Introduction |
|
xxiii | |
|
Part I Anatomy of Payment Application Vulnerabilities |
|
|
1 | (90) |
|
Chapter 1 Processing Payment Transactions |
|
|
3 | (22) |
|
|
3 | (2) |
|
|
5 | (1) |
|
|
5 | (1) |
|
|
6 | (1) |
|
|
6 | (2) |
|
|
7 | (1) |
|
|
7 | (1) |
|
|
7 | (1) |
|
|
7 | (1) |
|
|
8 | (1) |
|
|
8 | (3) |
|
|
8 | (1) |
|
|
9 | (2) |
|
|
11 | (1) |
|
|
11 | (1) |
|
|
11 | (1) |
|
|
12 | (4) |
|
|
12 | (1) |
|
|
13 | (3) |
|
|
16 | (3) |
|
Sale vs. PreAuth/Completion |
|
|
16 | (1) |
|
|
16 | (1) |
|
|
17 | (1) |
|
|
18 | (1) |
|
Special Transaction Types |
|
|
18 | (1) |
|
Key Areas of Payment Application Vulnerabilities |
|
|
19 | (3) |
|
|
22 | (3) |
|
Chapter 2 Payment Application Architecture |
|
|
25 | (30) |
|
Essential Payment Application Blocks |
|
|
25 | (9) |
|
|
25 | (3) |
|
|
28 | (3) |
|
|
31 | (1) |
|
Typical Payment Transaction Flow |
|
|
32 | (2) |
|
Communication Between Modules |
|
|
34 | (5) |
|
|
34 | (1) |
|
|
35 | (1) |
|
|
36 | (1) |
|
|
36 | (2) |
|
|
38 | (1) |
|
|
38 | (1) |
|
Deployment of Payment Applications |
|
|
39 | (11) |
|
|
39 | (1) |
|
|
40 | (1) |
|
Comparing Deployment Models |
|
|
41 | (2) |
|
Store EPS Deployment Model |
|
|
43 | (1) |
|
|
44 | (2) |
|
Hybrid POS/Store Deployment Model |
|
|
46 | (1) |
|
Gas Station Payment Systems |
|
|
46 | (2) |
|
|
48 | (2) |
|
|
50 | (5) |
|
|
55 | (36) |
|
|
56 | (1) |
|
|
57 | (26) |
|
|
59 | (1) |
|
|
59 | (8) |
|
|
67 | (10) |
|
Comparing PA-DSS and PCI DSS Requirements |
|
|
77 | (3) |
|
|
80 | (1) |
|
|
81 | (2) |
|
|
83 | (3) |
|
|
83 | (2) |
|
|
85 | (1) |
|
Mobile Payments Guidelines for Developers |
|
|
86 | (1) |
|
|
86 | (5) |
|
Part II Attacks on Point-of-Sale Systems |
|
|
91 | (74) |
|
Chapter 4 Turning 40 Digits into Gold |
|
|
93 | (32) |
|
|
93 | (1) |
|
Physical Structure and Security Features |
|
|
94 | (4) |
|
Why Security Features Fail |
|
|
97 | (1) |
|
Inside the Magnetic Stripe |
|
|
98 | (12) |
|
|
98 | (2) |
|
|
100 | (1) |
|
|
101 | (1) |
|
|
102 | (1) |
|
ISO Prefix and BIN Ranges |
|
|
103 | (2) |
|
|
105 | (1) |
|
|
106 | (1) |
|
|
107 | (3) |
|
|
110 | (1) |
|
Getting the Dumps: Hackers |
|
|
111 | (3) |
|
|
112 | (1) |
|
Largest Point-of-sale Breach |
|
|
113 | (1) |
|
Converting the Bits into Cash: Carders |
|
|
114 | (1) |
|
Monetization Strategies: Cashers |
|
|
115 | (1) |
|
Producing Counterfeit Cards |
|
|
116 | (5) |
|
|
118 | (2) |
|
|
120 | (1) |
|
|
121 | (4) |
|
Chapter 5 Penetrating Security Free Zones |
|
|
125 | (22) |
|
Payment Application Memory |
|
|
125 | (9) |
|
|
26 | (100) |
|
|
126 | (1) |
|
|
127 | (7) |
|
|
134 | (1) |
|
|
134 | (6) |
|
Traffic on Local Networks |
|
|
135 | (1) |
|
|
135 | (1) |
|
|
136 | (3) |
|
More Communication Vulnerability Points |
|
|
139 | (1) |
|
Exploiting Other Vulnerabilities |
|
|
140 | (4) |
|
Tampering With the Application |
|
|
140 | (1) |
|
Tampering With the Hardware |
|
|
141 | (1) |
|
Targeting New Technologies |
|
|
142 | (1) |
|
Attacks on Integrity and Availability |
|
|
143 | (1) |
|
|
144 | (3) |
|
Chapter 6 Breaking into PCI-protected Areas |
|
|
147 | (18) |
|
|
147 | (1) |
|
Data at Rest: The Mantra of PCI |
|
|
148 | (12) |
|
|
149 | (1) |
|
|
150 | (2) |
|
|
152 | (1) |
|
Insecure Storage of Encryption Keys |
|
|
153 | (4) |
|
|
157 | (3) |
|
Data in Transit: What is Covered by PCI? |
|
|
160 | (2) |
|
|
160 | (1) |
|
|
161 | (1) |
|
|
162 | (3) |
|
|
165 | (86) |
|
Chapter 7 Cryptography in Payment Applications |
|
|
167 | (28) |
|
|
167 | (1) |
|
Symmetric, Asymmetric, or One-way? |
|
|
168 | (2) |
|
|
170 | (2) |
|
|
170 | (1) |
|
|
171 | (1) |
|
|
172 | (4) |
|
|
173 | (1) |
|
|
173 | (1) |
|
Implementing Symmetric Encryption |
|
|
174 | (1) |
|
|
174 | (1) |
|
Blocks, Padding, and Initialization Vectors |
|
|
175 | (1) |
|
Encryption and Decryption |
|
|
175 | (1) |
|
|
176 | (5) |
|
Implementing Public-key Encryption |
|
|
177 | (1) |
|
|
178 | (1) |
|
|
178 | (1) |
|
|
179 | (1) |
|
|
180 | (1) |
|
|
180 | (1) |
|
|
181 | (5) |
|
Implementing One-way Encryption |
|
|
181 | (1) |
|
|
182 | (2) |
|
|
184 | (1) |
|
|
184 | (2) |
|
|
186 | (2) |
|
Attached vs. Detached Signatures |
|
|
186 | (1) |
|
Code and Configuration Signing |
|
|
187 | (1) |
|
Data File and Message Signing |
|
|
187 | (1) |
|
|
188 | (1) |
|
|
188 | (3) |
|
|
189 | (2) |
|
|
191 | (1) |
|
|
191 | (1) |
|
|
191 | (4) |
|
Chapter 8 Protecting Cardholder Data |
|
|
195 | (24) |
|
|
195 | (2) |
|
|
196 | (1) |
|
Encrypting Data End to End |
|
|
196 | (1) |
|
|
197 | (10) |
|
|
197 | (9) |
|
|
206 | (1) |
|
|
207 | (2) |
|
|
207 | (1) |
|
|
207 | (1) |
|
|
208 | (1) |
|
|
209 | (1) |
|
Point-to-point Encryption |
|
|
209 | (5) |
|
What Point-to-point Really Means |
|
|
209 | (1) |
|
|
209 | (1) |
|
|
210 | (1) |
|
|
211 | (3) |
|
|
214 | (1) |
|
Mobile and Contactless Payments |
|
|
215 | (1) |
|
|
215 | (4) |
|
Chapter 9 Securing Application Code |
|
|
219 | (32) |
|
|
219 | (10) |
|
|
220 | (1) |
|
Code Signing Certificates |
|
|
220 | (1) |
|
Creating the Root CA Using OpenSSL |
|
|
221 | (1) |
|
|
222 | (1) |
|
Creating a Production-grade Code Signing Certificate |
|
|
223 | (3) |
|
|
226 | (1) |
|
Implementing Code Signing |
|
|
227 | (2) |
|
Signing Configuration and Data Files |
|
|
229 | (8) |
|
|
229 | (1) |
|
|
230 | (1) |
|
|
231 | (1) |
|
Implementing Detached Signature |
|
|
232 | (3) |
|
|
235 | (1) |
|
|
235 | (1) |
|
Implementing Attached Signature |
|
|
235 | (2) |
|
|
237 | (5) |
|
|
237 | (3) |
|
|
240 | (2) |
|
|
242 | (4) |
|
|
242 | (1) |
|
|
243 | (2) |
|
Language-specific Guidelines |
|
|
245 | (1) |
|
|
246 | (3) |
|
|
249 | (2) |
|
Appendix A POS Vulnerability Rank Calculator |
|
|
251 | (6) |
|
Security Questionnaire and Vulnerability Rank |
|
|
251 | (1) |
|
|
252 | (1) |
|
|
252 | (1) |
|
POS Security Questionnaire |
|
|
252 | (3) |
|
|
255 | (2) |
|
Appendix B Glossary of Terms and Abbreviations |
|
|
257 | (8) |
Index |
|
265 | |