Mobile payments v1 1

Securing Mobile
Payments
v1.1

Witham Laboratories
1/842 High Street
East Kew 3102
Melbourne
Australia
Ph: +61 3 9846 2751

Witham Laboratories
Fax: +61 3 9857 0350

Rambla de Catalunya
38, 8 planta
08007 Barcelona
Spain
Ph: +34 93 184 27 88

Email: lab@withamlabs.com

PCI PTS PCI PIN PCI DSS PA-DSS
Witham Laboratories
Slide No. 1 Building Confidence in Payment Systems

Defining Mobile Payments
• What is “mobile”?
– Paying on a phone? Paying with a phone?
Accepting payments with a phone?
– What about other mobile devices:
• Tablets, laptops, e-readers, PMDs?
Witham Laboratories
1/842 High Street
East Kew 3102
– What about internet banking on a phone?
Melbourne
Australia
Ph: +61 3 9846 2751
Fax: +61 3 9857 0350
• ‘Mobile’ is often defined by the vendor
Rambla de Catalunya
38, 8 planta
08007 Barcelona
– Be aware that there are different meanings
Spain
Ph: +34 93 184 27 88

– Let’s look at some examples …
Witham Laboratories

Mobile payment examples

Witham Laboratories
1/842 High Street
East Kew 3102
Melbourne
Australia
Ph: +61 3 9846 2751
Fax: +61 3 9857 0350

Rambla de Catalunya
38, 8 planta
08007 Barcelona
Spain
Ph: +34 93 184 27 88


Witham Laboratories

• Contactless / NFC often used for mobile
– NFC = Near Field Communications
– Contactless NFC != RFID
– Provides processing on card
• RFID is just a contactless bar-code
Witham Laboratories
1/842 High Street
East Kew 3102
– Cards require ‘active’ EM field to operate
• Draw power from the field itself
Melbourne
Australia
Ph: +61 3 9846 2751
Fax: +61 3 9857 0350

Rambla de Catalunya • Limits range of independent access to card(s)
38, 8 planta

– Collision resistance and time-delays built in
08007 Barcelona
Spain
Ph: +34 93 184 27 88

to prevent accidental purchases
Witham Laboratories

Why is Mobile Different
• Aspires to be everything to everyone
– Card, bank, cash, Point of Sale register
• Mobile presents new sets of problems
– Different operating systems and vulns
• 400% increase in mobile virii since 2010*
Witham Laboratories
1/842 High Street – Zeus and Spyeye specifically target financial data
East Kew 3102
Melbourne
Australia
Ph: +61 3 9846 2751
• Keyboard auto-complete caches and location
Fax: +61 3 9857 0350
logging a potential for compromise
Rambla de Catalunya
38, 8 planta
08007 Barcelona • Rapid OS development and lack of knowledge
Spain
Ph: +34 93 184 27 88
/ visibility to approval bodies

* Android platform, “Malicious Mobile Threats Report 2010/2011” , Juniper Witham Laboratories

• Introduces new market players
– Google, Apple, Square, Intel
• New market dynamics
– Is security still a main customer concern?
• Mobile often seen as a cash replacement
• ‘As good as cash’ for security may be enough, if
Witham Laboratories
1/842 High Street
East Kew 3102
Melbourne
Australia
Ph: +61 3 9846 2751
coupled with increased convenience
– Customer interface changes
Fax: +61 3 9857 0350

Rambla de Catalunya
38, 8 planta
08007 Barcelona
Spain
Ph: +34 93 184 27 88
• Does the customer interface to the issuer or
the phone company? Who is the issuer?
Witham Laboratories

• Card data stored in ‘Secure Element’
– But how is the data transmitted?

Mobile Network Modem Payment
Network Network
User Interface
Witham Laboratories
1/842 High Street
East Kew 3102
Application
Melbourne
Australia
Ph: +61 3 9846 2751
Operating System
Fax: +61 3 9857 0350 Perso /
Rambla de Catalunya Update Secure Element
38, 8 planta POS /
08007 Barcelona Server POI
Spain
Ph: +34 93 184 27 88
NFC Controller

Witham Laboratories

PCI SSC and Mobile
• PCI taking a three pronged approach to
mobile payments
– PCI PTS approved add-on devices
• Must be approved to SRED requirements
• Can accept MSR and/or ICC, with/without PIN
Witham Laboratories
1/842 High Street
– PA DSS approved applications on certain
East Kew 3102
Melbourne
Australia
types of mobile devices
Ph: +61 3 9846 2751

– Working with mobile vendors for further
Fax: +61 3 9857 0350

Rambla de Catalunya

solutions around mobile payments
38, 8 planta
08007 Barcelona
Spain
Ph: +34 93 184 27 88

Email: lab@withamlabs.com • Expect more from PCI on mobile in the future
Witham Laboratories

PCI PTS v3 - SRED
• PCI PIN Transaction Security program
– Secure Reading and Exchange of Data
(SRED) module introduced in v3
– Non-PIN device class approvals in v3.1
• Secure Card Reader (SCR), non-PED
Witham Laboratories
1/842 High Street
East Kew 3102
• Allows for secure mobile transactions
– Approval of physically & logically secure
Melbourne
Australia
Ph: +61 3 9846 2751
Fax: +61 3 9857 0350

Rambla de Catalunya
38, 8 planta
encrypting card acceptance devices
– PIN / Chip / Stripe acceptance supported
08007 Barcelona
Spain
Ph: +34 93 184 27 88

with external hardware devices
Witham Laboratories

PA DSS and Mobile
• PCI SSC is cautious about approval of
mobile applications
– Three types of mobile apps defined
– PA DSS approval only for two types
– Work on-going regarding type 3
Witham Laboratories
1/842 High Street
East Kew 3102
Melbourne
Australia Category 1 Category 2 Category 3
Ph: +61 3 9846 2751
Fax: +61 3 9857 0350 PCI PTS Device Dedicated All other mobile
Rambla de Catalunya Payment Device payment software
38, 8 planta
08007 Barcelona
Spain
Ph: +34 93 184 27 88

Can be approved to PA DSS Cannot currently be
approved to PA DSS
PCI PTS PCI PIN PCI DSS PA-DSS Witham Laboratories
Building Confidence in Payment Systems
Slide No. 10

Mobile Payments Stats

Witham Laboratories
1/842 High Street
East Kew 3102
Melbourne
Australia
Ph: +61 3 9846 2751
Fax: +61 3 9857 0350

Rambla de Catalunya
38, 8 planta
08007 Barcelona
Spain
Ph: +34 93 184 27 88


Witham Laboratories

Mobile Events 2011
• Visa invest in Square (April)
• Visa release mobile best practice (April)
• PCI define 3 types of mobile apps (June)
• Google Wallet released in conjunction
Witham Laboratories
with MasterCard (Sept)
1/842 High Street

• PCI release PCI PTS v3.1 as a facilitator
East Kew 3102
Melbourne
Australia
Ph: +61 3 9846 2751
Fax: +61 3 9857 0350

Rambla de Catalunya
to secure mobile add-on devices (Sept)
38, 8 planta
08007 Barcelona
Spain
Ph: +34 93 184 27 88
• MasterCard / Intel co-operation (Nov)
• GSMA support for SIM based NFC (Nov)

Witham Laboratories

Visa Mobile Best Practices
• Provide secure code loading & updates
– Using known chain of trust
• Use secure coding best practices
• Protect encryption keys
Witham Laboratories
– PCI PTS and PA DSS referenced
1/842 High Street
East Kew 3102
Melbourne
Australia
• Allow for remote disablement
Ph: +61 3 9846 2751
Fax: +61 3 9857 0350

Rambla de Catalunya
– Reduce risk & threat of stolen device(s)
38, 8 planta
08007 Barcelona
Spain
Ph: +34 93 184 27 88
• Log and track sensitive operations
– Store remotely where possible
Witham Laboratories

Visa Mobile Best Practices
• Encrypt all public transmissions of data
• Protect account data from other apps
– Encrypting reader recommended (SRED)
• Provide truncation and/or tokenisation
Witham Laboratories
– Minimize storage of account data
1/842 High Street
East Kew 3102
Melbourne
Australia
• Protect stored PAN and sensitive
Ph: +61 3 9846 2751
Fax: +61 3 9857 0350

Rambla de Catalunya
account data
– By using encryption
38, 8 planta
08007 Barcelona
Spain
Ph: +34 93 184 27 88

– Only store SAD prior to authorisation
Witham Laboratories

Contactless Security
Lots of press on ‘Contactless pickpockets’

Witham Laboratories
1/842 High Street
East Kew 3102
Melbourne
Australia
Ph: +61 3 9846 2751
Fax: +61 3 9857 0350

Rambla de Catalunya
38, 8 planta
08007 Barcelona
Spain
Ph: +34 93 184 27 88

Is this a problem?
Witham Laboratories

Contactless Security
• CVV3 / CVC3 is used to dislocate data
on contactless card with MSR / ICC data
– Provides a unique value per transaction
– Uses information from the terminal
• Prevents replay attacks
Witham Laboratories
1/842 High Street
East Kew 3102
– Uses unique secret keys in card
• Mitigates card cloning
Melbourne
Australia
Ph: +61 3 9846 2751
Fax: +61 3 9857 0350

Rambla de Catalunya
38, 8 planta
• Contactless data can be intercepted,
08007 Barcelona
Spain
Ph: +34 93 184 27 88 but PAN/expiry only provides little value

Witham Laboratories

Security without CVM
• But there’s no PIN / signature!
– Contactless floor limits prevent large-scale
fraud using stolen card
– Scheme rules reduce cardholder liability
– Reduction in PIN use and CVV3/CVC3
Witham Laboratories
1/842 High Street
reduces incentives for skimming
East Kew 3102
Melbourne
Australia
Ph: +61 3 9846 2751
– Other scheme incentives reduce value of
PAN / expiry only data
Fax: +61 3 9857 0350

Rambla de Catalunya
38, 8 planta

• Documented fraud on contactless cards
08007 Barcelona
Spain
Ph: +34 93 184 27 88

in Australia very low
Witham Laboratories

Mobile Payments Security
• ‘Secure element’ used in phones
– To protect the cryptographic keys and data
– Current approvals to requirements such as
MasterCard CAST / EMV chip security
– Protects against side channel and physical
Witham Laboratories
1/842 High Street
attacks
East Kew 3102

• Secure element like a physical card chip
Melbourne
Australia
Ph: +61 3 9846 2751
Fax: +61 3 9857 0350

Rambla de Catalunya
38, 8 planta
on your phone
08007 Barcelona
Spain
Ph: +34 93 184 27 88 – Integration may expose new vulns
– Understand risks when assessing mobile

Witham Laboratories

What’s the Future for Mobile?
• Mobile payments will not disappear
– An area of growth, not a fad
• Contactless / NFC will play a big part
– Co-existence of other wireless interfaces
possible for the short term
• Mobile payments likely to push secure
Witham Laboratories
1/842 High Street
East Kew 3102
Melbourne

elements into phones
Australia
Ph: +61 3 9846 2751
Fax: +61 3 9857 0350

– Lead to other possible uses
Rambla de Catalunya
38, 8 planta
08007 Barcelona
Spain
Ph: +34 93 184 27 88

– Certification requirements may expand
beyond current CAST / EMV chip
Witham Laboratories

What’s the Future for Mobile?
• Understand what ‘mobile’ means to
your business
– Payment, banking, acceptance, other (?)
– Risk mitigations are different
• Look past the hype for the real story
Witham Laboratories
1/842 High Street
East Kew 3102
Melbourne
– Both in benefits and risks
Australia
Ph: +61 3 9846 2751
Fax: +61 3 9857 0350 • Be aware of emerging standards
Rambla de Catalunya
38, 8 planta
08007 Barcelona
Spain
– OK today may not be OK tomorrow
Ph: +34 93 184 27 88

Email: lab@withamlabs.com • Ensure CHD remains protected …
Witham Laboratories

Questions?

Witham Laboratories
1/842 High Street
For further information please contact
East Kew 3102
Melbourne
Australia
Andrew Jamieson
Ph: +61 3 9846 2751
Fax: +61 3 9857 0350
Technical Manager
Rambla de Catalunya
38, 8 planta
08007 Barcelona Witham Laboratories
Spain
Ph: +34 93 184 27 88

Email: andrew.jamieson@withamlabs.com
Phone: +61 3 9846 2751
Witham Laboratories

Mobile payments v1 1

Recommended

Recommended

More Related Content

Viewers also liked

Viewers also liked (9)

Similar to Mobile payments v1 1

Similar to Mobile payments v1 1 (20)

Recently uploaded

Recently uploaded (20)

Mobile payments v1 1