Comments on: Card Wars: The Phantom Menace http://www.lightbluetouchpaper.org/2008/08/05/card-wars-the-phantom-menace/ Security Research, Computer Laboratory, University of Cambridge Tue, 06 Jan 2009 21:05:02 +0000 http://wordpress.org/?v=2.6.3 By: Mike Bond http://www.lightbluetouchpaper.org/2008/08/05/card-wars-the-phantom-menace/#comment-29688 Mike Bond Wed, 06 Aug 2008 13:36:39 +0000 http://www.lightbluetouchpaper.org/?p=350#comment-29688 Chris, in theory yes all they need to do is to locate a disputed transaction, and get some footage of it to see who was responsible. I am not privvy to all the details of the example case I described of what they are and aren't trying, I just provided some early advice via the phantom site. One problem is that while shops may be covered in CCTV, not all ATMs are (all the disputed withdrawals in this case were at ATMs). Crooks may know which ATMs are not CCTV covered and target these deliberately, and cameras integrated into ATMs are rather uncommon here in UK unfortunately compared with US. But yes you are right that CCTV *should* be able to help in phantom cases, I just think you underestimate the bureaucratic barriers to actually using it. In practice it is rather hard to get hold of CCTV unless it is a criminal case going to court, and by then it is often too late. Often by the time I get to hear of a case it is also too late to preserve the CCTV. Chris, in theory yes all they need to do is to locate a disputed transaction, and get some footage of it to see who was responsible. I am not privvy to all the details of the example case I described of what they are and aren’t trying, I just provided some early advice via the phantom site.

One problem is that while shops may be covered in CCTV, not all ATMs are (all the disputed withdrawals in this case were at ATMs). Crooks may know which ATMs are not CCTV covered and target these deliberately, and cameras integrated into ATMs are rather uncommon here in UK unfortunately compared with US.

But yes you are right that CCTV *should* be able to help in phantom cases, I just think you underestimate the bureaucratic barriers to actually using it. In practice it is rather hard to get hold of CCTV unless it is a criminal case going to court, and by then it is often too late. Often by the time I get to hear of a case it is also too late to preserve the CCTV.

]]> By: Chris http://www.lightbluetouchpaper.org/2008/08/05/card-wars-the-phantom-menace/#comment-29687 Chris Wed, 06 Aug 2008 10:25:28 +0000 http://www.lightbluetouchpaper.org/?p=350#comment-29687 "providing logs from their authorisation system (BASE24), including all of the cryptograms, input data and transaction parameters covering the affected transactions. Everything turns on the Application Transaction Counter (ATC), an on-card counter which increments with every transaction initiated." I don't get it. Surely if the bank can provide all the details of the above transactions, then they should know the exact shop the person was in, and the time of the transaction? As we are one nation under CCTV, and these transactions are occuring over a small area, then either the shops should have CCTV which would cover who at the checkout at the time of the transaction, or there would possibly be external CCTV in say a shopping centre to check whether this couple entered or left the shop. Even allowing for CCTV Uselessabilty (i.e. the vast percentage of cases where a CCTV camera is suddenly needed for evidence, but due to [insert random pathetic excuse] the video was not recorded) there should be enough CCTV cameras working to record at least 1 of the mystery transactions. So any reason as to why this isn't being used? Chris “providing logs from their authorisation system (BASE24), including all of the cryptograms, input data and transaction parameters covering the affected transactions. Everything turns on the Application Transaction Counter (ATC), an on-card counter which increments with every transaction initiated.”

I don’t get it. Surely if the bank can provide all the details of the above transactions, then they should know the exact shop the person was in, and the time of the transaction?

As we are one nation under CCTV, and these transactions are occuring over a small area, then either the shops should have CCTV which would cover who at the checkout at the time of the transaction, or there would possibly be external CCTV in say a shopping centre to check whether this couple entered or left the shop.

Even allowing for CCTV Uselessabilty (i.e. the vast percentage of cases where a CCTV camera is suddenly needed for evidence, but due to [insert random pathetic excuse] the video was not recorded) there should be enough CCTV cameras working to record at least 1 of the mystery transactions.

So any reason as to why this isn’t being used?

Chris

]]>