When analyzing the security of PoS (Point of Sale) applications, we have to take into account the necessary involvement of magnetic stripes and cardholder data, which is extremely sensitive information, both for the holder and the financial institution that issued it.
In any location where information that needs to be protected and shielded exists, there is an urgent need to use cryptographic solutions. Originally used in the military, today they are capable of protecting the confidentiality and integrity of this kind of data. It's not enough to use security protocols alone – these must also be correctly applied and adjusted by customizing them both to the software and to the hardware.
As we might expect, cryptography is an essential component of PoS terminals, just as in all digital payment methods used today. In addition to the cornerstones of confidentiality and integrity, authentication and non-repudiation come into play too – in other words, a transaction cannot be allowed without the user’s knowledge.
In payment terminals, largely speaking, there are three groups of cryptographic algorithms that are used in a variety of technologies, where they are combined with each other and with various types of architecture inside PoS devices. Each of these groups offers different advantages and disadvantages.
The main areas in which major differences can be seen are power consumption, speed, and the ease of implementation in the different sections that make up PoS devices. Depending on the way a key is stored, the way to encrypt the communication between two points, – or the level of security required – one of the following types of algorithms will be used:
- Symmetric-key algorithms
The same key is used for both encrypting and decrypting the information. These algorithms are very quick, but also less “secure”, and require both sides to have already exchanged their key or password for communication to begin without exception. A couple of examples of symmetric-key cryptography are 3DES (Triple Data Encryption) and AES (Advanced Encryption Standard which is also known as Rijndael).
- Asymmetric-key algorithms
These contain two keys: one public and one private. This means one key cannot be used for both encrypting and decrypting the information. Both keys are generated at the same time. The private one remains shielded, being the one that will be used to read the communication, while the public one is distributed, being the one that will be used to write it. The usual scenario is that Person A writes a message to Person B and encrypts it with Persons B’s public key. Upon receiving, Person B uses their private key to decrypt the message and read it.
Two widely used examples of asymmetric-key cryptography or PKI (public key infrastructure) are emails sent through PGP/GPG (Pretty Good Privacy) and network traffic encrypted with SSL/TLS (Secure Socket Layer and Transport Layer Security), which is employed extensively by websites that are used for performing transactions or that require credentials to be entered.
- One-way hash algorithms
These functions capture information of variable length and generate what is commonly called a fixed-length hash output, based on the input. These functions when used in cryptography offer the benefit of being easy to calculate, and so they are used a great deal for protecting passwords, as in many cases it is difficult to regenerate the original input if you only know the hash value.
With encryption algorithms, size matters
A general rule for all encryption algorithms is “the bigger, the better”. This is due to the fact that the simplest way to attack the encrypted data is with a brute force attack, which tests all possible combinations of the bits until finally the sought-after string is found. With the data combination processing capacities of modern computers, it is possible to carry out brute force attacks on relatively large keys of many bits.
For example, DES with a 56-bit key (2^56 possible combinations) can be broken in less than a day, since average computers can perform a billion operations per second. However, the addition of more bits to the string will exponentially increase the time required to crack it. The most commonly used hash algorithms are MD5 (128 bits) and SHA1 (160 bits), although oddly enough these are not very robust in terms of security – as we’ve seen how MD5 had collisions and was weakend already back in 2005 when Wang and Yu of Shadong University in China demostrated how two different sequences could have the same MD5 and SHA1 collisions might be practical as stated by Bhargavan and Leurent in their most recent paper – compared with Triple DES or AES, which are recommended by the NSA.
Conclusion
The diversity of PoS terminal types, both modular and compact, continues to increase, while telecommunications technologies accompany them in their continual development, resulting in improved speed and availability. Nonetheless, in many cases, cryptographic algorithms do not accompany the development of PoS devices from the initial design phase. This leaves a window for cybercriminals to corrupt the systems and extract various types of information. For instance, we can confirm that within the ‘Cryptography security for remote dispenser transactions” patent, published in June 2000, that DES is believed to provide “the highest degree of security when used according to the invention described”. Furthermore, SHA1 is defined as a ‘Secure Hashing Algorithm” within the Cryptography security for remote dispenser transactions patent, which was published in 2011.
In future posts we will look at how malicious code can be used to circumvent these cryptographic processes in PoS terminals applied on specific layers, for the purpose of capturing sensitive information.
