Back to the Internet Security IndexPosition Paper: Electronic Purse
by Paul Grosse - October 1999
Introduction
Cash has been around for many thousands of years and has worked reasonably well. However, with the growth on the Internet of ebusiness and ecommerce - where there is a genuine need for secure transactions - together with a push from the financial service sector to enhance the services offered to users, there is now competition between a number of smartcard based electronic purse or electronic wallet vendors to get their standard accepted as the standard upon which all transactions will be based.
Electronic purse is a term applied to a number of formats, each with different applications. At the moment, smartcard based systems tend to be a direct replacement for money that the user would have in his pocket and software based systems tend to be used for online purchases. There are already some systems on the market that make use of a smartcard based electronic purse and combine it with a reader to enable the user access to Internet based commerce via their PCs. Users of this system have the advantage of being able to use the smartcard in shops as well.
One of the biggest advantages to the banks of transferring transactions to an electronic based medium is that doing so will reduce yet further the requirement to transport large quantities of metal and paper around the country and reduce the number of staff required to interact with customers as a result. In addition, replacing cheques - with their unacceptable delays - with electronic money will speed up the processing of accounts, giving users access to their own funds.
Computer-based Purses
Computer-based purses are a means to online purchasing either for individuals or companies and take two forms with the user's details stored either at the user's end, in a dedicated program, or on the online shopping server. Currently, these tend to be a user-based support mechanism for use with existing credit cards or other credit mechanisms although there is no reason why they cannot all be extended to include the use of smartcard based products as some do already.
Client-based Programs
The client based programs tend to be a dedicated pop-up program that has the user's credit card details, address and other relevant information stored on the user's hard drive. This information is usually encrypted and protected with a password although there are a number of products that have encryption as an option. The advantage of systems like this is that the information can be called up by the user in a few seconds and pasted into any relevant online forms without the user having to remember numbers and other details and then type them all in without making any errors. As the program is self-contained, if the user forgets his password, he can type in the information again with only minor inconvenience.
Some of these programs also have buttons that allow immediate access to particular remote shopping sites or to search engines and may be configured by the user in order to reflect better, their particular needs. Some programs store your logins to various services in such a way that passwords are not revealed on the screen when the information is transferred to the Internet Shopping Service. This has the advantage of not providing keystrokes to any recently installed background program that is monitoring the keyboard thus precluding the interception of passwords.
The disadvantage of systems such as this is that the browsers that are used for online shopping contain many security loopholes that allow malicious users to download information from the client's computer without the user knowing about it. Script based attacks and even form based attacks will copy credit card details to another Internet address with the user finding out only when it is too late. The database of user's financial details and addresses can be downloaded whilst he is online without him suspecting anything and with shopping sites containing a large amount of graphics, the high demands on the user's connection to the Internet will not show any substantial change in function if the database is uploaded. It is unlikely that the average user will be sufficiently security aware to know that his browser has such capabilities, let alone be up-to-date with the latest patches.
Server-based Systems
Server-based systems tend to be associated with a particular shopping service which offer the user a virtual shopping mall with products, potentially from all over the world, available at the click of the mouse and delivery through the post. The merchants receive the visibility that they need to do business and this can help small to medium sized companies reach markets easily through a centralised service. Financial services are also included so that the user can take advantage of special offers and discounts along with preferential credit and payment terms.
The user enters his financial details, along with addresses, product preferences and so on. These details are stored centrally, on a server and therefore may be more secure than if they were stored on the client's machine. However, such a centralised store of financial information represents a significant target for any hacker that is lucky enough to be able to break in and therefore this information requires a significantly higher level of security in order to provide adequate protection for the user population. Companies that offer such electronic shopping malls are likely to be able to afford to employ trained staff for this purpose although there is no guarantee of this.
Smartcard-based Purses
Card-based payment systems have been around for a number of years - examples including phonecards and electricity payment cards. In these cases, a card, with a specific end-use, is bought over the counter for a sum of money and the card inserted into a reader on a telephone, electricity meter or similar device. Generally, the user population has become used to this and has accepted it although there were a number of verifiable stories of some users revitalising their phonecards with the careful application of a magnet.
Other magnetic strip card trials have included vending machines and general applications that substitute loose change. There are also a number of reader/writer devices that are available that allow the user to interfere with the information held on the card. All of these applications involve small amounts of money and any loss is one that the user would put down to experience. However, improvements in smartcard technology and implementations of public key cryptography with intrinsic non-repudiation now mean that larger amounts of information can be stored more securely than before.
In some countries, phonecards are based upon smartcard technology and the user is required to enter a PIN in order to gain access to the card. Whilst this stops unauthorised use, the loss or theft of the card still represents a denial of service for the authorised user. In addition to phonecards, some universities and military installations in Europe and the US have been using smartcards in closed systems for a number of years and extending this, a number of open system trials are in place in various parts of the world. Australia, Brazil, Canada, Chile, the Netherlands, Sweden and Switzerland are some countries where trials have taken place, usually with a few tens of thousands of cards and several hundred or a thousand readers but there are plans to extend these further as they become more accepted.
Smartcards have two purses, one protected with a PIN, for money that is secured, and one that is not protected that may be accessed immediately. In some countries, contactless cards are used for payment in mass transit systems and there are plans to make cards operate both as contact and contactless cards thus removing the need for a user to possess both types. Usually, electronic purse transactions involve a company receiving at the point of sale payment for a product or service. However, there are some pocket-sized smartcard readers that have slots for two smartcards and allow transactions in the field so it is possible to pay for a taxi or a grocery delivery using smartcards.
Smartcards were originally designed with a specific application burned into the chip. However, with the rate of development of new services to put on these chips increasing to such a level that it has become impractical to design and distribute a newly programmed card each time there is an innovation in the services offered, a different solution has been found. Open smartcards have emerged in the last two years and have provided a platform that can be programmed as new services become available.
The card presented to the user with the operating system and any other appropriate software already on the chip and with this, the user can go about his everyday business as usual. When a new service needs to be added, the software is downloaded securely and authenticated using an applet certification process. The fact that the downloading of Java Card applets is not covered by the Java Card standard means that the transparent distribution of applets from different manufacturers is prevented.
To combat this, Visa has written the Visa Open Platform Specification which defines extensions to the Java Card components involved thus allowing card interoperability for applet downloading and management. However, this does not stop badly designed applets from being downloaded, authenticated and run. There have been occasions when large, respectable software manufacturers have inadvertently distributed PC software with backdoors and viruses included so there is no reason to suspect that the same will not happen with smartcards, especially as applets will be developed by third party manufactures that are not necessarily very experienced in the security field.
In addition to breaches of security caused by either carelessness in checking source code on the part of the manufacturer or by the planting of malicious code into the code libraries used by the manufacturers in order to provide back doors into the system, the end user has a virtually unlimited amount of off-line access to the card. Modern smartcards do not have a clock on the chip - relying entirely on the card reader to supply a clock signal. This means that cards can be run as fast or as slow as the reader, or whoever controls the reader, wants. In this way, power consumption, pin voltages, various emissions and so on may be monitored at the hacker's leisure. The hacker is completely at liberty to use any software attack he pleases, generating faults and seeing how the smartcard responds or feeding it bogus information. The smartcard itself is powerless to take any preventative action as it can be stopped simply by taking away the clock signal.
Further, the user keystrokes on any card reader may be monitored as this is the only way that the authorised user has to communicate with the card. The key press information from the card reader can be stored for later use or transmitted to remote storage for later use therefore PINs form no protection against malicious use.
The chip itself has a comparatively large amount of storage capacity - 128kB in some cases - and some applications of smartcard technology include the keeping of medical records and other personal information. The ability of the card to store information regarding dates and times of transactions together with the identity of the other parties involved make smartcards ideal for use in shop loyalty schemes although there is no reason why this information cannot be used to keep an eye on the spending habits of individual users and lead to targeting of special offers or advertising campaigns.
Opinion
Nearly every company now recognises the need to be able to perform online transactions on the Internet and electronic commerce and business is set to increase spectacularly over the next few years. Any company that fails to take up the challenge while it has the opportunity will see its market share fall and may even go out of business. Clearly a single, universally accepted means of transferring funds in such transactions is required for this to work. In addition, many employers are beginning to find it more acceptable for their employees to have electronic money on them instead of carrying metal and paper around with them, sometimes for safety reasons. This also extends to military sites and universities where trials have been carried out successfully - a single smartcard being able to work as an ID card with a photograph of the holder, electronic wallet and a means of acting as an authentication token for entry to buildings, specific rooms or computer systems. With the amount of memory available on a card, they can be used for storing other data as well.
With their need defined and the user population already accepting them in the work place, it only makes sense to extend their functionality into the street where loose change transactions such as buying a newspaper or paying for public transport can be made simple by using the part of the wallet that is not protected by the PIN - public transport being a good case for contactless smartcards where users simply get on the bus, state their destination and sit down thus speeding up the processing of bus queues.
There are a number of vulnerabilities to take into account however - especially if the user has information on the smartcard that is of particular interest to hackers. Cards spend most of their time off-line and as they do not possess a clock of their own, are powerless to take preventative or protective measures that take more than one clock cycle. Hackers can collect information from a specially adapted smartcard reader in exactly the same way that they did so with an ATM machine - collecting users' PINs. There is no reason why the user should have any idea that anything untoward is happening.
In addition to this, cards may be subjected to various hardware monitoring and software attacks. A specially adapted card reader can be set up to monitor electromagnetic radiation from the card along with other analogue information such as current and voltage information for the chip's pins. If the chip contains sensitive information and does not need to be returned, the plastic part of the card can be dissolved, revealing the chip itself. Protective layers can be etched with acids, holes bored and contacts and wires monitored using fine tipped probes of the order of 100nm diameter. This type of probing need not damage the chip and it can remain fully functional. In addition, the surface may be scanned and the structures identified. In response to this, chip manufactures can scramble the components on their design and encrypt data but it must be remembered that hackers always have time on their side and it is probably a good idea not to put sensitive information onto a smartcard in the first place unless it is heavily encrypted and the keys are secure.
For the cards to become generally accepted, the public have to be reassured, in a convincing way, that any losses to them from their card will be underwritten by the banks and that information contained on the cards will be limited to what they feel comfortable with. Keeping information about past transactions may be of use to a store or other companies but it raises serious questions regarding civil liberties. If the potential user population sees smartcards as a way of keeping track on their whereabouts, they will never become accepted to any great extent.
Even though, in the last decade or so, phonecards have become accepted as a means of paying for telephone time, having the user's money on one may be perceived differently. Telephone cards involve payment being made by a human, to a human, face to face in a shop in exchange for a card with a certain amount of telephone time on it - the telephone company's time, not the user's money. Any fraud is almost always to the detriment of the telephone company and not to the user. Smartcards however, carry the user's personal wealth to use in any way he sees fit and if anything goes wrong, the user needs to know that he will not lose out.
Some claims of card system vendors include one that as everything can be encrypted, your money is safe on a smartcard and therefore it cannot be stolen. Claims such as this do not take into account the fact that if the physical card is stolen from the user, he cannot access any of the money on it either. In this respect, it has the same effect on the user as having his conventional wallet stolen. Paper money has on it the words 'I promise to pay the bearer on demand the sum of five pounds' and so on. If the user loses the notes in a fire or they fall apart in the washing machine, sending the silver strip and any remains to the bank of England will be met with a refund. There needs to be a similar assurance with any technology that replaces bank notes.
With software wallets for online shopping, there are the well known problems that relate to security loopholes in browsers and other pieces of software - the weaknesses in SSL3 with adaptive attacks has been covered many times before. Most home users do not have the benefit of a firewall nor do they receive regular bulletins regarding computer security vulnerabilities and hacker exploits. The biggest weakness of client based software solutions is that the credit card information and addresses may be transferred onto another machine, somewhere else on the Internet and, using a number of products that are now available, keystrokes may be monitored without the user knowing about it. Modems have become sufficiently fast for such a data transfer to go unnoticed leaving the hacker as much time as he needs to get at the user's information once he has collected it. Server based online shopping malls let the user upload his credit card details to a secure server that belongs to the company that runs the mall. While it is clearly in their best interests to look after the user's data and take every appropriate step to ensure that it remains safe, people do get their servers broken into.
However, one thing that needs to be appreciated is that, even though this is new technology has no single, universally accepted standard that works and the potential user population needs to be more informed about risks, the systems that have already been accepted by the user population are far less secure. Credit card security involves a number of vulnerabilities that are at best questionable. The use of publicly available information as a means of authentication is one that, if it was applied to a computer security product, would probably lead to litigation against the manufacturer by the users. The practice of handing over a credit card to people in shops and restaurants or telling people that the user has never met, over a public telephone system, all of the authentication data that is required to perform a transaction is beyond parody yet it is accepted. Some banking service providers recommend that if you have a lot of PIN numbers to remember, you should make them all the same. This is the user implemented Single Sign-On, along with all of its well known security weaknesses, being proposed by a banking service as a secure methodology. All of these points have to be taken in the context that credit cards are very successful.
Strengths
Weaknesses
Conclusion
Initially, most companies will be looking at electronic purses as a way of making the environment within the workplace more effective but, as time goes on, these cards should integrate with products and services that are offered by banks and other institutions off-site. The shift towards the electronic purse will probably be slow, in the same way that cheques took a number of years to become accepted. Unless banks make the already existing Internet banking perform better, it the uptake will become protracted and a great number of opportunities will be lost.
Even though there are a number of security issues concerning the implementation of electronic commerce and business, together with smartcard technology, the alternative systems that have already been accepted and are in place today are not particularly secure either. This either represents an opportunity for the financial institutions to supply a replacement system that is more secure, or an opportunity for complacency.
For companies that wish to take up the electronic purse, making the decision regarding which technology to opt for could prove to be expensive if the wrong one is selected. Many companies may choose to opt for a smartcard system that provides on-site authentication together with small amounts of cash for vending machines and so on. There are already magnetic strip systems that allow this to happen with a small outlay so it may be that at this stage, the most pertinent thing to do is to purchase a low cost system and wait for the standards to be established before making a greater investment.
Copyright (c) 1999 P. A. Grosse. All Rights Reserved.
Back
to the Index