Tue, Oct 24, 2006 page10

• New radio wave cards spark security fears

  SECURE INFORMATION? Credit cards with the account holders name and details embedded in a chip have some experts worried as the data can be easily skimmed

  • NY TIMES NEWS SERVICE
  • • 
    • 
    • 

  Tom Heydt-Benjamin tapped an envelope against a black plastic box connected to his computer. Within moments, the screen showed a garbled string of characters that included this: fu/kevine, along with some numbers.

  Heydt-Benjamin then ripped open the envelope. Inside was a credit card, fresh from the issuing bank. The card bore the name of Kevin E. Fu, a computer science professor at the University of Massachusetts, Amherst, who was standing nearby. The card number and expiration date matched those numbers on the screen.

  The demonstration revealed potential security and privacy holes in a new generation of credit cards -- cards whose data is relayed by radio waves without need of a signature or physical swiping through a machine. Tens of millions of the cards have been issued, and equipment for their use is showing up at a growing number of locations, including pharmacies, McDonald's restaurants and many movie theaters.

  

  Tom Heydt-Benjamin, left, and Kevin Fu, a University of Massachusetts professor, cull information from a credit card with a card reader in Amherst, Massachusetts, on Thursday.

  PHOTO: NY TIMES

  The card companies have implied through their marketing that the data is encrypted to make sure that a digital eavesdropper cannot get any intelligible information. American Express has said its cards incorporate "128-bit encryption," and J.P. Morgan Chase has said that its cards, which it calls Blink, use "the highest level of encryption allowed by the US government."

  But in tests on 20 cards from Visa, MasterCard and American Express, the researchers here found that the cardholder's name and other data was being transmitted without encryption and in plain text. They could skim and store the information from a card with a device the size of a couple of paperback books, which they cobbled together from readily available computer and radio components for US$150. They say they could probably make another one even smaller and cheaper: about the size of a pack of gum for less than US$50.

  And because the cards can be read even through a wallet or an item of clothing, the security of the information, the researchers say, is startlingly weak.

  Companies that make and issue the cards said that what looks shocking in the laboratory could not lead to widespread abuse in the real world, and that additional data protection and anti-fraud measures in the payment system protect consumers from end to end.

  "This is an interesting technical exercise," said Brian Triplett, senior vice president for emerging-product development for Visa, "but as a real threat to a consumer -- that threat really doesn't exist."

  The experiment was conducted by researchers here working with RSA, the security division of EMC, an information management and storage company.

  The companies contend that testing just 20 cards does not provide an accurate picture of the card market, which generally uses higher security standards than the cards that were tested.

  "It's a small sample," said Art Kranzley, an executive with MasterCard. "This is almost akin to somebody standing up in the theater and yelling, `Fire!' because somebody lit a cigarette."
• Most Popular

  • 1

    Napoli’s title hopes shaken by late Genoa equalizer

  • 2

    Privately owned city in Kenya taking on corrupt officials

  • 3

    MOE to encourage foreigners to work in Taiwan

  • 4

    Kane tastes first title as Bayern bid farewell to Mueller

  • 5

    Former president Tsai departs for Lithuania