Visa Inc. · NYSE:V
Visa — Technical Presentation (April 2016)
64 slides from Visa's technical presentation, Apr 13, 2016
Slide 1: Identifying, Preventing, and Mitigating Skimming Attacks
Identifying, Preventing, and Mitigating Skimming Attacks April 13, 2016 Sylvia Auyeung – Director, Merchant Risk, Visa Inc. Lester Chan – Director, Merchant Security, Visa Inc. Charlie Harrow – Solutions Manager, NCR Corp. | Identifying, Preventing, and Mitigating Skimming Attacks | April 13, 2016 V
Slide 2: Disclaimer
Disclaimer The information or recommendations contained herein are provided "AS IS" and intended for informational purposes only and should not be relied upon for operational, marketing, legal, technical, tax, financial or other advice. When implementing any new strategy or practice, you should cons
Slide 3: Agenda
Agenda • Global Data Compromise Landscape • Liability Shift and Increase in Skimming Attacks • Card Skimming – Criminal Trends • Safeguarding Against Skimming Attacks • How to Report a Skimming Device • Key Takeaways • Resources | Identifying, Preventing, and Mitigating Skimming Attacks | April 13,
Slide 4: Global Data Compromise Landscape
Global Data Compromise Landscape Sylvia Auyeung – Director, Merchant Risk, Visa Inc. | Identifying, Preventing, and Mitigating Skimming Attacks | April 13, 2016 Visa Public 4
Slide 5: Global Data Compromises
Global Data Compromises 2011-2015 • Global data compromise events are Compromise Cases by Region slightly higher in 2015 over those managed in 2014 • The U.S. is the largest contributor, CEMEA mainly due to its large mag stripe infrastructure and an increase in AP successful attacks on third party V
Slide 6: Global Data Compromises
Global Data Compromises Breach trends by merchant level Entity Type 2012 2013 2014 2015 Large breach events (levels 1 & 2) % % % % Level 1 <1% 1% 1% <1% Level 2 <1% 1% 1% <1% Level 3 1% 4% 4% 5% Level 4 95% 92% 93% 92% Agent <1% 1% 1% 2% Other 2% <1% 0% 0% Total 100% 100% 100% 100% 2012 2013 2014 20
Slide 7: EMV Liability Shift and Increase in Skimming Attacks
EMV Liability Shift and Increase in Skimming Attacks Lester Chan – Director, Merchant Security, Visa Inc. | Identifying, Preventing, and Mitigating Skimming Attacks | April 13, 2016 Visa Public 7
Slide 8: EMV Liability Shift and Counterfeit Fraud
EMV Liability Shift and Counterfeit Fraud Understanding how the liability shift affects fraud Oct. 2015 U.S. EMV liability shift (excludes AFD & ATM) Criminals continue to attack the Payment System to steal and monetize cardholder data Oct. 2017 U.S. AFD & ATM liability shift | Identifying, Preventi
Slide 9: EMV Chip Adoption & Fraud
EMV Chip Adoption & Fraud Fraud will likely migrate to other channels Liability shift Chip card adoption Fraud rate | Identifying, Preventing, and Mitigating Skimming Attacks | April 13, 2016 Visa Public 9
Slide 10: Fraud Migration to Other Channels
Fraud Migration to Other Channels Fraud migrating to e-commerce, automated fuel dispensers, and ATMs • Fraud and attacks will continue in CNP/e- • Scan for vulnerabilities commerce channels • Be aware of OWASP Top 10 • Insecure websites and mis-configured security settings • Work with a qualified in
Slide 11: Rise in Skimming Attacks
Rise in Skimming Attacks Criminals are targeting mag stripe data • Criminals are shifting their attacks to skimming • Increase skimming attacks in the news • Criminals are targeting: – Self-checkout terminals at stores – Automated fuel dispensers – White-label ATMs • Increasing in sophistication of
Slide 12: Card Skimming – Criminal Trends
Card Skimming – Criminal Trends Charlie Harrow – Solutions Manager, NCR Corp. | Identifying, Preventing, and Mitigating Skimming Attacks | April 13, 2016 Visa Public 12
Slide 13: Card Skimming: Trends
Card Skimming: Trends Skimming continues to be the #1 cause of fraud loss on ATMs. • Criminal techniques have grown increasingly sophisticated • Criminal techniques have diversified to avoid anti-skimming defences • An arms race has taken place - Industrialisation - Avoidance techniques - Sabotage -
Slide 14: "Traditional" Skimming Attack
“Traditional” Skimming Attack Skimmer added to fake panel over card slot. Camera concealed in fake panel above PIN Pad. | Identifying, Preventing, and Mitigating Skimming Attacks | April 13, 2016 Visa Public 14
Slide 15: Skimming History: full fascia overlays…
Skimming History: full fascia overlays… | Identifying, Preventing, and Mitigating Skimming Attacks | April 13, 2016 Visa Public 15
Slide 16: Getting smaller….
Getting smaller…. | Identifying, Preventing, and Mitigating Skimming Attacks | April 13, 2016 Visa Public 16
Slide 17: Getting smaller….
Getting smaller…. | Identifying, Preventing, and Mitigating Skimming Attacks | April 13, 2016 Visa Public 17
Slide 18: Smaller….
Smaller…. Six small batteries connected to micro Transmitter switches Circuit Micro Switches Transmitter Magnetic Read Antenna Head | Identifying, Preventing, and Mitigating Skimming Attacks | April 13, 2016 Visa Public 18
Slide 19: Smallest: Insert Skimmer, Germany
Smallest: Insert Skimmer, Germany | Identifying, Preventing, and Mitigating Skimming Attacks | April 13, 2016 Visa Public 19
Slide 20: Bypassing Passive Protection
Bypassing Passive Protection | Identifying, Preventing, and Mitigating Skimming Attacks | April 13, 2016 Visa Public 20
Slide 21: Bezel Overlay Skimmer - Canada
Bezel Overlay Skimmer - Canada | Identifying, Preventing, and Mitigating Skimming Attacks | April 13, 2016 Visa Public 21
Slide 22: Bulgaria
Bulgaria | Identifying, Preventing, and Mitigating Skimming Attacks | April 13, 2016 Visa Public 22
Slide 23: Skimming - Ireland
Skimming - Ireland | Identifying, Preventing, and Mitigating Skimming Attacks | April 13, 2016 Visa Public 23
Slide 24: Skimming - Ireland
Skimming - Ireland | Identifying, Preventing, and Mitigating Skimming Attacks | April 13, 2016 Visa Public 24
Slide 25: Skimming – UK
Skimming – UK | Identifying, Preventing, and Mitigating Skimming Attacks | April 13, 2016 Visa Public 25
Slide 26: Australia
Australia | Identifying, Preventing, and Mitigating Skimming Attacks | April 13, 2016 Visa Public 26
Slide 27: Insert Skimmers
Insert Skimmers | Identifying, Preventing, and Mitigating Skimming Attacks | April 13, 2016 Visa Public 27
Slide 28: Criminal Lab Raid: Germany
Criminal Lab Raid: Germany Card Reader Moulds and Surrounds | Identifying, Preventing, and Mitigating Skimming Attacks | April 13, 2016 Visa Public 28
Slide 29: Criminal Lab Raid: Germany
Criminal Lab Raid: Germany | Identifying, Preventing, and Mitigating Skimming Attacks | April 13, 2016 Visa Public 29
Slide 30: Bypassing Active Prevention
Bypassing Active Prevention | Identifying, Preventing, and Mitigating Skimming Attacks | April 13, 2016 Visa Public 30
Slide 31: Fascia penetration Switzerland
Fascia penetration Switzerland | Identifying, Preventing, and Mitigating Skimming Attacks | April 13, 2016 Visa Public 31
Slide 32: Ireland – Internal Attacks
Ireland – Internal Attacks | Identifying, Preventing, and Mitigating Skimming Attacks | April 13, 2016 Visa Public 32
Slide 33: Eavesdropping attacks expanding
Eavesdropping attacks expanding • Create hole in Fascia, typically under card orientation window • Attach to control electronics within card reader module • Fascia break-through “naturally” hidden • Impact as per “traditional” skimming • Different styles of eavesdropping device observed. | Identifyi
Slide 34: Eavesdropping - Global Expansion
Eavesdropping - Global Expansion Attacks continuing globally UK Canada | Identifying, Preventing, and Mitigating Skimming Attacks | April 13, 2016 Visa Public 34
Slide 35: Mexico – Internal Skimming: DIP
Mexico – Internal Skimming: DIP | Identifying, Preventing, and Mitigating Skimming Attacks | April 13, 2016 Visa Public 35
Slide 36: Mexico – Internal Skimming: DIP
Mexico – Internal Skimming: DIP | Identifying, Preventing, and Mitigating Skimming Attacks | April 13, 2016 Visa Public 36
Slide 37: "Deep" Insert Skimming
“Deep” Insert Skimming • Sits further into the card reader then typical insert skimmers • Intent of this technique is to defeat jamming technology which focuses on the bezel • Different styles of device observed • Devices often transmit card data in real time, no on board storage | Identifying, Prev
Slide 38: Deep Insert Skimmers - Variations
Deep Insert Skimmers - Variations New form factor Deep Insert Skimmers reported in Turkey and Ireland (not pictured). | Identifying, Preventing, and Mitigating Skimming Attacks | April 13, 2016 Visa Public 38
Slide 39: Sabotage: Attempts to Disable SPS
Sabotage: Attempts to Disable SPS • Criminal has attempted a crude attack on the SPS bezel to damage and disable the SPS electromagnetic disruptor • SPS anti-tamper sensors will detect and alert on a wide range of tamper conditions, including simple disabling attacks like this one. • ATM infrastruct
Slide 40: Attacks concerning CPK
Attacks concerning CPK Sabotage Cloning | Identifying, Preventing, and Mitigating Skimming Attacks | April 13, 2016 Visa Public 40
Slide 41: Software Skimming: Offline Malware Attack
Software Skimming: Offline Malware Attack • Insert to Card Reader 2. After inserting the fraud device into the reader, turn this handle clock-wise over 90 degree • Connector turned through 3. By turning the handle clock- 1. Direction of 90 deg. wise over 90 degree, the inserting the USB connector is
Slide 42: Network Sniffing: Internal and External
Network Sniffing: Internal and External Sniffing device connects inline with network cable Device is able to intercept and read all network traffic, including card data. A separate device is used to capture the PIN. Both overlays and cameras have been observed PIN capture device transmits th
Slide 43: 'Shimming' - Mexico, Greece, Portugal
‘Shimming’ - Mexico, Greece, Portugal Correct EMV implementation protects against this attack | Identifying, Preventing, and Mitigating Skimming Attacks | April 13, 2016 Visa Public 43
Slide 44: Bluetooth Skimming
Bluetooth Skimming Blog posts report internal skimming in Mexico Bluetooth devices transmit card and PIN data from inside the ATM. Bugs placed inside card reader and EPP High levels of corruption of service staff Attacks are not possible with latest EPPs Attacks highlight the importance
Slide 45: Stereo Skimming
Stereo Skimming Two confirmed reports of stereo skimming in Ireland ATMs were fitted with TMD CPK 6000 which failed to prevent the attacks. Stereo skimming uses 2 separate skimmers wired in differential mode to eliminate the effects of electromagnetic jamming Stereo skimming is very hard to
Slide 46: Card Skimming - Threat Summary
Card Skimming - Threat Summary Skimming Category Description Recommended Solutions Manufactured overlay containing a skimmer which fits a Bezel Overlay SPS with Skimmer Detect and Alert Monitoring specific ATM model Manufactured insert containing a skimmer which fits a Bezel Insert SPS with Skimmer
Slide 47: PIN capture: Keyboard Overlays
PIN capture: Keyboard Overlays Keyboard overlays increase work function for criminal - cost/effort Overlays have a higher probability of discovery Typically cameras are used to capture PINs SelfServ key design a small advantage New EPP design for SelfServ | Identifying, Preventing, and Mitig
Slide 48: PIN Pad Overlay - Mexico
PIN Pad Overlay - Mexico EPP overlay created by slicing the top from a genuine NCR PIN pad. Device fitted ‘correctly’ into the ATM, with original ATM PIN pad directly below it. Attacker required access into top box to fit the overlay. | Identifying, Preventing, and Mitigating Skimming Attack
Slide 49: PIN capture: Cameras……
PIN capture: Cameras…… | Identifying, Preventing, and Mitigating Skimming Attacks | April 13, 2016 Visa Public 49
Slide 50: PIN capture: Shoulder Surfing
PIN capture: Shoulder Surfing The gentleman on the left demonstrates the old fashioned way to capture a PIN……. | Identifying, Preventing, and Mitigating Skimming Attacks | April 13, 2016 Visa Public 50
Slide 51: Safeguarding Against Skimming Attacks
Safeguarding Against Skimming Attacks Charlie Harrow – Solutions Manager, NCR Corp. | Identifying, Preventing, and Mitigating Skimming Attacks | April 13, 2016 Visa Public 51
Slide 52: Three effective strategies to combat skimming
Three effective strategies to combat skimming Migrate from magnetic stripe Protect the installed base Identify anomalous behaviour Reduce the counterfeit card While mag stripe is still used, If the worst happens and risk we need effective, active, cards are skimmed, we must defended, preventio
Slide 53: Use of Contactless Card Readers as prevention from skimming risks
Use of Contactless Card Readers as prevention from skimming risks Magnetic Stripe Vulnerabilities Contactless Security Benefits Markets that use magnetic stripe are more vulnerable Eliminates the risk for card data to be skimmed to counterfeit by eliminating the DIP or swipe of the stripe EMV
Slide 54: Contactless EMV live today
Contactless EMV live today In November 2014, ANZ announced a world-first ATM EMV transaction: ‘Tap & PIN’ Faster Transaction Secure Contactless Transaction Seen as a good way to avoid skimming Mobile phone and ATM can communicate in a secure way ANZ claims 'world's safest ATM‘ source .. sour
Slide 55: Active Anti-Card Skimming
Active Anti-Card Skimming • Prevents skimming through object detection and electromagnetic disruption • Built in self defence using multiple anti-tamper sensors • Integration into ATM Software to provide flexible response to attack • Peripheral defences to prevent side channel attacks Optimum protec
Slide 56: Transaction Processing and Fraud Detection
Transaction Processing and Fraud Detection AUTHENTIC ACQUIRE Other (omni-channel CARD NETWORKS Channel SWITCH/ROUTE Systems transaction AND NATIONAL NETWORKS processing) AUTHORISE CORE MODEL DETECTION BANKING FRACTALS RULES DETECTION (Enterprise CARD MGMT. ALERT/ACTION Fraud Detection) …… INVESTIGAT
Slide 57: FINALLY - NCR SECURITY ALERTS
FINALLY - NCR SECURITY ALERTS Are you enrolled? • NCR have a proven set of solutions and practice recommendations to reduce your risk • Get on NCR’s Alert List • Notification of new attacks response.ncr.com/ security-alerts • Lock down your BIOS | Identifying, Preventing, and Mitigating Skimming Att
Slide 58: How to Report a Skimming Device
How to Report a Skimming Device Lester Chan – Director, Merchant Security, Visa Inc. | Identifying, Preventing, and Mitigating Skimming Attacks | April 13, 2016 Visa Public 58
Slide 59: Best Practices on Handling and Reporting
Best Practices on Handling and Reporting What to do if a skimmer is found Do not approach or confront anyone who Document and take pictures of the looks suspicious skimming device as-is Might be installing or removing a skimming Document before and after removal device Document date/time May be arme
Slide 60: How to Report a Compromise to Visa
How to Report a Compromise to Visa Reporting requirements after a skimmer is found Issuers (ATMs) Review Compromised Guidelines Complete Questionnaire Send to: USFraudControl@Visa.com * 1. Send Questionnaire to Visa Cyber Investigations with incident details 2. Try to determine the potential Window
Slide 61: How to Report a Compromise to Visa
How to Report a Compromise to Visa Reporting requirements after a skimmer is found for Merchants Review Compromised Guidelines Complete Questionnaire Send to acquirer 1. Acquirer will forward questionnaire to Visa Cyber Investigations with incident details 2. Skimming incidents often involve the com
Slide 62: Key Takeaways
Key Takeaways • Be aware that due to EMV liability shift, fraud and compromises will likely migrate • Recognize that criminals are targeting mag stripe data and transactions • Skimming devices are becoming more sophisticated • Understand how to identify different types of skimming devices • Learn be
Slide 63: Upcoming Events and Resources
Upcoming Events and Resources Resources • PCI Standards Council: Skimming Prevention • NCR Security Alerts: response.ncr.com/security-alerts • Visa’s “What To Do If Compromised” guidelines • Visa’s “Payment Acceptance Best Practices for U.S. Retail Petroleum Merchants” guidelines Upcoming Webinars –
Slide 64: Questions?
Questions? | Identifying, Preventing, and Mitigating Skimming Attacks | April 13, 2016 Visa Public 64