We'll pay by smartphone, but let's not pay for dumb security

As we create the infrastructure for mobile electronic payments, we have to get the security right

It's a new dawn, people! As of today, you can walk into just about any Starbucks store and pay for your latte using nothing other than a (free) iPhone app, coupled to an existing Starbucks card account. That's right -- the day of mobile electronic payments is here at last! Ta-dah!

I will pause for the fanfare that it is sure to follow.

Still waiting.

OK, so, new infrastructure improvements don't often get much fanfare -- witness the DNSSEC and IPv6 rollouts.

Nonetheless, we truly (and finally) seem to be on the cusp of a whole new era in mobile payments. By most analyst accounts, the next generation of smartphones is sure to tackle mobile payments in a serious way.

There's a lot riding on the infrastructure for this. A stupid design mistake today can have long-term impact on all of us. Witness the (mostly) European Chip and Pin payment card system.

Researchers at Cambridge unearthed a design defect in the Chip and Pin system over a year ago. The defect enables a fraudster to make unauthorized payments using any valid (or cloned) Chip and Pin card, without needing either a PIN or a signature. (To be fair, that defect hasn't much slowed down Chip and Pin usage. With some 750 million of these cards in use, that's not going to change overnight, but rest assured that the card issuers are well aware of the problem.)

If a new payment system is rolled out to consumers only to be quickly cracked by attackers, no one wins. I'm not saying there are problems with the new Starbucks system (which was in testing for some time in limited markets). But if it does come to pass, the customers lose, the company loses and in the end, technology suffers a setback -- all quite possibly because of some silly design decision that failed to take attackers' capabilities into account.

I have the utmost confidence that a mobile payment system can be designed and implemented securely. If the engineers follow sound security principles, it's certainly within reasonable expectations that we'll have a ubiquitous and secure mobile payment system in the next few years. (I'm referring to something more general in purpose than the Starbucks system.)

But we can't afford bad judgment. Even well-intended security mechanisms can be implemented poorly. Take Apple 's hardware encryption of the iPhone (and other iOS devices), for example. All sensitive files on the file system are encrypted in hardware using AES with a key that is unique to each device. Sounds brilliant, right? Certainly, this is the stuff of breathtaking sales literature -- in which the security features are the hero for a change.

The problem is that Apple's engineers failed to adequately protect that unique encryption key, and the hardware encryption can be completely circumvented in seconds using freely available tools. That's what happens when you combine a brilliant idea with an implementation that wouldn't pass even the most casual scrutiny.

We have to get this right. For this new dawn of mobile payment systems to be accepted broadly by both consumers and enterprises, the system's security must be the hero.

Leave open the possibility of a man-in-the-middle attack anywhere in the system (as in the Chip and Pin system), and it will be exploited. Leave open the possibility of eavesdropping on a password, PIN or payment card account number, and it will most certainly be exploited. Leave open the possibility of someone spoofing a client or a server... You get the picture.

It is exactly because of how much is at stake that ubiquitous mobile payment systems didn't crop up years ago. Yes, plenty of smaller systems have been deployed, but the day of paying for anything from a can of soda to a car via your mobile phone has certainly not yet come to fruition in the U.S.

The stakes are indeed high, but we're staring at a point of confluence where the market pressures are finally overcoming the fear of screwing up. Everyone wants to be the first to get it right and to own the market (so to speak). We can thank ingenuity and competition for that.

So as consumers, we'll sit back and watch what happens as Starbucks and others roll out their offerings. I long for the day when I can throw away my wallet and just carry my (really) smart phone. If these efforts succeed, security will be the hero of the day -- albeit the unsung hero, no doubt. If it fails, it's a safe bet that security will be publicly flogged.

Whatever you do, guys and gals, don't screw this one up.

Now, I think it's time for that morning espresso. Where's my i4?

With more than 20 years in the information security field, Kenneth van Wyk has worked at Carnegie Mellon University's CERT/CC, the U.S. Deptartment of Defense, Para-Protect and others. He has published two books on information security and is working on a third. He is the president and principal consultant at KRvW Associates LLC in Alexandria, Va.

Read more about security in Computerworld's Security Topic Center.

Join the CSO newsletter!

Error: Please check your email address.

Tags starbucksAppletelecommunicationMobile and Wirelesssecuritymobile

More about AES EnvironmentalAppleCarnegie Mellon University AustraliaCERT AustraliaMellonPara-ProtectSECStarbucks

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Kenneth van Wyk

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts