SoylentNews is people
SoylentNews
Fuze card is wide open to data theft over Bluetooth. A fix is on the way.
The makers of the programmable Fuze smart card say it's powerful enough to be your wallet in one card yet secure enough to be used the same way as traditional payment cards—including trusting it to restaurant servers when paying the bill. But it turns out that convenience comes with a major catch. A flaw makes it possible for anyone with even brief physical control of the card to surreptitiously siphon all data stored on the device.
Fuze representatives said they're aware of the vulnerability and plan to fix it in an update scheduled for April 19. They also thanked the two researchers who, independent of one another, discovered the vulnerability and privately reported it. So far, however, Fuze officials have yet to fully inform users of the extent of the risk so they can prevent private data stored on the cards from being stolen or tampered with until the critical flaw is repaired.
Mike Ryan, one of the two researchers, said he created attack code that impersonated the Android app that uses a Bluetooth connection to load credit card data onto the smart cards. While the official Fuze app takes care to prevent pairing with cards that have already been set up with another device, Ryan's rogue app had no such restrictions. As a result, it allowed him to take complete control of a card, including reading, changing, or adding payment card numbers, expiration dates, and card-verification values.
https://arstechnica.com/?p=1290811
-- submitted from IRC
(Score: 2) by leftover on Wednesday April 11 2018, @11:06PM (3 children)
I worked on projects like this decades ago, including some sizable efforts. The very first thing to get right is the security. Smart cards have more than enough capability to design comprehensive solutions. The problems start when all the versions and permutations of Point-Of-Sale software has to implement the design correctly. Never underestimate the trouble this causes! For cards that encode for multiple accounts, multiply the POS terminal implementation problems by the number of applications plus key management systems. Then you get to add the fuming nitric acid: the POS terminal software needs to have a user interface for selecting which account to use. The alternative is to have a set of prioritization rules instead of the user interface. Have fun getting the account vendors to agree on that one.
Perhaps there is a planet out there somewhere on which such a system could actually reach operations before the "cooperating" vendors tore it to shreds. I do not believe it will happen on this one.
Bent, folded, spindled, and mutilated.
(Score: 2) by TheRaven on Thursday April 12 2018, @06:40AM (2 children)
I'm guessing none of the projects that you worked on enjoyed widespread commercial success. The very first thing to get right is the UI. That's what makes people adopt your system. You can then worry about security later because it's depressingly rare for a product to fail in the market as a result of poor security.
sudo mod me up
(Score: 0) by Anonymous Coward on Thursday April 12 2018, @11:45AM
Proprietary software dev 101.
(Score: 2) by leftover on Thursday April 12 2018, @11:52PM
My part of the UI was a gimme: Insert card in slot. The initiatives failed because each of the 'partners' wanted all of the gains. Had the projects gone on, the POS terminal UIs would have been a big problem due in part to extreme variations in hardware capabilities.
The security design was central to getting approval from the Feds, which it did. Not a Dev 101 software project at all.
Bent, folded, spindled, and mutilated.