchants must pay to implement SecureCode or Verified by Visa, where the systems mentioned above would likely require the banks to spend money, Murdoch said.
In a statement, Visa defended its system, saying criminals will always try to defeat security measures but that it had reduced fraud and made consumers more comfortable with on-line transactions.
"Verified by Visa is one layer of security that makes fraud more difficult by helping to prove that a genuine cardholder is taking part in the transactions," the statement said. "Taken in isolation, this will not solve the massively complex issue of fraud, and Visa has never claimed that it would do so."
MasterCard officials could not be immediately reached for comment.
- Bookmark this page
- Share this article
- Got more on this story? Email PC World
- Follow PC World on twitter
-
Applications for Distributed Systems and Network Management
-
Photoshop CS
-
Mastering System Center Operations Manager 2007
-
Mastering Windows Network Forensics and Investigation
-
Wileyplus/Hs Subscription Stand-alone to Accompany Big Java 3E for Java 5 and 6
-
Iphone and iPod Touch Development
-
Teach Yourself Visually Dreamweaver Cs4
-
Mindmanager for Dummies
-
Microsoft SQL Server 2005 Express Edition for Dummies
3%
11%
Comments
Anonymous
Verified by Visa is intrusive crap
I tried buying an air ticket online, filled in all the usual stuff including my credit card info, and at the very end of the transaction, instead of processing the payment it sent me to Verified by Visa which wanted me to accept a multi-page legal agreement which I didn't have time to read, so I quit out of the transaction. As a result, Verified by Visa flagged the incomplete transaction as a fraud alert and my card issuer froze my card. I got it straightened out over the phone but it delayed my buying my ticket by a day or so, which luckily didn't result in a higher fare. The crazy thing is I was able to buy the ticket with Paypal (billed to the exact same credit card), without going through Verified by Visa.
More and more sites are using Verified by Visa and it's just obnoxious. Once you enroll there is no way to get out of it, so if a site insists on using it and doesn't offer another way to pay, I just won't buy from them.
Cliff
Citicard has a superior system
Citicard offers a far superior system called a "virtual credit card number". The way it works is that you go to a URL (which you can bookmark) that opens a little control panel (it's actually a Flash application) where you log into your Citicard account and request a one-time credit card number. You then use that number for your transaction. The number can only be used once, so if someone steals it after you have made your purchase they will not be able to use it. It is very convenient to use.
Anonymous
Link to the paper
Is there a working link to the research paper cited? I'm getting nothing but financial%20cryptography%20and%20data%20security/
Matt Melton
Allowing banks to avoid their fraud obligations
I hate it when I know the security and the banking/legal aspect of the whole thing, because it troubles me more than most.
This is just another method the banks are using to reverse the burden of proof in cases of fraud. It is a powerful play with no recourse of the powerless consumer.
From a legal standpoint, it is for the bank to disprove a customer's allegation of fraud - the burden lies with the bank. When you use systems such as 3DS, you give the bank an automatic burden-reversal card to play if you allege fraud. If *you* can't disprove the burden, you lose - it's evidence so close to intent (or recklessness as to) you'll never beat your bank in court.
Real fraud no longer low tech. Real fraud is high tech and very hard to explain (easy to trace != easy to explain). Criminals will find away to abuse the system. Whether it's socially engineering the chain of trust that results in someone walking into *your* bank with your card and resetting your 3DS ID, obtaining your entire identity by deception or intercepting wire-transfers between the banks. Either way, you won't know how or why and you won't have a reasonable defence.
Banks should remain obligated to pick up the mess for fraud - a common sense ideal given the inherent inequalities our relationships offer. An illusionary security measure so far from substance should never be relied upon to buy goods any more print your own bank notes.
eCert
Pointless
Another Password? This is not a security measure for verification, it's just another way to make brute force more difficult for website crackers. Pointless, more expensive for those website operators, and confusing for customers. <br>
This is not security. Was this initiative sponsored by the TSA?
Anonymous
Better systems
In Taiwan, you can buy a usb card reader for your credit card. Then you can use your computer as an ATM to transfer money to other people, or as a credit card terminal to pay online.
So it seems that with that system, you get the same security as you get at a store.
Better security is also provided by credit card with smart chips. Which have been deployed widely in various countries such as France and Taiwan.
Smart chip cards + card reader, seems like a better solution, yet one has to assume that it would be more expensive for the US banks than it is to just deal with the current fraud in the system....
Anonymous
... This is secure, how?
Any keylogged machine/compromised machine would then give the skimmed details, essentially the USB reader is an MSR... this means it reads the card in a format that can be then duplicated to another card.
I don't think that's a safe way to do it!
Martin
Links
Blog article: http://www.lightbluetouchpaper.org/2010/01/26/how-online-card-security-fails/
PDF: http://www.cl.cam.ac.uk/~rja14/Papers/fc10vbvsecurecode.pdf
Anonymous
No Kidding
I presented to visa Canada about my secure anonymous electronic financial transaction and that liked it, but said they already made a decision to go with this insecure system.
Note: they new it was insecure prior to implementation; They also knew there were secure systems that they rejected.
Also, they said that security was not their main concern (I almost fell off my seat...) It is customer service...
Greg Lehey
Verified by VISA: "Security" for morons
I've been suffering from this problem for years with "Verified by VISA". In addition to the problems described in this paper, they seem to have changed their password rules to make them less secure. On each occasion, my (secure) password was invalidated because it didn't match the preconceptions of the "security" people. Never mind, they told me--I could enter a new one online, with "security" information that is all available with a Google search.
The sad thing is that the banks don't seem to understand this, though they do point the finger at other people.
See http://www.lemis.com/grog/product-reviews/verified-by-visa.php for more details.
About this page: the link to the paper is broken. See the URL above for more details. If anybody can give me the correct URL, I'd be grateful.
Visa credit card processing
Merchant credit card processing
Verified by Visa doesn't evoke a feeling of trust from me.
I wouldn't waste my time using this when there are plenty of free<a href="http://www.acceptpayments.org"> payment processing solutions</a> that are far better with security.
Anonymous
Worried about security???
No surprise - when I was involved in the early days of ETF terminals (20 years ago) the banks cared about two things and only two things...
1. Their own liability and how much a legal action would cost them vs how much they could scam out of the public.
2. How good their spin doctors could make it look to the uneducated public.
Did anyone really expect anything to have changed?
Greg Lehey
Found that link
The correct link to the paper is http://www.cl.cam.ac.uk/~rja14/Papers/fc10vbvsecurecode.pdf
james_hutchinson@idg.com.au
Link now working
Sorry about that guys,
Link should now be working
Anonymous
SMS authentication far from secure
Murdoch is wrong to say that the SMS authentication system guarantees anything. Mobile platforms as an out of band password platform are becoming less and less secure every day if they ever were to begin with, doesnt he read the endless new phone hacks and trojans stealing mTAN stories? Also if you are doing the transaction from your mobile then there is nothing out of band about it.
As mobile operating systems have grown in complexity they have the same inumerable security holes as the pc os and criminals are focusing in on those without any extra difficulty in fact you dont even need to as most countries have anti competition legislation for their telecommunications companies which force them to allow customers (or criminals) to transfer or forward calls/SMS with very little difficulty or authentication other than date of birth. Not to mention almost any telecom worker even the little mobile huts can type in your number and read all your SMS's.
He did a great job of pointing out the holes in the VISA system which i wholeheartedly agree with however he should not try to offer up an even less secure method as a solution.
Rambo
Insane Discussion ....
None of the discussion is proving a point here... It is something Like Venus Project from Zeitgeist, discussing Democracy is Bad... Think thru the Other way around................
Santhosh
Understanding the real 3 D Secure
Guys
3D Secure allows the customer to actively participate and authenticate his e commerce purchase. However, 3DS does not force using a password for authentication. Authentication mechanism is completely at the discretion of the banks. Banks can authenticate users using a one time password sent to his registered mobile device, or initiate an out of band IVR call before completing the transaction etc etc.
Now the question which needs to be answered is how feasible are these authentication techniques.
1. One time password sent as an SMS: What would happen if the customer has not updated the bank with the correct mobile number, or he is traveling, or his phone is switched off, or his wife is making the purchase, SMS does not reach on time during festive seasons like Christmas, you are out of coverage area etc etc. Would the customer be still happy???.
2. Another example of phishing of secure systems (which is more dangerous) is when a citibank customer walks to a merchant and swipes his card. It also prompts for the ATM PIN . This looks very secure as the customer needs to enter the PIN which means even if his card is skimmed PIN is required to complete the transaction. However, you are now subjecting your ATM PIN also for phishing. The fraud merchant now has both the customer card details as well as his ATM PIN which means the fraudster can replicate the card and withdraw cash from the ATM. I would have been better off with a less secure card where i need not enter my ATM pin on a merchant POS i don't trust. Phishing can only be stopped with a combination of technology, process and awareness.
3. Smart card chips and card readers. Can you imagine the investment on the physical device the banks incur in shipping the device to millions of its customers. Bank would be happy with a few frauds instead.
I can keep going on with the draw backs of secure systems. They are either expensive or simply does not have the reach to the masses.
Summary is, no system is perfect. It has its up's and down's. Security, availability and usability does not go well with each other. Someone talked about paypal, does all merchants accept paypal. So for a more generic solution like VISA and Master card whose reach towards merchants and customers are huge, we need a generic solution which addresses the masses. You need to consider the demography, infrastructure, finance of your customers before implementing a secure solution. If you are complaining about a simple password being cumbersome imagine if you need to wait for an SMS, IVR call during a purchase.
I believe 3D Secure is a perfect solution. This system can learn and gradually upgrade its authentication mechanisms as per demographic and infrastructural growth. MOTO is to make it secure yet usable.
Vinnie
Simple steps
Some simple steps to follow:
1. Ask banks to use more questions to verify identity instead of just date of birth to reset password; disable activation while shopping.
2. Please dont ask pin
3. Ask random characters instead of full password
4. Never allow iframe; show proper URL to user
5. Use URL which is known domain of issuing bank. If it is HSBC then it should be HSBC.com domain. Otherwise it can be prone to phishing attack
6. Banks cannot offload their liability on to customers; otherwise there is no incentives for them to improve security of the transactions.
Daniel B
This is the banks responsibility, not VISA International
I have my self worked with implementing 3DS/VBV for a country, via a company that did the implementation/hosting. It was implemented closely with the company that authored the software, the local visa agency, and visa international. It was done very professionally.
It was implemented in such a way, that each bank is responsible for authenticating it's customers. This generally means implementing BankID, a common method of authenticating customers (also used to authenticate customers using online bank services). The banks then choose what way they want to implement BankID. Generally this means using 2-factor authenticating (some times in addition to account number or social security number), by using a password, and a key generator. The bank would then enroll series of visa/mastercard numbers into 3DS, until all it's series where enrolled. All the authentication is separate from VBV/3D, and it's separate from the banks. But it's the bank responsibility for securing the password, and key generators when setting it up, and sending it to the customer.
The key generator gives one time passwords, either by pressing a button, or by entering a pin code.
I honestly believe the 3DS framework/software is more than secure enough as it is, and it is the banks who are failing at implementing it at an secure manner. Letting customers set their password via ADS/birth day, is awful, in terms of security.
Other issues like iFrame, is a valid point, but there are several ways to implement 3DS/VBV, without the use of an iFrame. I've also worked with security/coding for a company that offers merchants online payment, via methods like credit cards, and there are several ways to implement this in a secure manner, without using iFrames.
Anonymous
cryptographic tokens
Cryptographic tokens (http://en.wikipedia.org/wiki/Security_token) have been in use, securing IT systems, for some years now and you can even get them for locking down your World of Warcraft account.
The concept is simple - supply a piece of information along with the cryptographic key that changes every 60 seconds. Your credit card information (a piece of information) would be useless if it was tied to an ever changing cryptographic key.
I informed my local bank that I would be happy to be part of a pilot of such a scheme (if one existed), but their blank expressions revealed, what I already knew, that IT security just simply isn't understood by the majority of people - this includes the banks that lose billions every year to identity theft and card cloning.
Btw - whenever I use the 3DS system, the in-frame dialog box fills in the user name (based on the card number) and displays the password reminder question, leaving only the password to fill in - secure eh?
Emmanuel Haydont
Misleading Title
The title of this article and of the research document is apparently criticizing the 3d Secure protocol where in fact it is developing about the weaknesses of the issuer authentication methods used. These are independent from the 3d Secure protocol which, by design, leaves to the issuer all the liberty on how he authenticates the cardholder. A fine implementation could be done in EMV or CAP, etc., fixing for some time the security issues raised in the research paper. Imho…
Anonymous
VbV and 3DSecure
The primary problem is acceptance. This product has been around for 8 years now and merchant participation is minimal due to cost and the fact that most merchants have either bought or developed more efficient authentication tools. While the security concerns are valid for 3D secure, if no merchants accept the product there is no level of security provided during shopping.
Anonymous
Verified by Via Doesn't Protect Consumers
Verified by Visa exists to protect merchants against chargebacks. It doesn't do much to protect consumers from fraudulent credit card transactions. Even if authentication that is stronger than passwords is used by banks, consumers are only protected if the fraudster is trying to make a purchase at a merchant that has implemented Verified by Visa. A thief could easily make fraudulent charges using stolen credit card information at a merchant that has not deployed Verified by Visa. If some sort of authentication system (Verified by Visa or something else) were truly intended to protect consumers from fraud, there would need to be a way to flag a credit card number that is enrolled, so that authentication would *always* be required when the enrolled credit card number is used, no matter what the merchant has deployed.
Bravo
VBV does protect the consumer as well
You have got the basic concept of VBV very wrong. If the fraudster uses the stolen card on a merchant who has not deployed VBV, then the chargeback liability is on the merchant not on the consumer.
Anonymous
Currently in dispute over a Secure 3D transaction.
This thread has been quiet for a couple of weeks so I don't know if anyone is reading it.
I'm concerned about the safety of the web implementation of 3D secure as I am currently disputing some large transactions done with my credit card. I am concerned about the way transactions have been handled between the merchants system, the authorisation system and the bank.
A few weeks ago I attempted a couple of large transactions to a vendor using an RBS mastercard. On each occasion the transaction failed after I filled in the 3D secure password, and it appeared that the transaction did not go through. I didn't pay a great deal of attention to the error message which appeared at the time. I am used to web systems occasionally breaking.
So I gave up on these payments. To my surprise when my credit card bill arrived (four weeks late as it happened but that is a different issue) the transactions were charged to the card.
However the vendor (which is a large government body, not a fly in the night cowboy website) cannot find the payments.
The bank is currently saying that the payments were made, while the vendor claims they never received them. As a result I am some thousands of pounds out of pocket at this point, and I'm being bounced around like a ping pong ball from one mega-corporate entity to the other, both denying this has anything to do with them.
This reeks to me of some kind of transactional bug in their systems, but I am very worried that from my position outside their systems I can't prove it. Its still early days as I will take this matter as far as I can... but I am very concerned that with government agencies increasingly mandating online payments that we are being forced to use less secure and less safe systems for making large payments.
3D secure feels like an ugly bolt on to the ecommerce process speaking as a consumer rather than a security expert. I'm really unclear that the error conditions have been fully thought through and tested through all eventualities.
I will be in financial trouble if I can't resolve this.
Post new comment