PCI, Why store Credit Card Numbers?

October 5, 2007 Leave a comment

Well it has been a while since I have posted anything.  I have been really busy this past month.  I was promoted to the  IT security  manager  at my current employer.   I am now dealing with IT security almost full time, they still need to fill my vacant position.  So I am much happier now not having to deal with a lot of the boring mundane task, and now instead get to do what I love, security.

I was reading another blog security blog entry and it got me thinking.  Why do POS systems have to store credit card numbers?  There really is no rational reason that I can think of.  I have had quite a bit of experience with a POS POS system (note that isn’t a mistake only 1 POS means Point of Sales).   The way credit card transactions work is that the stores POS system calls a card processing system.  The stores computer then asks the card processors computer if this credit card has enough money to cover this purchase.  If it does then it “reserves” these funds for the store for some time period and gives the store a magic approval number, no actual money is taken at that time.  I don’t know exactly why they do this, my guess is that they reserve a slightly higher amount of money than is actually needed so that it can be adjusted down if the transaction needs to be modified, IE you give the waiter a tip or you decide you really don’t want to buy that Iphone.

The store will then within a day or two do a batch settlement transaction where the store goes back to the card processor and says yes all these transactions really did happen so send us money.

So the only point in that process where the store actually needs the credit card number is the first transaction to the card processor.  After that the store could just use the unique authorization number to identify the transaction.  So now a hacker could still get credit card numbers but only in real time sniffing all the transactions as they go instead of the cue de gra 18 months or more that they currently can get if they hack into a POS system.

Categories: Security

Electronic voting reform

August 8, 2007 Leave a comment

I live in California where the Secretary of State Debra Bowen has allowed The University of California to test the E-Voting systems used in here in California.  What they found was that all of them are hackable. I find the preliminary findings very scary but not at all surprising.  The legislature of California are not Computer Security Experts but they should have consulted with and let Security Professionals verify that they were secure before Certifying the systems.  It is inexcusable to allow what is arguably the most important Computer System in the country to be so insecure.  These machines are what decide our election.  If you could modify the election results you could execute a bloodless coup and no one would be the wiser.   No one could prove that an election had been stolen if there is no paper trail.

I will give you one scenario.  All the electronic voting machines are stored in some medium security warehouse with a few guards and 1 or 2 cameras.  A disgruntled technician from company XYZ that makes $20,000 a year maintains voting machines is payed some large sum to hack the companies voting machines.  He is admitted entry into the facility do do “maintenance” He turns them all on and one by one inserts a USB thumb drive that installs a virus on each machine.  He also updates the BIOS and changes the checksum check that is used to verify that the operating system is certified, just like he has to do when he installs any patch.  This virus will change the vote on 41% of the votes in the favor of candidate FOO.  Thus virtually insuring victory.  This virus then removes all traces of itself and restores the correct checksum back into the BIOS at 7:55PM on election day.  With the current systems that have no paper trail and no one would find out unless someone starts looking at the technicians large bank account.

I am not saying to go back to all paper ballets, to me this is even more error prone and hackable than E-voting.  Just make up some ballet boxes and switch them in transit to the registrars office.  No to me the problem is fairly trivial technologically speaking.  The solution is 3 fold.  First and most simple a paper copy must be printed out and verified correct by the voter.  Thus ensuring a backup in case the electronic version is lost or tampered with.

The second part of my proposed solution is PKI (Public Key Infrastructure).  Each voter should be assigned a private key, a 3D bar code would work nicely.  This key should be assigned completely at random and only good for 1 election so that voting patterns couldn’t be data mined and somehow connect to an individual, there should also be no record kept of the voters private key only their public key should be kept.  This private key should be encrypted with a master public key so that there is no way a voters private key and identity could be obtained by coping it in transit unless the person also had the master private key.  The voter then would then scan their bar code and the voting machine would verify that it is a legitimate key by decrypting the key with the master private key.  The voter would then vote and the results would be signed with the users private key, and also be printed out.  If the results were tampered with the signature would not match and it would be obvious that the results were tampered with.  If two different votes were signed with the same private key you would also know that the user voted twice and to trow out all other votes signed with the same signature.   The  public keys and paper copies should be escrowed so that recounts could be done for some defined time.

The last and most important is both the physical security and openness of the system.  The inputs should be protected with 3DES encryption so that only certified devices could be plugged in.  No uncertified devices should be allowed on the system.  No one should be able to plug a key board in.  The case should be wielded shut and painted with a heat sensitive paint so any attempted tampering would be apparent.  The system should be completely open source from the OS to the voting software so that all code can be freely audited.  It someone did manage to hack the system the paper backup should throw up the red flag that the system was compromised.  The system should also be on an encrypted EEPROM so that even if you get into the case you can’t modify the EEPROM with out the key.  The key should be on a physically separate  dongle that is  locked up  separate from the voting machine and must be present when booting the machine and removed thereafter.  If any dongle is lost then all the dongles will have to be replaced and the EEPROM reprogrammed so it is very important that they don’t go missing.  The systems should never be plugged into an open network.  The system that collects the votes should also have a certificate assigned to it and stored on the voting machines so that the voting machines don’t disclose voting results to an unauthorized system.

All of this technology is common and in use today.  We need to reform the voting system so that we implement this as soon as possible.  If we don’t we may soon find our country not in our control anymore.  I don’t go into all the details about the system but I would love feedback, what are the weaknesses in the system I described.  If done correct E-Voting is both more efficient and more secure than paper based voting alone.

Categories: Geeky stuff, Security


July 23, 2007 Leave a comment

I just got the email I passed the CISSP exam that I took July 7th.  I just have to get my endorsement letter signed by my boss and send in my resume to ISC2.  I am glad I passed especially since it cost $500.00 of my own money.  Hopefully this will open up some doors professionally. I studied off and on for 2 months and crammed like crazy the last week.  I used the official ISC2 CISP book to do most of my studying but also took some practice tests that I found, and reviewed Shon Harris’s CISSP All in one Exam Guide book for some of my weaker areas.

Categories: misc, Security

Truncating Microsoft sql transaction logs

June 17, 2007 Leave a comment

I rarely touch MS SQL but I have to administer 2 instances, so I have had to learn some of the administrative tasks that have to be done from time to time. One of the less obvious task is truncating transaction logs. The MS SQLs transaction logs can get out of hand on databases that do a lot of writes. MS SQL does not purge transactions that have been committed in case you want to roll the database back to a point in time.  At some point after a back up you will probably want to get rid of the old data as it can quickly fill your hard drive. You have to manually truncated the old transactions by running


The easiest way to do this is to open up query optimizer and run it from there.

That will flush out all the old transactions that have already been committed to the database.  This however does not resize the file.  You will have to manually do this in enterprise manager by choosing shrink database.  If you have a scheduled maintenance plan that covers resizing; it will take place on its own the next time it is scheduled.

Categories: Geeky stuff

Snort IDS

May 22, 2007 Leave a comment

I am redoing the IDS system at work.  The current IDS uses snort and BASE.  Base just isn’t able to keep up under the current load.  We got a new quad core server with 4 gigs of ram that should do nicely for base.  I also decided to redo the sensors at the same time.  They were both running FreeBSD and I wanted to go to CentOS 5 because I am much more familiar with it than FreeBSD.  I installed CentOS 5 and did a test run with tcpdump.   It just can’t keep up the kernel is dropping packets even when loging just the raw packets to a file.  The traffic isn’t huge its about 3000 packets per second (around 32 Mbps).  Even after tunning some kernel parameters and some network parameters it was still dropping packets.

From what I have read the FreeBSD network stack is a lot better at this type of thing.  I am testing another FreeBSD box to see if it can keep up without dropping packets.  If it can keep up then I am going to use freeBSD for the sensors and stick with CentOS for the BASE front end.

UPDATE:  FreeBSD took it like a champ 0 dropped packets, so it looks like its FreeBSD for snort

Categories: Geeky stuff, Security

mdid Mysql authentication

November 3, 2006 Leave a comment

Mdid mysql authentication is finished, it is a dirty dirty dirty hack, but it works. Had to chop it into active directory authentication method since mdid does not support two different methods at the same time. Defiantly getting better at C# active directory took me a few days, since I don’t know how the AD api worked and also because I was hacking up someone else’s code. Mysql authentication took maybe 2 hours and most of that was googleing how to implement md5(base64) hashing in c#, it’s actually in System.Security.Cryptography which is nice, didn’t have to write my own function.

Categories: Geeky stuff

Compiling Apache

March 9, 2005 Leave a comment

One of my least favorite things to do is compiling apache. All the different modules are always a pain to get working. Webdav, modssl, php with gd curl fdftk pdflib etc, mod perl, etc. Unfortuantly I use odd addons to php so I almost have to compile. Finally after over a day of fussing I got a newversion up on the main web server. Now that I have curl I can finish my project for authinticating students using ssl and a php script on another server.

Categories: Geeky stuff