<![CDATA[[SecurityRatty] tag: cryptosystems]]> http://securityratty.com/tag/cryptosystems Thu, 03 Jan 2008 23:06:57 +0000 iRatty Engine http://blogs.law.harvard.edu/tech/rss <![CDATA[MBTA Hack - Is it really this easy?]]> http://securityratty.com/article/f6ec916b224830aa520ce767a8418965 http://securityratty.com/article/f6ec916b224830aa520ce767a8418965 A lot of the focus of the MBTA vs MIT case has been discussion of the CharlieCards.  These are MiFare classic cards which have been known to be broken earlier this year.  There is also a paper disposable card called the CharlieTicket that uses a magnetic stripe.  The MIT students presentation states that these are cloneable and forgeable using a $150 magnetic stripe reader/writer.

From the Confidential Memo Prepared for the MBTA which was publicly disclosed by the MBTA is court filing:

This seems to break all the rules of integrity of sensitive data storage. How could someone store money on a magnetic stripe in 2008 and not store an identifier that references the account in a central database?

The tickets do have a unique identifier generated when the card is initially purchased so a fraud detection system could be in place or is planned. But this would require tracking the value on the ticket or the usage of the ticket centrally so it isn’t clear why the value is stored on the card in the first place.

There are so many question about the security of this public system.  Fraud costs the Massachusetts taxpayer money and refitting an insecure, ill-designed system costs the Massachusetts taxpayer money. [Disclosure: I am a Massachusetts taxpayer.]

It should be a requirement that the current system or the (hopefully) upgraded system be tested by an independent organization that specializes in cryptosystems.  If the independent testing uncovers vulnerabilities, they need to be fixed before the system is fielded. Then the system should be retested to verify the fixes.  Once the system is deemed secure by an independent organization, a summary of the test document should be published for public inspection.  It should include the types of testing conducted and the results.

The public trust requires inspection of taxpayer funded projects to make sure they meet acceptible standards and vendors held responsible for deficiencies.  Projects that use computers and software should not get a free pass. It will be interesting to see if the CharlieTicket system is ever held up to public scrutiny.

]]> Fri, 15 Aug 2008 09:19:29 +0000 massachusetts taxpayer taxpayer system fraud detection system system costs public system massachusetts taxpayer money charlieticket system charlieticket MBTA Hack - Is it really this easy? <![CDATA[MBTA Hack: Is It Really This Easy?]]> http://securityratty.com/article/1b9874427cf921ef00de8a56a8a8cab9 http://securityratty.com/article/1b9874427cf921ef00de8a56a8a8cab9 A lot of the focus of the MBTA vs MIT case has been discussion of the CharlieCards. These are MiFare classic cards which have been known to be broken earlier this year. There is also a paper disposable card called the CharlieTicket that uses a magnetic stripe. The MIT students presentation states that these are cloneable and forgeable using a $150 magnetic stripe reader/writer.

From the Confidential Memo Prepared for the MBTA which was publicly disclosed by the MBTA is court filing:

This seems to break all the rules of integrity of sensitive data storage. How could someone store money on a magnetic stripe in 2008 and not store an identifier that references the account in a central database?

The tickets do have a unique identifier generated when the card is initially purchased so a fraud detection system could be in place or is planned. But this would require tracking the value on the ticket or the usage of the ticket centrally so it isn’t clear why the value is stored on the card in the first place.

There are so many question about the security of this public system. Fraud costs the Massachusetts taxpayer money and refitting an insecure, ill-designed system costs the Massachusetts taxpayer money. [Disclosure: I am a Massachusetts taxpayer.]

It should be a requirement that the current system or the (hopefully) upgraded system be tested by an independent organization that specializes in cryptosystems. If the independent testing uncovers vulnerabilities, they need to be fixed before the system is fielded. Then the system should be retested to verify the fixes. Once the system is deemed secure by an independent organization, a summary of the test document should be published for public inspection. It should include the types of testing conducted and the results.

The public trust requires inspection of taxpayer funded projects to make sure they meet acceptible standards and vendors held responsible for deficiencies. Projects that use computers and software should not get a free pass. It will be interesting to see if the CharlieTicket system is ever held up to public scrutiny.

]]> Fri, 15 Aug 2008 09:19:29 +0000 massachusetts taxpayer taxpayer system fraud detection system system costs public system massachusetts taxpayer money charlieticket system charlieticket MBTA Hack: Is It Really This Easy? <![CDATA[What do you want to know about Cryptography in the Enterprise ?]]> http://securityratty.com/article/1ccb5ba45d5871381a74dd9b6c0265f1 http://securityratty.com/article/1ccb5ba45d5871381a74dd9b6c0265f1 I am working on a presentation entitled “Lessons Learned Deploying and Managing Enterprise Cryptosystems“. I will be presenting this at Information Security World 2008. In the 45 minutes I have for the presentation, it is my goal to touch on several key lessons learned in my work with cryptographic controls over the past several years. Cryptosystems is a broad topic, and can include not only techniques (encryption, digital signatures, timestamps), but also key management and implementation issues. There is a lot of material that I have available to draw from, and I want to make sure that the presentation includes the most valuable and relevant points that it can. After giving a presentation, there is almost nothing more disappointing than reviewing the feedback forms only to find out what people really wanted to know. This is especially disappointing if it is material you could have easily included…

I would love to know what kinds of questions you have and would like to see addressed.

In addition to your question, please provide a little context, such as:

- What are the drivers for your use of cryptographic controls (data protection, compliance, etc.)?
- Will your deployment be externally audited?

Cheers,
Erik

Cross posted on Linked In.

Art of Information Security would love your feedback !

What do you want to know about Cryptography in the Enterprise ?

]]> Thu, 03 Jan 2008 23:06:57 +0000 enterprise information security world presentation includes presentation information security enterprise cryptosystems cryptographic controls lessons cryptosystems What do you want to know about Cryptography in the Enterprise ?