Monday, December 30, 2013

The Target breach, Encrypted PINs, and Customer Safety

On Friday I sat down with Jon Erlichman on Bloomberg West to discuss the recent Target breach, what we know, and what risks face consumers.
Timeline of events & what we know
Encryption of PINs
On Friday, December 27th Target revealed that the encrypted PINs had been compromised. The press release includes a few important statements:
  1. Target doesn't have the decryption key - "Target does not have access to nor does it store the encryption key within our system. The PIN information is encrypted within Target’s systems and can only be decrypted when it is received by our external, independent payment processor."
  2. Triple DES encryption - "PIN is encrypted at the keypad with what is known as Triple DES"
  3. Target claims customers are safe - "We remain confident that PIN numbers are safe and secure" and "debit card accounts have not been compromised due to the encrypted PIN numbers being taken" 
Are customers safe?
I'm not surprised to see Target attempting to calm customers' fears with their statements about the security of the PINs. However, I'm not convinced I'd support their optimism of safety.  Triple-DES encryption, when used correctly, does provide strong encryption and it would be infeasible to brute force the encryption key. However, even in an ideal use case there are several weaknesses to Triple DES that could impact the effective strength.

What could go wrong with Triple DES?
But, when used incorrectly Triple DES may only provide the illusion of security for these PINs. Here are two scenarios that could put PIN data immediately at risk:
In these situations the encrypted output would be the same if the input (i.e. the PIN) is the same. This allows attackers to perform analysis of the encrypted PIN data and compare the results with frequency analysis of PIN selection to make reasonable guesses about which encrypted value matches to what original PIN. In other words, if the most common encrypted value is "51 91 ca 27 be 68 c2 21" then there's a really good chance the original PIN for those users is 1234.

Other indications of concern
Another reason to be cautious about the safety of breached users is the actions taken by Chase. In the height of the Christmas season Chase bank changed limits for all impacted customers. This may be a cautionary move by Chase with memories of the 2009 RBS WorldPay attack that resulted in the loss of $9 million in a matter of hours. However, such a decision made in the prime spending hours of Christmas must have been thoroughly discussed and had supporting information justifying their concerns.

Lastly, we don't know what other information will be uncovered during the investigation, or worse, won't be uncovered because the investigation can't detect it. Target themselves initially reported that PINs were safe and unaffected only to later find out, as their investigation continued, that the encrypted values were stolen.

Advice to Customers
My advice for customers involved is to proactively request new debit cards. Credit card fraud can be easily reversed but debit card fraud can result in inaccessibility to lost funds for a period of time during the dispute.

-Michael Coates - @_mwc

Thursday, December 12, 2013

Gmail Changes Enables Tracking of User Email Activity

Changes to Gmail Image Handling Enables Tracking of User Activity with Emails

Google has just modified Gmail so images automatically load within emails.

An important privacy element was omitted from discussion with this change. The change to image handling in gmail creates a reliable method for companies and advertisers to track if a user opens any email sent by the company/advertiser.

This is accomplished since the image within the email can be accompanied with a unique URL parameter that acts as a tracking beacon. If a user opens the email then the image will be automatically loaded and the beacon will be sent back to a web server controlled by the sender. This provides an alert that the specific user opened the email.

Previously Gmail blocked images by default and required users to take a specific action to display the images. So while this beacon based email tracking has always been possible, the default handling in gmail previously made it an unreliable tracking method that wasn't worth the effort.

How Does The Tracking Work?
In this example the company sending the email would own
  1. Company crafts an email and includes an image with a tracking beacon number within a url parameter
  2. User opens the email within gmail and the browser automatically requests the image included in the email
  3. Google has modified the email so the image new resolves through the new proxy service. This means the url from step #1 now looks like this in the source
  4. The browser automatically requests the image
  5. The google proxy service at receives this request and makes an outbound request to
  6. The sender of the email returns picture.jpg and records that user 0001234 has opened the email

Here's a screenshot of my webserver showing the request which includes the URL parameter and also a mention to google's domain

[12/Dec/2013:23:48:10 +0000] "GET /Turkish_Van_Cat.jpg?id=01234 HTTP/1.1" 200 1718186 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv: Gecko/2009021910 Firefox/3.0.7 (via"

In practice companies wishing to track email activity will simply add a hidden 1 pixel by 1 pixel image that will perform this tracking unbeknownst to the end user.

Opt-Out Argument
The argument that you can opt-out of this new setting is a red-herring. If only those that read this post take actions to opt-out then the vast majority of people can still be tracked using this technique.

Security Win and Privacy Loss?
Perhaps there are security merits to this change. However, the collateral damage should not be ignored and overlooked in this change that impacts all gmail users.

-Michael Coates - @_mwc

Sunday, December 8, 2013

Missed OWASP AppSecUSA? Videos Online Now

OWASP AppSecUSA videos are now online here.
A quick wrap-up of AppSecUSA from Tom Brennan is posted here.
The whole catalog of owasp videos can be found here.

-Michael Coates - @_mwc