Computing and Software Wiki - User contributions [en]

Bots & Botnets

2009-04-11T00:53:46Z

SJakubowski: /* Bot? What is it?? How it works??? */

Each phase our world, had it's wealthiness such it has been with gold, commerce, industry and others on the last centuries. On this XXI century, the main wealthiness has been around information, and the spread of it. This information has been the key structure of our world's society, economy, health, development and others. And this vast information sea has been spread though the internet network, which evolved into a magnificent tool of knowledge power on the latest years. Unfortunately, malicious intentioned people have been using this consistent tool for the spread of threats such as viruses, worms, Trojan horses and others, again, to obtain confidential and powerful information such as bank accounts user names & passwords, confidential & military information or even CPU power to the increase of the spread of these threats. One powerful way of this spread, has been though Bots that integrate Botnets, which are the main focus on this research. This security breach has been one of the newest and most powerful threats relating to computer security within the last 5 years.
 

== Bot? What is it?? How it works???==

Thanks for asking if you could modify my page, or use my info. -SJakubowski.

A Bot is a type of malicious software that after successfully invading a machine (called Zombie computers), usually installed via worms, Trojan horses, or through Back doors, under a common command-and-control infrastructure. These new installed malicious software (Most likely to exist in machines that run on Windows OS (most used OS in the world), which don't have a file-user safe executing system like computers that run on Linux or Mac OS) behaves like a “worm” process, capable of spreading though the infected machine and having the power to connect to a communication channel (IRC, Web Server or P2P Server), allowing the attacker(Bot Herder) full control of this machine though a remote communication channel.
 
At this point, these infected machines can work only as tool used by the Bot Herders as they may please. Some of this malicious intentioned people use this Bot commanded machines to obtain certain valuable information from users, or also, to integrate these Bot Clients to a much greater threat and risk, such as a Botnet.
 

== Botnet? What is it?? How it works??? ==
A Botnet consists of a Bot server connected to one or more Bot clients. This set of Bots integrate the zombie machines into a really powerful and sophisticated invasion technique of a mass control of a a network.
 
This invasion technique has evolved not only to an illegal way of profit, but also to a way of violating people's information privilege. What have been Botnets being used for? Is the concept of Botnet Evil? What measurements are being taken to control this terrible plague?. On the following sections, this article will discuss ways to detain this astonishing threat which has been vastly used as one effective malicious way of breaking into data integrity, availability and confidentiality of computers of a network.
 

== Hard to exterminate...why? ==
A Botnet is adaptive; it can be designed to to download different modules to exploit specific things that it finds on a victim. New exploits can be added as they are discovered. This makes the job of the anti-viruses systems way more complex. Finding one component of a Botnet does not imply the nature of any other of the others components because the first component can choose to download from any number of modules to perform the functionality of each phase in the life cycle of a Botnet.
It also casts doubt on the capability of anti virus software to claim that a system is clean when it encounters and cleans one component of a multi-component bot. Because each component is downloaded when it is needed after the initial infection, the potential for a system to get a zero day exploit is higher. We also have to put in consideration that one of the bot client modules is usually set to to make the anti-virus tool ineffective and prevent the user from contacting the anti-virus vendor’s Web site for updates or removal tools. Botnets are powerful because they not only try to enable a perfect attack, but also a perfect own defense system.
 

== History of Botnets ==
Like many things on the Internet today, bots began as a useful tool without malicious purposes. They were originally developed to keep a channel open and prevent malicious users from taking over the channel when the operator was busy doing other things. In order to assist these IRC operators, bots needed to be able to operate as the channel operator. This lead the bots to evolve from being code that helped a single user to a code that manages and runs IRC channels as well. Around this time, some IRC servers and bots began offering the capability to make OS shell accounts available to users. The shell account permitted users to run commands on the IRC host. At this point, the bots intentions were twisted to a malicious way of commanding a machine remotely.
 
The table bellow shows the evolution and how an human-machine assist application went from being a simple code to

 

<table border="1">

<tr>
<th>Timeline</th>
<th>Bot technology</th>
</tr>

<tr>
<td>1988</td>
<td>Invention of IRC by Jarkko “WiZ” Oikarinen of the University of Oulu, Finland</td>
</tr>

<tr>
<td>1989</td>
<td>Greg Lindahl invents GM the first Bot, where GM plays "Hunt the Wumpus" with IRC users</td>
</tr>

<tr>
<td>1999</td>
<td>Pretty Park discovered. First worm to use an IRC server as a means of remote control</td>
</tr>

<tr>
<td>1999</td>
<td>SubSeven Trojan/bot. A remote control Trojan added control via IRC</td>
</tr>

<tr>
<td>2000</td>
<td>GT Bot, mIRC based. Runs scripts in response to IRC server events Supports raw TCP and UDP Socket connections</td>
</tr>

<tr>
<td>2002</td>
<td>SDBot. Written in C++ where its source code is available to hacker community though a small single binary</td>
</tr>

<tr>
<td>2002</td>
<td>AgoBot, Gaobot. They introduced modular design. The 1st module break-sin downloads, the 2nd module turns off anti virus and hides from detection before downloading the 3rd module. Module 3 has attack engines/payload</td>
</tr>

<tr>
<td>2003</td>
<td>SpyBot. Spyware capabilities (key logging, data mining for email addresses lists of URLs, etc.)</td>
</tr>

<tr>
<td>2003</td>
<td>RBot. Most Prevalent Bot today. It spreads through weak passwords, easily modifiable, Uses packaging software</td>
</tr>

<tr>
<td>2004</td>
<td>PolyBot. A derivative of AgoBot with Polymorphic abilty. Changes the look of its code on every infection</td>
</tr>

<tr>
<td>2005</td>
<td>MYTOB. My Doom mass emailing worm with Bot IRC C&C</td>
</tr>

</table>
 

== How Big is the problem? ==
On September of 2006 Symantec released a internet threat report which stated that during the six-month period from January to June 2006 Symantec observed 57,717 active bot network computers per day. Symantec also stated that it observed more than 4.5 million distinct, active bot network computers. They also discovered that many bots were not
usually detected until the Bot Herder had abandoned the computer which makes us conclude that the actual number is much larger than what Symantec can report.
 
In March of 2006, McAfee was called to reclaim an unnamed Central American country’s telecommunications infrastructure from a massive Botnet. In the first week of the
engagement McAfee documented 6.9 million attacks of which 95 percent were Internet Relay Chat (IRC) bot related. The national telecommunication company reported the
following resulting problems:
* Numerous network outages of up to six hours
* Customer threats of lawsuits
* Customer business disruptions
* Lengthy outages of bank ATM service
Since January 2005, Microsoft has been delivering the Windows Malicious Software Removal Tool to its customers. After 15 months, Microsoft announced that it had removed 16 million instances of malicious software from almost six million unique computers. Use of the tool is voluntary; that is to say, the vast majority of Microsoft users are not running it.
 
Consider the distributed denial-of-service (DDoS) attack power in one Botnet; A small Botnet of 10,000 bot clients with, conservatively, 128Kbps broadband upload speed can produce approximately 1.3 giga-bits of data per second. With this kind of power, two or three large (one million plus) Botnets could, according to McAfee, “threaten the national infrastructure of most countries.”
 

== How it turned in to an illegal way of profit? ==

== Life cycle of a Botnet ==
*Initial setup of configuration settings of the bot
*Register a Dynamic DNS
*Infect a PC with a bot
**Bot propagates according to the configuration settings
**Scans for vulnerabilities
**Idle
**Performs actions as received by other bots above it in the chain of command
**Bot dies:
***Bot may be taken over by another botnet
***The bot's owner's PC realizes the PC is a zombie, kills the bot.
***The chain of command may be compromised above the level.

== Types of attacks ==

===DDoS===
A Distributed denial of Service attack. The bots flood a web server with ICMP requests causing the server to crash. This can be used as a method of extortion from various websites. The herder demonstrates the power of his botnet by taking down the website, then he/she contacts the site in question and extorts them for money.

===Spamming===
A Herder can sell his botnet as a service to a spammer. This is beneficial to the spammer as he can have anonymous distribution of his messages.
 
Due to the size of some botnets, a spammer will also be able to send much more messages via the bots then he normally could. This is another example of the exponential power of a botnet.

===Phishing===
Works the same way as the spamming method. However, instead of trying to sell a service such as "P3N15 3NLARGEMENT PILLS" the phisher is trying to con you out of your paypal or bank account.

===Scrumping===
A bot stealing CPU cycles from the host computer. This can be used as a positive means if the botnet is configured to not automatically propagate into systems that do not want it. This is not commonly the case. This could be done on a school's network.

== How it works ==
A Botnet basically uses a command and control schema, the same as a military. Each bot has a chain of command that is part of. It distributes orders down the line that it receives from up top. This is beneficial in the fact that it can grow exponentially. This is the opposite of the cell schema that some malware uses, which is to split apart and never communicate once they become big enough. 

A bot installs itself onto a PC. It has various vectors to enter that PC that the Herder can set. It does this autonomously. It receives orders from a server that tell it what to do. An individual bot by itself is not that powerful. However an exponential number of bots performing the same action has a much more profound effect. 

The bot once installed camouflages itself from the system view. It installs a hidden IRC client. It tries to mask itself by maintaining a low profile by using as little system resources as possible until it receives orders. 

Due to the inherent weakness of a command and control scheme, once the higher level bots are compromised the effectiveness of the botnet can be severally reduced. If the main server is taken down, the entire botnet fails.

== Bot Management ==
Bots commonly have hidden removal commands, to completely clean the host computer. On the larger IRC networks such as EFnet channel activity is logged in order to learn the commands, and then automated systems are setup to prevent the owner of the botnet from accessing them and at the same time perform the removal command when a bot comes online to it's control channel.

== How to Fight Botnets ==
===Norton Anti-Bot===
[[Image:Norton_AntiBot.jpg|thumb|140px|right|
'''Norton Anti-Bot''']]
Norton Anti-Bot is commercial software that scans your system to see if it has become a zombie. It is behavioral based, versus the usual signature based. What this means is unless the bot software actually does something, Norton will leave it alone. It has all the benefits of a commercial software, meaning it will be updated constantly as new bot definitions are found.
===General Tips===
Use common malware prevention techniques. On Windows XP this includes monitoring the process manager and registry for unknown applications. 

A better user could also monitor network traffic and see what ports are in use. A good indication is TCP port 6667 open when an IRC client is not running.
== References ==
[http://en.wikipedia.org/wiki/Botnet "Botnet"] 
== See Also ==
[http://www.cas.mcmaster.ca/wiki/index.php/Alternative_Technologies_for_Ethernet "Alternative Technologies for Ethernet"] 
[http://www.cas.mcmaster.ca/wiki/index.php/Phishing "Phishing"] 

== External Links ==
[http://www.symantec.com/norton/products/overview.jsp?pcid=is&pvid=nab1 "Norton AntiBot"] 
[http://www.techweb.com/wire/security/172303160 "Dutch Botnet Suspects Ran 1.5 Million Machines"] 
--[[User:SJakubowski|SJakubowski]] 23:17, 13 April 2008 (EDT)

Bots & Botnets

2008-04-14T03:18:22Z

SJakubowski:

A Botnet is a collection of infected computers that can be used to attack organizations and distribute illegal information due to the sheer number of computers that is contained within them. Botnets are hard to prevent as the computers that become bots usually bear no resemblance in their locations in the physical world. 

They are a major threat to computing, due to the sheer amount of computers that can be controlled. In 2005 the Dutch police shut down a botnet that controlled 1.5 million computers. 1.5 million computers could shut down any website in the world if they all attempted to access its services at the same time.
== Definitions ==
*Bot
*Herder
*Zombie
*Scrumping

===Bot===

A Bot is short for robot. In the context of this wiki page a bot is a malicious program that installs itself unbeknownest to the owner of the pc, sets up an IRC or HTTP server and is ready to perform illegal activities.
===Herder===
A person who controls all the bots in the botnet.
===Zombie===
An infected computer.
===Scrumping===
A bot stealing CPU cycles from the host computer. This can be used as a positive means if the botnet is configured to not automatically propagate into systems that do not want it. This is not commonly the case. This could be done on a school's network.
== How it works ==
A Botnet basically uses a command and control schema, the same as a military. Each bot has a chain of command that is part of. It distributes orders down the line that it receives from up top. This is beneficial in the fact that it can grow exponentially. This is the opposite of the cell schema that some malware uses, which is to split apart and never communicate once they become big enough. 

A bot installs itself onto a PC. It has various vectors to enter that PC that the Herder can set. It does this autonomously. It receives orders from a server that tell it what to do. An individual bot by itself is not that powerful. However an exponential number of bots performing the same action has a much more profound effect. 

The bot once installed camouflages itself from the system view. It installs a hidden IRC client. It tries to mask itself by maintaining a low profile by using as little system resources as possible until it receives orders. 

Due to the inherent weakness of a command and control scheme, once the higher level bots are compromised the effectiveness of the botnet can be severally reduced. If the main server is taken down, the entire botnet fails.

== Attacks ==
*DDoS
*Spamming
*Phishing
===DDoS===
A Distributed denial of Service attack. The bots flood a web server with ICMP requests causing the server to crash. This can be used as a method of extortion from various websites. The herder demonstrates the power of his botnet by taking down the website, then he/she contacts the site in question and extorts them for money.
===Spamming===
A Herder can sell his botnet as a service to a spammer. This is beneficial to the spammer as he can have anonymous distribution of his messages. 

Due to the size of some botnets, a spammer will also be able to send much more messages via the bots then he normally could. This is another example of the exponential power of a botnet.

===Phishing===
Works the same way as the spamming method. However, instead of trying to sell a service such as "P3N15 3NLARGEMENT PILLS" the phisher is trying to con you out of your paypal or bank account.
== Life Cycle ==
*Initial setup of configuration settings of the bot
*Register a Dynamic DNS
*Infect a PC with a bot
**Bot propagates according to the configuration settings
**Scans for vulnerabilities
**Idle
**Performs actions as received by other bots above it in the chain of command
**Bot dies:
***Bot may be taken over by another botnet
***The bot's owner's PC realizes the PC is a zombie, kills the bot.
***The chain of command may be compromised above the level.
== Bot Management ==
Bots commonly have hidden removal commands, to completely clean the host computer. On the larger IRC networks such as EFnet channel activity is logged in order to learn the commands, and then automated systems are setup to prevent the owner of the botnet from accessing them and at the same time perform the removal command when a bot comes online to it's control channel.

== How to Fight Botnets ==
===Norton Anti-Bot===
[[Image:Norton_AntiBot.jpg|thumb|140px|right|
'''Norton Anti-Bot''']]
Norton Anti-Bot is commercial software that scans your system to see if it has become a zombie. It is behavioral based, versus the usual signature based. What this means is unless the bot software actually does something, Norton will leave it alone. It has all the benefits of a commercial software, meaning it will be updated constantly as new bot definitions are found.
===General Tips===
Use common malware prevention techniques. On Windows XP this includes monitoring the process manager and registry for unknown applications. 

A better user could also monitor network traffic and see what ports are in use. A good indication is TCP port 6667 open when an IRC client is not running.
== References ==
[http://en.wikipedia.org/wiki/Botnet "Botnet"] 
== See Also ==
[http://www.cas.mcmaster.ca/wiki/index.php/Alternative_Technologies_for_Ethernet "Alternative Technologies for Ethernet"] 
[http://www.cas.mcmaster.ca/wiki/index.php/Phishing "Phishing"] 

== External Links ==
[http://www.symantec.com/norton/products/overview.jsp?pcid=is&pvid=nab1 "Norton AntiBot"] 
[http://www.techweb.com/wire/security/172303160 "Dutch Botnet Suspects Ran 1.5 Million Machines"] 
--[[User:SJakubowski|SJakubowski]] 23:17, 13 April 2008 (EDT)

Bots & Botnets

2008-04-14T03:17:44Z

SJakubowski:

A Botnet is a collection of infected computers that can be used to attack organizations and distribute illegal information due to the sheer number of computers that is contained within them. Botnets are hard to prevent as the computers that become bots usually bear no resemblance in their locations in the physical world. 

They are a major threat to computing, due to the sheer amount of computers that can be controlled. In 2005 the Dutch police shut down a botnet that controlled 1.5 million computers. 1.5 million computers could shut down any website in the world if they all attempted to access its services at the same time.
== Definitions ==
*Bot
*Herder
*Zombie
*Scrumping

===Bot===

A Bot is short for robot. In the context of this wiki page a bot is a malicious program that installs itself unbeknownest to the owner of the pc, sets up an IRC or HTTP server and is ready to perform illegal activities.
===Herder===
A person who controls all the bots in the botnet.
===Zombie===
An infected computer.
===Scrumping===
A bot stealing CPU cycles from the host computer. This can be used as a positive means if the botnet is configured to not automatically propagate into systems that do not want it. This is not commonly the case. This could be done on a school's network.
== How it works ==
A Botnet basically uses a command and control schema, the same as a military. Each bot has a chain of command that is part of. It distributes orders down the line that it receives from up top. This is beneficial in the fact that it can grow exponentially. This is the opposite of the cell schema that some malware uses, which is to split apart and never communicate once they become big enough. 

A bot installs itself onto a PC. It has various vectors to enter that PC that the Herder can set. It does this autonomously. It receives orders from a server that tell it what to do. An individual bot by itself is not that powerful. However an exponential number of bots performing the same action has a much more profound effect. 

The bot once installed camouflages itself from the system view. It installs a hidden IRC client. It tries to mask itself by maintaining a low profile by using as little system resources as possible until it receives orders. 

Due to the inherent weakness of a command and control scheme, once the higher level bots are compromised the effectiveness of the botnet can be severally reduced. If the main server is taken down, the entire botnet fails.

== Attacks ==
*DDoS
*Spamming
*Phishing
===DDoS===
A Distributed denial of Service attack. The bots flood a web server with ICMP requests causing the server to crash. This can be used as a method of extortion from various websites. The herder demonstrates the power of his botnet by taking down the website, then he/she contacts the site in question and extorts them for money.
===Spamming===
A Herder can sell his botnet as a service to a spammer. This is beneficial to the spammer as he can have anonymous distribution of his messages. 

Due to the size of some botnets, a spammer will also be able to send much more messages via the bots then he normally could. This is another example of the exponential power of a botnet.

===Phishing===
Works the same way as the spamming method. However, instead of trying to sell a service such as "P3N15 3NLARGEMENT PILLS" the phisher is trying to con you out of your paypal or bank account.
== Life Cycle ==
*Initial setup of configuration settings of the bot
*Register a Dynamic DNS
*Infect a PC with a bot
**Bot propagates according to the configuration settings
**Scans for vulnerabilities
**Idle
**Performs actions as received by other bots above it in the chain of command
**Bot dies:
***Bot may be taken over by another botnet
***The bot's owner's PC realizes the PC is a zombie, kills the bot.
***The chain of command may be compromised above the level.
== Bot Management ==
Bots commonly have hidden removal commands, to completely clean the host computer. On the larger IRC networks such as EFnet channel activity is logged in order to learn the commands, and then automated systems are setup to prevent the owner of the botnet from accessing them and at the same time perform the removal command when a bot comes online to it's control channel.

== How to Fight Botnets ==
===Norton Anti-Bot===
[[Image:Norton_AntiBot.jpg|thumb|140px|right|
'''Norton Anti-Bot''']]
Norton Anti-Bot is commercial software that scans your system to see if it has become a zombie. It is behavioral based, versus the usual signature based. What this means is unless the bot software actually does something, Norton will leave it alone. It has all the benefits of a commercial software, meaning it will be updated constantly as new bot definitions are found.
===General Tips===
Use common malware prevention techniques. On Windows XP this includes monitoring the process manager and registry for unknown applications. 

A better user could also monitor network traffic and see what ports are in use. A good indication is TCP port 6667 open when an IRC client is not running.
== References ==
[http://en.wikipedia.org/wiki/Botnet "Botnet"] 
== See Also ==
[http://www.cas.mcmaster.ca/wiki/index.php/Alternative_Technologies_for_Ethernet "Alternative Technologies for Ethernet"] 
[http://www.cas.mcmaster.ca/wiki/index.php/Phishing "Phishing"] 

== External Links ==
[http://www.symantec.com/norton/products/overview.jsp?pcid=is&pvid=nab1 "Norton AntiBot"] 
[http://www.techweb.com/wire/security/172303160 "Dutch Botnet Suspects Ran 1.5 Million Machines"] 
--[[User:SJakubowski|SJakubowski]] 23:17, 13 April 2008 (EDT)

Bots & Botnets

2008-04-14T03:16:03Z

SJakubowski: /* How it works */

Bots & Botnets

2008-04-14T03:13:04Z

SJakubowski: /* Spamming */

A Botnet is a collection of infected computers that can be used to attack organizations and distribute illegal information due to the sheer number of computers that is contained within them. Botnets are hard to prevent as the computers that become bots usually bear no resemblance in their locations in the physical world. 

They are a major threat to computing, due to the sheer amount of computers that can be controlled. In 2005 the Dutch police shut down a botnet that controlled 1.5 million computers. 1.5 million computers could shut down any website in the world if they all attempted to access its services at the same time.
== Definitions ==
*Bot
*Herder
*Zombie
*Scrumping

===Bot===

A Bot is short for robot. In the context of this wiki page a bot is a malicious program that installs itself unbeknownest to the owner of the pc, sets up an IRC or HTTP server and is ready to perform illegal activities.
===Herder===
A person who controls all the bots in the botnet.
===Zombie===
An infected computer.
===Scrumping===
A bot stealing CPU cycles from the host computer. This can be used as a positive means if the botnet is configured to not automatically propagate into systems that do not want it. This is not commonly the case. This could be done on a school's network.
== How it works ==
A Botnet basically uses a command and control schema, the same as a military. Each bot has a chain of command that is part of. It distributes orders down the line that it receives from up top. This is beneficial in the fact that it can grow exponentially. This is the opposite of the cell schema that some malware uses, which is to split apart and never communicate once they become big enough. 

A bot installs itself onto a PC. It has various vectors to enter that PC that the Herder can set. It does this autonomously. It receives orders from a server that tell it what to do. An individual bot by itself is not that powerful. However an exponential number of bots performing the same action has a much more profound effect. 

The bot once installed camouflages itself from the system view. It installs a hidden IRC client. It tries to mask itself by maintaining a low profile by using as little system resources as possible until it receives orders.

== Attacks ==
*DDoS
*Spamming
*Phishing
===DDoS===
A Distributed denial of Service attack. The bots flood a web server with ICMP requests causing the server to crash. This can be used as a method of extortion from various websites. The herder demonstrates the power of his botnet by taking down the website, then he/she contacts the site in question and extorts them for money.
===Spamming===
A Herder can sell his botnet as a service to a spammer. This is beneficial to the spammer as he can have anonymous distribution of his messages. 

Due to the size of some botnets, a spammer will also be able to send much more messages via the bots then he normally could. This is another example of the exponential power of a botnet.

===Phishing===
Works the same way as the spamming method. However, instead of trying to sell a service such as "P3N15 3NLARGEMENT PILLS" the phisher is trying to con you out of your paypal or bank account.
== Life Cycle ==
*Initial setup of configuration settings of the bot
*Register a Dynamic DNS
*Infect a PC with a bot
**Bot propagates according to the configuration settings
**Scans for vulnerabilities
**Idle
**Performs actions as received by other bots above it in the chain of command
**Bot dies:
***Bot may be taken over by another botnet
***The bot's owner's PC realizes the PC is a zombie, kills the bot.
***The chain of command may be compromised above the level.
== Bot Management ==
Bots commonly have hidden removal commands, to completely clean the host computer. On the larger IRC networks such as EFnet channel activity is logged in order to learn the commands, and then automated systems are setup to prevent the owner of the botnet from accessing them and at the same time perform the removal command when a bot comes online to it's control channel.

== How to Fight Botnets ==
===Norton Anti-Bot===
[[Image:Norton_AntiBot.jpg|thumb|140px|right|
'''Norton Anti-Bot''']]
Norton Anti-Bot is commercial software that scans your system to see if it has become a zombie. It is behavioral based, versus the usual signature based. What this means is unless the bot software actually does something, Norton will leave it alone. It has all the benefits of a commercial software, meaning it will be updated constantly as new bot definitions are found.
===General Tips===
Use common malware prevention techniques. On Windows XP this includes monitoring the process manager and registry for unknown applications. 

A better user could also monitor network traffic and see what ports are in use. A good indication is TCP port 6667 open when an IRC client is not running.
== References ==
[http://en.wikipedia.org/wiki/Botnet "Botnet"] 
== See Also ==
[http://www.cas.mcmaster.ca/wiki/index.php/Alternative_Technologies_for_Ethernet "Alternative Technologies for Ethernet"] 
[http://www.cas.mcmaster.ca/wiki/index.php/Phishing "Phishing"] 

== External Links ==
[http://www.symantec.com/norton/products/overview.jsp?pcid=is&pvid=nab1 "Norton AntiBot"] 
[http://www.techweb.com/wire/security/172303160 "Dutch Botnet Suspects Ran 1.5 Million Machines"]

Bots & Botnets

2008-04-14T03:10:09Z

SJakubowski: /* See Also */

A Botnet is a collection of infected computers that can be used to attack organizations and distribute illegal information due to the sheer number of computers that is contained within them. Botnets are hard to prevent as the computers that become bots usually bear no resemblance in their locations in the physical world. 

They are a major threat to computing, due to the sheer amount of computers that can be controlled. In 2005 the Dutch police shut down a botnet that controlled 1.5 million computers. 1.5 million computers could shut down any website in the world if they all attempted to access its services at the same time.
== Definitions ==
*Bot
*Herder
*Zombie
*Scrumping

===Bot===

A Bot is short for robot. In the context of this wiki page a bot is a malicious program that installs itself unbeknownest to the owner of the pc, sets up an IRC or HTTP server and is ready to perform illegal activities.
===Herder===
A person who controls all the bots in the botnet.
===Zombie===
An infected computer.
===Scrumping===
A bot stealing CPU cycles from the host computer. This can be used as a positive means if the botnet is configured to not automatically propagate into systems that do not want it. This is not commonly the case. This could be done on a school's network.
== How it works ==
A Botnet basically uses a command and control schema, the same as a military. Each bot has a chain of command that is part of. It distributes orders down the line that it receives from up top. This is beneficial in the fact that it can grow exponentially. This is the opposite of the cell schema that some malware uses, which is to split apart and never communicate once they become big enough. 

A bot installs itself onto a PC. It has various vectors to enter that PC that the Herder can set. It does this autonomously. It receives orders from a server that tell it what to do. An individual bot by itself is not that powerful. However an exponential number of bots performing the same action has a much more profound effect. 

The bot once installed camouflages itself from the system view. It installs a hidden IRC client. It tries to mask itself by maintaining a low profile by using as little system resources as possible until it receives orders.

== Attacks ==
*DDoS
*Spamming
*Phishing
===DDoS===
A Distributed denial of Service attack. The bots flood a web server with ICMP requests causing the server to crash. This can be used as a method of extortion from various websites. The herder demonstrates the power of his botnet by taking down the website, then he/she contacts the site in question and extorts them for money.
===Spamming===
A Herder can sell his botnet as a service to a spammer. This is beneficial to the spammer as he can have anonymous distribution of his messages.
===Phishing===
Works the same way as the spamming method. However, instead of trying to sell a service such as "P3N15 3NLARGEMENT PILLS" the phisher is trying to con you out of your paypal or bank account.
== Life Cycle ==
*Initial setup of configuration settings of the bot
*Register a Dynamic DNS
*Infect a PC with a bot
**Bot propagates according to the configuration settings
**Scans for vulnerabilities
**Idle
**Performs actions as received by other bots above it in the chain of command
**Bot dies:
***Bot may be taken over by another botnet
***The bot's owner's PC realizes the PC is a zombie, kills the bot.
***The chain of command may be compromised above the level.
== Bot Management ==
Bots commonly have hidden removal commands, to completely clean the host computer. On the larger IRC networks such as EFnet channel activity is logged in order to learn the commands, and then automated systems are setup to prevent the owner of the botnet from accessing them and at the same time perform the removal command when a bot comes online to it's control channel.

== How to Fight Botnets ==
===Norton Anti-Bot===
[[Image:Norton_AntiBot.jpg|thumb|140px|right|
'''Norton Anti-Bot''']]
Norton Anti-Bot is commercial software that scans your system to see if it has become a zombie. It is behavioral based, versus the usual signature based. What this means is unless the bot software actually does something, Norton will leave it alone. It has all the benefits of a commercial software, meaning it will be updated constantly as new bot definitions are found.
===General Tips===
Use common malware prevention techniques. On Windows XP this includes monitoring the process manager and registry for unknown applications. 

A better user could also monitor network traffic and see what ports are in use. A good indication is TCP port 6667 open when an IRC client is not running.
== References ==
[http://en.wikipedia.org/wiki/Botnet "Botnet"] 
== See Also ==
[http://www.cas.mcmaster.ca/wiki/index.php/Alternative_Technologies_for_Ethernet "Alternative Technologies for Ethernet"] 
[http://www.cas.mcmaster.ca/wiki/index.php/Phishing "Phishing"] 

== External Links ==
[http://www.symantec.com/norton/products/overview.jsp?pcid=is&pvid=nab1 "Norton AntiBot"] 
[http://www.techweb.com/wire/security/172303160 "Dutch Botnet Suspects Ran 1.5 Million Machines"]

Bots & Botnets

2008-04-14T03:08:37Z

SJakubowski:

A Botnet is a collection of infected computers that can be used to attack organizations and distribute illegal information due to the sheer number of computers that is contained within them. Botnets are hard to prevent as the computers that become bots usually bear no resemblance in their locations in the physical world. 

They are a major threat to computing, due to the sheer amount of computers that can be controlled. In 2005 the Dutch police shut down a botnet that controlled 1.5 million computers. 1.5 million computers could shut down any website in the world if they all attempted to access its services at the same time.
== Definitions ==
*Bot
*Herder
*Zombie
*Scrumping

===Bot===

A Bot is short for robot. In the context of this wiki page a bot is a malicious program that installs itself unbeknownest to the owner of the pc, sets up an IRC or HTTP server and is ready to perform illegal activities.
===Herder===
A person who controls all the bots in the botnet.
===Zombie===
An infected computer.
===Scrumping===
A bot stealing CPU cycles from the host computer. This can be used as a positive means if the botnet is configured to not automatically propagate into systems that do not want it. This is not commonly the case. This could be done on a school's network.
== How it works ==
A Botnet basically uses a command and control schema, the same as a military. Each bot has a chain of command that is part of. It distributes orders down the line that it receives from up top. This is beneficial in the fact that it can grow exponentially. This is the opposite of the cell schema that some malware uses, which is to split apart and never communicate once they become big enough. 

A bot installs itself onto a PC. It has various vectors to enter that PC that the Herder can set. It does this autonomously. It receives orders from a server that tell it what to do. An individual bot by itself is not that powerful. However an exponential number of bots performing the same action has a much more profound effect. 

The bot once installed camouflages itself from the system view. It installs a hidden IRC client. It tries to mask itself by maintaining a low profile by using as little system resources as possible until it receives orders.

== Attacks ==
*DDoS
*Spamming
*Phishing
===DDoS===
A Distributed denial of Service attack. The bots flood a web server with ICMP requests causing the server to crash. This can be used as a method of extortion from various websites. The herder demonstrates the power of his botnet by taking down the website, then he/she contacts the site in question and extorts them for money.
===Spamming===
A Herder can sell his botnet as a service to a spammer. This is beneficial to the spammer as he can have anonymous distribution of his messages.
===Phishing===
Works the same way as the spamming method. However, instead of trying to sell a service such as "P3N15 3NLARGEMENT PILLS" the phisher is trying to con you out of your paypal or bank account.
== Life Cycle ==
*Initial setup of configuration settings of the bot
*Register a Dynamic DNS
*Infect a PC with a bot
**Bot propagates according to the configuration settings
**Scans for vulnerabilities
**Idle
**Performs actions as received by other bots above it in the chain of command
**Bot dies:
***Bot may be taken over by another botnet
***The bot's owner's PC realizes the PC is a zombie, kills the bot.
***The chain of command may be compromised above the level.
== Bot Management ==
Bots commonly have hidden removal commands, to completely clean the host computer. On the larger IRC networks such as EFnet channel activity is logged in order to learn the commands, and then automated systems are setup to prevent the owner of the botnet from accessing them and at the same time perform the removal command when a bot comes online to it's control channel.

== How to Fight Botnets ==
===Norton Anti-Bot===
[[Image:Norton_AntiBot.jpg|thumb|140px|right|
'''Norton Anti-Bot''']]
Norton Anti-Bot is commercial software that scans your system to see if it has become a zombie. It is behavioral based, versus the usual signature based. What this means is unless the bot software actually does something, Norton will leave it alone. It has all the benefits of a commercial software, meaning it will be updated constantly as new bot definitions are found.
===General Tips===
Use common malware prevention techniques. On Windows XP this includes monitoring the process manager and registry for unknown applications. 

A better user could also monitor network traffic and see what ports are in use. A good indication is TCP port 6667 open when an IRC client is not running.
== References ==
[http://en.wikipedia.org/wiki/Botnet "Botnet"] 
== See Also ==
[http://www.cas.mcmaster.ca/wiki/index.php/Alternative_Technologies_for_Ethernet "Alternative Technologies for Ethernet"] 
== External Links ==
[http://www.symantec.com/norton/products/overview.jsp?pcid=is&pvid=nab1 "Norton AntiBot"] 
[http://www.techweb.com/wire/security/172303160 "Dutch Botnet Suspects Ran 1.5 Million Machines"]

Bots & Botnets

2008-04-14T03:03:21Z

SJakubowski:

A Botnet is a collection of infected computers that can be used to attack organizations and distribute illegal information due to the sheer number of computers that is contained within them. Botnets are hard to prevent as the computers that become bots usually bear no resemblance in their locations in the physical world. 

They are a major threat to computing, due to the sheer amount of computers that can be controlled. In 2005 the Dutch police shut down a botnet that controlled 1.5 million computers. 1.5 million computers could shut down any website in the world if they all attempted to access its services at the same time.
== Definitions ==
*Bot
*Herder
*Zombie
*Scrumping

===Bot===

A Bot is short for robot. In the context of this wiki page a bot is a malicious program that installs itself unbeknownest to the owner of the pc, sets up an IRC or HTTP server and is ready to perform illegal activities.
===Herder===
A person who controls all the bots in the botnet.
===Zombie===
An infected computer.
===Scrumping===
A bot stealing CPU cycles from the host computer. This can be used as a positive means if the botnet is configured to not automatically propagate into systems that do not want it. This is not commonly the case. This could be done on a school's network.
== How it works ==
A Botnet basically uses a command and control schema, the same as a military. Each bot has a chain of command that is part of. It distributes orders down the line that it receives from up top. This is beneficial in the fact that it can grow exponentially. This is the opposite of the cell schema that some malware uses, which is to split apart and never communicate once they become big enough. 

A bot installs itself onto a PC. It has various vectors to enter that PC that the Herder can set. It does this autonomously. It receives orders from a server that tell it what to do. An individual bot by itself is not that powerful. However an exponential number of bots performing the same action has a much more profound effect. 

The bot once installed camouflages itself from the system view. It installs a hidden IRC client. It tries to mask itself by maintaining a low profile by using as little system resources as possible until it receives orders.

== Attacks ==
*DDoS
*Spamming
*Phishing
===DDoS===
A Distributed denial of Service attack. The bots flood a web server with ICMP requests causing the server to crash. This can be used as a method of extortion from various websites. The herder demonstrates the power of his botnet by taking down the website, then he/she contacts the site in question and extorts them for money.
===Spamming===
A Herder can sell his botnet as a service to a spammer. This is beneficial to the spammer as he can have anonymous distribution of his messages.
===Phishing===
Works the same way as the spamming method.
== Life Cycle ==
*Initial setup of configuration settings of the bot
*Register a Dynamic DNS
*Infect a PC with a bot
**Bot propagates according to the configuration settings
**Scans for vulnerabilities
**Idle
**Performs actions as received by other bots above it in the chain of command
**Bot dies:
***Bot may be taken over by another botnet
***The bot's owner's PC realizes the PC is a zombie, kills the bot.
***The chain of command may be compromised above the level.
== Bot Management ==
Bots commonly have hidden removal commands, to completely clean the host computer. On the larger IRC networks such as EFnet channel activity is logged in order to learn the commands, and then automated systems are setup to prevent the owner of the botnet from accessing them and at the same time perform the removal command when a bot comes online to it's control channel.

== How to Fight Botnets ==
===Norton Anti-Bot===
[[Image:Norton_AntiBot.jpg|thumb|140px|right|
'''Norton Anti-Bot''']]
Norton Anti-Bot is commercial software that scans your system to see if it has become a zombie. It is behavioral based, versus the usual signature based. What this means is unless the bot software actually does something, Norton will leave it alone. It has all the benefits of a commercial software, meaning it will be updated constantly as new bot definitions are found.
===General Tips===
Use common malware prevention techniques. On Windows XP this includes monitoring the process manager and registry for unknown applications. 

A better user could also monitor network traffic and see what ports are in use. A good indication is TCP port 6667 open when an IRC client is not running.
== References ==
[http://en.wikipedia.org/wiki/Botnet "Botnet"] 
== See Also ==
[http://www.cas.mcmaster.ca/wiki/index.php/Alternative_Technologies_for_Ethernet "Alternative Technologies for Ethernet"] 
== External Links ==
[http://www.symantec.com/norton/products/overview.jsp?pcid=is&pvid=nab1 "Norton AntiBot"] 
[http://www.techweb.com/wire/security/172303160 "Dutch Botnet Suspects Ran 1.5 Million Machines"]

Bots & Botnets

2008-04-14T02:47:32Z

SJakubowski:

Bots & Botnets

2008-04-14T02:41:43Z

SJakubowski: /* Norton Anti-Bot */

Bots & Botnets

2008-04-14T02:35:38Z

SJakubowski: /* Norton Anti-Bot */

File:Norton AntiBot.jpg

2008-04-14T02:35:20Z

SJakubowski:

Bots & Botnets

2008-04-13T14:07:43Z

SJakubowski:

insert description here

== Definitions ==
===Bot===
===Herder===
===Zombie===
===Scrumping===
== Attacks ==
===DDoS===
===Spamming===
===phishing===

== Life Cycle ==

== Bot Management ==

== How to Fight Botnets ==

== References ==
[http://en.wikipedia.org/wiki/Botnet "Botnet"] 
== See Also ==
[http://www.cas.mcmaster.ca/wiki/index.php/Alternative_Technologies_for_Ethernet "Alternative Technologies for Ethernet"] 
== External Links ==

Bots & Botnets

2008-04-13T14:06:36Z

SJakubowski:

insert description here

== Definitions ==
===Bot===
===Herder===
===Zombie===
===Scrumping===
== Attacks ==
===DDoS===
===Spamming===
===phishing===

== Life Cycle ==

== Bot Management ==

== How to Fight Botnets ==

== References ==

== See Also ==
[http://en.wikipedia.org/wiki/Botnet "Botnet"] 
== External Links ==

Bots & Botnets

2008-04-13T14:03:50Z

SJakubowski:

Bots & Botnets

2008-04-13T13:52:10Z

SJakubowski: New page: a

Smart Card technology to prevent fraud

2007-12-03T04:59:05Z

SJakubowski:

Smart Card technology to prevent fraud is a summary of various ways that fraud can be prevented using smart cards. This wiki page mainly deals with fraud in '''Credit Cards''' and '''Debit Cards'''.

== Terms used in this article ==
==== ATM ====
Automated Teller Machine
==== PIN ====
Personal Identification Number
== General Facts about debit/credit fraud in Canada==

*44 Million dollars lost in 2003 due to debit card fraud.
*100 Million in 2006
*Numbers on the rise every year.
*Takes less then a second and your Card is compromised.
*Smart card technology can prevent this.
 
Debit and Credit card fraud is a major issue here in Canada. What is basically involved is a group of individuals setting up magnetic strip readers to record magentic data from an unsuspecting person. The PIN must also be either witnessed by a team member or a camera. Then blank cards are filled with the data. Then the cashout phase begins which is when various ATM's are hit and balances are withdrawn sometimes to the point of depositing blank envelopes and withdrawing cash that does not even exist. 

A Group of Romainian gang members were busted last year for a total of 4 million dollars worth of fraudulent withdrawls from debit cards and ATMs. They custom made a device to fit overtop of an ATM terminal that would look like part of it, with the keypad and magnetic reader, they would leave it there unobserved for an hour or two, and then recover it before the deception was noted. The device kept track of the magnetic data and PIN numbers.

== General Facts about Smart Cards ==
[[Image:Smartcardchip.jpg|thumb|300px|right|
'''What a Smart Card Chip looks like internally''']]
====What is a Smart Card====
*Smart cards use a microchip embedded onto the card.
*The chip uses no power, the reader provides the power and reads the information from the chip
*Smart card chips are encrypted
**They use RSA and DSA encryption algorithms
====Background====
*Invented in 1968. German rocket scientist. Helmut Gröttrup
*French debit cards in 1992.
**Carte Bleue.
*EMVco
**Company that updates the card specifications.
**Visa/Debit cards must meet their worldwide standards if the Card is to be successful.

== Problems with Smart Cards ==
*Chip is not flexible.
*Big banks estimate it would cost 500 million to convert the system to use smart cards.
*They have been cracked in the past.

== Future of Smart Cards ==
====RFID====



RFID is a relatively recent technology. It stands for Radio-frequency identification. It is also non powered, so the card will require no battery. It allows smart cards to function without having to make physical contact with a chip reader, they will be able to work wirelessly.

== General Tips to Prevent fraud ==
*Hide your PIN
*Watch for signs of tampered card readers
*Don't lend out your Credit card or Debit Card

== See Also ==
[[HaveFunWithCasWiki]] 
[[http://www.cas.mcmaster.ca/wiki/index.php/User:SJakubowski SJakubowski]] 
[[http://www.cas.mcmaster.ca/wiki/index.php/User:Cavaliaj Cavaliaj]] 
[[Electronic Voting Systems]] 
[[Social engineering]] 
[[Piggybacking]] 
[[Identity Theft]] 
[[The Mitnick attack]] 
[[Security and Storage Mediums]] 
[[Operating Systems Security]] 
[[Honeypot]] 
[[Payment Card Industry Data Security Standard]]
--[[User:SJakubowski|SJakubowski]] 23:59, 2 December 2007 (EST)

Smart Card technology to prevent fraud

2007-12-03T04:56:01Z

SJakubowski: /* Future of Smart Cards */

Smart Card technology to prevent fraud

2007-12-03T04:55:18Z

SJakubowski: /* Future of Smart Cards */

Smart Card technology to prevent fraud is a summary of various ways that fraud can be prevented using smart cards. This wiki page mainly deals with fraud in '''Credit Cards''' and '''Debit Cards'''.

== Terms used in this article ==
==== ATM ====
Automated Teller Machine
==== PIN ====
Personal Identification Number
== General Facts about debit/credit fraud in Canada==

*44 Million dollars lost in 2003 due to debit card fraud.
*100 Million in 2006
*Numbers on the rise every year.
*Takes less then a second and your Card is compromised.
*Smart card technology can prevent this.
 
Debit and Credit card fraud is a major issue here in Canada. What is basically involved is a group of individuals setting up magnetic strip readers to record magentic data from an unsuspecting person. The PIN must also be either witnessed by a team member or a camera. Then blank cards are filled with the data. Then the cashout phase begins which is when various ATM's are hit and balances are withdrawn sometimes to the point of depositing blank envelopes and withdrawing cash that does not even exist. 

A Group of Romainian gang members were busted last year for a total of 4 million dollars worth of fraudulent withdrawls from debit cards and ATMs. They custom made a device to fit overtop of an ATM terminal that would look like part of it, with the keypad and magnetic reader, they would leave it there unobserved for an hour or two, and then recover it before the deception was noted. The device kept track of the magnetic data and PIN numbers.

== General Facts about Smart Cards ==
[[Image:Smartcardchip.jpg|thumb|300px|right|
'''What a Smart Card Chip looks like internally''']]
====What is a Smart Card====
*Smart cards use a microchip embedded onto the card.
*The chip uses no power, the reader provides the power and reads the information from the chip
*Smart card chips are encrypted
**They use RSA and DSA encryption algorithms
====Background====
*Invented in 1968. German rocket scientist. Helmut Gröttrup
*French debit cards in 1992.
**Carte Bleue.
*EMVco
**Company that updates the card specifications.
**Visa/Debit cards must meet their worldwide standards if the Card is to be successful.

== Problems with Smart Cards ==
*Chip is not flexible.
*Big banks estimate it would cost 500 million to convert the system to use smart cards.
*They have been cracked in the past.

== Future of Smart Cards ==
*RFID



RFID is a relatively recent technology. It stands for Radio-frequency identification. It is also non powered, so the card will require no battery. It allows smart cards to function without having to make physical contact with a chip reader, they will be able to work wirelessly.

== General Tips to Prevent fraud ==
*Hide your PIN
*Watch for signs of tampered card readers
*Don't lend out your Credit card or Debit Card

== See Also ==
[[HaveFunWithCasWiki]] 
[[http://www.cas.mcmaster.ca/wiki/index.php/User:SJakubowski SJakubowski]] 
[[http://www.cas.mcmaster.ca/wiki/index.php/User:Cavaliaj Cavaliaj]] 
[[Electronic Voting Systems]] 
[[Social engineering]] 
[[Piggybacking]] 
[[Identity Theft]] 
[[The Mitnick attack]] 
[[Security and Storage Mediums]] 
[[Operating Systems Security]] 
[[Honeypot]] 
[[Payment Card Industry Data Security Standard]]

Smart Card technology to prevent fraud

2007-12-03T04:35:56Z

SJakubowski:

Smart Card technology to prevent fraud is a summary of various ways that fraud can be prevented using smart cards. This wiki page mainly deals with fraud in '''Credit Cards''' and '''Debit Cards'''.

== Terms used in this article ==
==== ATM ====
Automated Teller Machine
==== PIN ====
Personal Identification Number
== General Facts about debit/credit fraud in Canada==

*44 Million dollars lost in 2003 due to debit card fraud.
*100 Million in 2006
*Numbers on the rise every year.
*Takes less then a second and your Card is compromised.
*Smart card technology can prevent this.
 
Debit and Credit card fraud is a major issue here in Canada. What is basically involved is a group of individuals setting up magnetic strip readers to record magentic data from an unsuspecting person. The PIN must also be either witnessed by a team member or a camera. Then blank cards are filled with the data. Then the cashout phase begins which is when various ATM's are hit and balances are withdrawn sometimes to the point of depositing blank envelopes and withdrawing cash that does not even exist. 

A Group of Romainian gang members were busted last year for a total of 4 million dollars worth of fraudulent withdrawls from debit cards and ATMs. They custom made a device to fit overtop of an ATM terminal that would look like part of it, with the keypad and magnetic reader, they would leave it there unobserved for an hour or two, and then recover it before the deception was noted. The device kept track of the magnetic data and PIN numbers.

== General Facts about Smart Cards ==
[[Image:Smartcardchip.jpg|thumb|300px|right|
'''What a Smart Card Chip looks like internally''']]
====What is a Smart Card====
*Smart cards use a microchip embedded onto the card.
*The chip uses no power, the reader provides the power and reads the information from the chip
*Smart card chips are encrypted
**They use RSA and DSA encryption algorithms
====Background====
*Invented in 1968. German rocket scientist. Helmut Gröttrup
*French debit cards in 1992.
**Carte Bleue.
*EMVco
**Company that updates the card specifications.
**Visa/Debit cards must meet their worldwide standards if the Card is to be successful.

== Problems with Smart Cards ==
*Chip is not flexible.
*Big banks estimate it would cost 500 million to convert the system to use smart cards.
*They have been cracked in the past.

== Future of Smart Cards ==
RFID.

== General Tips to Prevent fraud ==
*Hide your PIN
*Watch for signs of tampered card readers
*Don't lend out your Credit card or Debit Card

== See Also ==
[[HaveFunWithCasWiki]] 
[[http://www.cas.mcmaster.ca/wiki/index.php/User:SJakubowski SJakubowski]] 
[[http://www.cas.mcmaster.ca/wiki/index.php/User:Cavaliaj Cavaliaj]] 
[[Electronic Voting Systems]] 
[[Social engineering]] 
[[Piggybacking]] 
[[Identity Theft]] 
[[The Mitnick attack]] 
[[Security and Storage Mediums]] 
[[Operating Systems Security]] 
[[Honeypot]] 
[[Payment Card Industry Data Security Standard]]

Smart Card technology to prevent fraud

2007-12-03T04:34:21Z

SJakubowski: /* General Facts about debit/credit fraud in Canada */

Smart Card technology to prevent fraud is a summary of various ways that fraud can be prevented using smart cards. This wiki page mainly deals with fraud in '''Credit Cards''' and '''Debit Cards'''.

== General Facts about debit/credit fraud in Canada==

*44 Million dollars lost in 2003 due to debit card fraud.
*100 Million in 2006
*Numbers on the rise every year.
*Takes less then a second and your Card is compromised.
*Smart card technology can prevent this.
 
Debit and Credit card fraud is a major issue here in Canada. What is basically involved is a group of individuals setting up magnetic strip readers to record magentic data from an unsuspecting person. The PIN must also be either witnessed by a team member or a camera. Then blank cards are filled with the data. Then the cashout phase begins which is when various ATM's are hit and balances are withdrawn sometimes to the point of depositing blank envelopes and withdrawing cash that does not even exist. 

A Group of romainian gang members were busted last year for a total of 4 million dollars worth of fraudulent withdrawls from debit cards and ATMs. They custom made a device to fit overtop of an ATM terminal that would look like part of it, with the keypad and magnetic reader, they would leave it there unobserved for an hour or two, and then recover it before the deception was noted. The device kept track of the magnetic data and PIN numbers.

== General Facts about Smart Cards ==
[[Image:Smartcardchip.jpg|thumb|300px|right|
'''What a Smart Card Chip looks like internally''']]
====What is a Smart Card====
*Smart cards use a microchip embedded onto the card.
*The chip uses no power, the reader provides the power and reads the information from the chip
*Smart card chips are encrypted
**They use RSA and DSA encryption algorithms
====Background====
*Invented in 1968. German rocket scientist. Helmut Gröttrup
*French debit cards in 1992.
**Carte Bleue.
*EMVco
**Company that updates the card specifications.
**Visa/Debit cards must meet their worldwide standards if the Card is to be successful.

== Problems with Smart Cards ==
*Chip is not flexible.
*Big banks estimate it would cost 500 million to convert the system to use smart cards.
*They have been cracked in the past.

== Future of Smart Cards ==
RFID.

== General Tips to Prevent fraud ==
*Hide your PIN
*Watch for signs of tampered card readers
*Don't lend out your Credit card or Debit Card

== See Also ==
[[HaveFunWithCasWiki]] 
[[http://www.cas.mcmaster.ca/wiki/index.php/User:SJakubowski SJakubowski]] 
[[http://www.cas.mcmaster.ca/wiki/index.php/User:Cavaliaj Cavaliaj]] 
[[Electronic Voting Systems]] 
[[Social engineering]] 
[[Piggybacking]] 
[[Identity Theft]] 
[[The Mitnick attack]] 
[[Security and Storage Mediums]] 
[[Operating Systems Security]] 
[[Honeypot]] 
[[Payment Card Industry Data Security Standard]]

Smart Card technology to prevent fraud

2007-12-03T04:28:21Z

SJakubowski: /* General Facts about fraud */

Smart Card technology to prevent fraud is a summary of various ways that fraud can be prevented using smart cards. This wiki page mainly deals with fraud in '''Credit Cards''' and '''Debit Cards'''.

== General Facts about debit/credit fraud in Canada==

*44 Million dollars lost in 2003 due to debit card fraud.
*100 Million in 2006
*Numbers on the rise every year.
*Takes less then a second and your Card is compromised.
*Smart card technology can prevent this.

== General Facts about Smart Cards ==
[[Image:Smartcardchip.jpg|thumb|300px|right|
'''What a Smart Card Chip looks like internally''']]
====What is a Smart Card====
*Smart cards use a microchip embedded onto the card.
*The chip uses no power, the reader provides the power and reads the information from the chip
*Smart card chips are encrypted
**They use RSA and DSA encryption algorithms
====Background====
*Invented in 1968. German rocket scientist. Helmut Gröttrup
*French debit cards in 1992.
**Carte Bleue.
*EMVco
**Company that updates the card specifications.
**Visa/Debit cards must meet their worldwide standards if the Card is to be successful.

== Problems with Smart Cards ==
*Chip is not flexible.
*Big banks estimate it would cost 500 million to convert the system to use smart cards.
*They have been cracked in the past.

== Future of Smart Cards ==
RFID.

== General Tips to Prevent fraud ==
*Hide your PIN
*Watch for signs of tampered card readers
*Don't lend out your Credit card or Debit Card

== See Also ==
[[HaveFunWithCasWiki]] 
[[http://www.cas.mcmaster.ca/wiki/index.php/User:SJakubowski SJakubowski]] 
[[http://www.cas.mcmaster.ca/wiki/index.php/User:Cavaliaj Cavaliaj]] 
[[Electronic Voting Systems]] 
[[Social engineering]] 
[[Piggybacking]] 
[[Identity Theft]] 
[[The Mitnick attack]] 
[[Security and Storage Mediums]] 
[[Operating Systems Security]] 
[[Honeypot]] 
[[Payment Card Industry Data Security Standard]]

Smart Card technology to prevent fraud

2007-12-03T04:27:57Z

SJakubowski: /* General Facts about Smart Cards */

Smart Card technology to prevent fraud is a summary of various ways that fraud can be prevented using smart cards. This wiki page mainly deals with fraud in '''Credit Cards''' and '''Debit Cards'''.

== General Facts about fraud ==

*44 Million dollars lost in 2003 due to debit card fraud.
*100 Million in 2006
*Numbers on the rise every year.
*Takes less then a second and your Card is compromised.
*Smart card technology can prevent this.

== General Facts about Smart Cards ==
[[Image:Smartcardchip.jpg|thumb|300px|right|
'''What a Smart Card Chip looks like internally''']]
====What is a Smart Card====
*Smart cards use a microchip embedded onto the card.
*The chip uses no power, the reader provides the power and reads the information from the chip
*Smart card chips are encrypted
**They use RSA and DSA encryption algorithms
====Background====
*Invented in 1968. German rocket scientist. Helmut Gröttrup
*French debit cards in 1992.
**Carte Bleue.
*EMVco
**Company that updates the card specifications.
**Visa/Debit cards must meet their worldwide standards if the Card is to be successful.

== Problems with Smart Cards ==
*Chip is not flexible.
*Big banks estimate it would cost 500 million to convert the system to use smart cards.
*They have been cracked in the past.

== Future of Smart Cards ==
RFID.

== General Tips to Prevent fraud ==
*Hide your PIN
*Watch for signs of tampered card readers
*Don't lend out your Credit card or Debit Card

== See Also ==
[[HaveFunWithCasWiki]] 
[[http://www.cas.mcmaster.ca/wiki/index.php/User:SJakubowski SJakubowski]] 
[[http://www.cas.mcmaster.ca/wiki/index.php/User:Cavaliaj Cavaliaj]] 
[[Electronic Voting Systems]] 
[[Social engineering]] 
[[Piggybacking]] 
[[Identity Theft]] 
[[The Mitnick attack]] 
[[Security and Storage Mediums]] 
[[Operating Systems Security]] 
[[Honeypot]] 
[[Payment Card Industry Data Security Standard]]

Smart Card technology to prevent fraud

2007-12-03T04:17:02Z

SJakubowski: /* General Facts about Smart Cards */

Smart Card technology to prevent fraud is a summary of various ways that fraud can be prevented using smart cards. This wiki page mainly deals with fraud in '''Credit Cards''' and '''Debit Cards'''.

== General Facts about fraud ==

*44 Million dollars lost in 2003 due to debit card fraud.
*100 Million in 2006
*Numbers on the rise every year.
*Takes less then a second and your Card is compromised.
*Smart card technology can prevent this.

== General Facts about Smart Cards ==
[[Image:Smartcardchip.jpg|thumb|300px|right|
'''What a Smart Card Chip looks like internally''']]
====What is a Smart Card====
*Smart cards use a microchip embedded onto the card.
*The chip uses no power, the reader provides the power and reads the information from the chip
*Smart card chips are encrypted
*They use RSA and DSA encryption algorithms
====Background====
*Invented in 1968. German rocket scientist.
*Helmut Gröttrup
*French debit cards in 1992.
*Carte Bleue.
*EMVco
*Company that updates the card specifications. Visa/Debit cards must meet their worldwide standards if the Card is to be successful.

== Problems with Smart Cards ==
*Chip is not flexible.
*Big banks estimate it would cost 500 million to convert the system to use smart cards.
*They have been cracked in the past.

== Future of Smart Cards ==
RFID.

== General Tips to Prevent fraud ==
*Hide your PIN
*Watch for signs of tampered card readers
*Don't lend out your Credit card or Debit Card

== See Also ==
[[HaveFunWithCasWiki]] 
[[http://www.cas.mcmaster.ca/wiki/index.php/User:SJakubowski SJakubowski]] 
[[http://www.cas.mcmaster.ca/wiki/index.php/User:Cavaliaj Cavaliaj]] 
[[Electronic Voting Systems]] 
[[Social engineering]] 
[[Piggybacking]] 
[[Identity Theft]] 
[[The Mitnick attack]] 
[[Security and Storage Mediums]] 
[[Operating Systems Security]] 
[[Honeypot]] 
[[Payment Card Industry Data Security Standard]]

Smart Card technology to prevent fraud

2007-12-03T04:16:52Z

SJakubowski: /* General Facts about Smart Cards */

Smart Card technology to prevent fraud is a summary of various ways that fraud can be prevented using smart cards. This wiki page mainly deals with fraud in '''Credit Cards''' and '''Debit Cards'''.

== General Facts about fraud ==

*44 Million dollars lost in 2003 due to debit card fraud.
*100 Million in 2006
*Numbers on the rise every year.
*Takes less then a second and your Card is compromised.
*Smart card technology can prevent this.

== General Facts about Smart Cards ==
[[Image:Smartcardchip.jpg|thumb|300px|right|
'''What a Smart Card Chip looks like internally''']]
====What is a Smart Card=====
*Smart cards use a microchip embedded onto the card.
*The chip uses no power, the reader provides the power and reads the information from the chip
*Smart card chips are encrypted
*They use RSA and DSA encryption algorithms
====Background====
*Invented in 1968. German rocket scientist.
*Helmut Gröttrup
*French debit cards in 1992.
*Carte Bleue.
*EMVco
*Company that updates the card specifications. Visa/Debit cards must meet their worldwide standards if the Card is to be successful.

== Problems with Smart Cards ==
*Chip is not flexible.
*Big banks estimate it would cost 500 million to convert the system to use smart cards.
*They have been cracked in the past.

== Future of Smart Cards ==
RFID.

== General Tips to Prevent fraud ==
*Hide your PIN
*Watch for signs of tampered card readers
*Don't lend out your Credit card or Debit Card

== See Also ==
[[HaveFunWithCasWiki]] 
[[http://www.cas.mcmaster.ca/wiki/index.php/User:SJakubowski SJakubowski]] 
[[http://www.cas.mcmaster.ca/wiki/index.php/User:Cavaliaj Cavaliaj]] 
[[Electronic Voting Systems]] 
[[Social engineering]] 
[[Piggybacking]] 
[[Identity Theft]] 
[[The Mitnick attack]] 
[[Security and Storage Mediums]] 
[[Operating Systems Security]] 
[[Honeypot]] 
[[Payment Card Industry Data Security Standard]]

Smart Card technology to prevent fraud

2007-12-02T19:57:18Z

SJakubowski: /* General Facts about Smart Cards */

Smart Card technology to prevent fraud is a summary of various ways that fraud can be prevented using smart cards. This wiki page mainly deals with fraud in '''Credit Cards''' and '''Debit Cards'''.

== General Facts about fraud ==

*44 Million dollars lost in 2003 due to debit card fraud.
*100 Million in 2006
*Numbers on the rise every year.
*Takes less then a second and your Card is compromised.
*Smart card technology can prevent this.

== General Facts about Smart Cards ==
[[Image:Smartcardchip.jpg|thumb|300px|right|
'''What a Smart Card Chip looks like internally''']]
*Smart cards use a microchip embedded onto the card.
*The chip uses no power, the reader provides the power and reads the information from the chip
*Smart card chips are encrypted
*They use RSA and DSA encryption algorithms
*Invented in 1968. German rocket scientist.
*Helmut Gröttrup
*French debit cards in 1992.
*Carte Bleue.
*EMVco
*Company that updates the card specifications. Visa/Debit cards must meet their worldwide standards if the Card is to be successful.

== Problems with Smart Cards ==
*Chip is not flexible.
*Big banks estimate it would cost 500 million to convert the system to use smart cards.
*They have been cracked in the past.

== Future of Smart Cards ==
RFID.

== General Tips to Prevent fraud ==
*Hide your PIN
*Watch for signs of tampered card readers
*Don't lend out your Credit card or Debit Card

== See Also ==
[[HaveFunWithCasWiki]] 
[[http://www.cas.mcmaster.ca/wiki/index.php/User:SJakubowski SJakubowski]] 
[[http://www.cas.mcmaster.ca/wiki/index.php/User:Cavaliaj Cavaliaj]] 
[[Electronic Voting Systems]] 
[[Social engineering]] 
[[Piggybacking]] 
[[Identity Theft]] 
[[The Mitnick attack]] 
[[Security and Storage Mediums]] 
[[Operating Systems Security]] 
[[Honeypot]] 
[[Payment Card Industry Data Security Standard]]

Smart Card technology to prevent fraud

2007-12-02T19:57:09Z

SJakubowski: /* General Facts about fraud */

Smart Card technology to prevent fraud is a summary of various ways that fraud can be prevented using smart cards. This wiki page mainly deals with fraud in '''Credit Cards''' and '''Debit Cards'''.

== General Facts about fraud ==

*44 Million dollars lost in 2003 due to debit card fraud.
*100 Million in 2006
*Numbers on the rise every year.
*Takes less then a second and your Card is compromised.
*Smart card technology can prevent this.

== General Facts about Smart Cards ==
*Smart cards use a microchip embedded onto the card.
*The chip uses no power, the reader provides the power and reads the information from the chip
*Smart card chips are encrypted
*They use RSA and DSA encryption algorithms
*Invented in 1968. German rocket scientist.
*Helmut Gröttrup
*French debit cards in 1992.
*Carte Bleue.
*EMVco
*Company that updates the card specifications. Visa/Debit cards must meet their worldwide standards if the Card is to be successful.

== Problems with Smart Cards ==
*Chip is not flexible.
*Big banks estimate it would cost 500 million to convert the system to use smart cards.
*They have been cracked in the past.

== Future of Smart Cards ==
RFID.

== General Tips to Prevent fraud ==
*Hide your PIN
*Watch for signs of tampered card readers
*Don't lend out your Credit card or Debit Card

== See Also ==
[[HaveFunWithCasWiki]] 
[[http://www.cas.mcmaster.ca/wiki/index.php/User:SJakubowski SJakubowski]] 
[[http://www.cas.mcmaster.ca/wiki/index.php/User:Cavaliaj Cavaliaj]] 
[[Electronic Voting Systems]] 
[[Social engineering]] 
[[Piggybacking]] 
[[Identity Theft]] 
[[The Mitnick attack]] 
[[Security and Storage Mediums]] 
[[Operating Systems Security]] 
[[Honeypot]] 
[[Payment Card Industry Data Security Standard]]

Smart Card technology to prevent fraud

2007-12-02T19:56:47Z

SJakubowski: /* General Facts about fraud */

Smart Card technology to prevent fraud is a summary of various ways that fraud can be prevented using smart cards. This wiki page mainly deals with fraud in '''Credit Cards''' and '''Debit Cards'''.

== General Facts about fraud ==
[[Image:Smartcardchip.jpg|thumb|300px|right|
'''What a Smart Card Chip looks like internally''']]
*44 Million dollars lost in 2003 due to debit card fraud.
*100 Million in 2006
*Numbers on the rise every year.
*Takes less then a second and your Card is compromised.
*Smart card technology can prevent this.

== General Facts about Smart Cards ==
*Smart cards use a microchip embedded onto the card.
*The chip uses no power, the reader provides the power and reads the information from the chip
*Smart card chips are encrypted
*They use RSA and DSA encryption algorithms
*Invented in 1968. German rocket scientist.
*Helmut Gröttrup
*French debit cards in 1992.
*Carte Bleue.
*EMVco
*Company that updates the card specifications. Visa/Debit cards must meet their worldwide standards if the Card is to be successful.

== Problems with Smart Cards ==
*Chip is not flexible.
*Big banks estimate it would cost 500 million to convert the system to use smart cards.
*They have been cracked in the past.

== Future of Smart Cards ==
RFID.

== General Tips to Prevent fraud ==
*Hide your PIN
*Watch for signs of tampered card readers
*Don't lend out your Credit card or Debit Card

== See Also ==
[[HaveFunWithCasWiki]] 
[[http://www.cas.mcmaster.ca/wiki/index.php/User:SJakubowski SJakubowski]] 
[[http://www.cas.mcmaster.ca/wiki/index.php/User:Cavaliaj Cavaliaj]] 
[[Electronic Voting Systems]] 
[[Social engineering]] 
[[Piggybacking]] 
[[Identity Theft]] 
[[The Mitnick attack]] 
[[Security and Storage Mediums]] 
[[Operating Systems Security]] 
[[Honeypot]] 
[[Payment Card Industry Data Security Standard]]

File:Smartcardchip.jpg

2007-12-02T19:55:57Z

SJakubowski:

Smart Card technology to prevent fraud

2007-12-02T03:59:48Z

SJakubowski: /* Future of Smart Cards */

Smart Card technology to prevent fraud is a summary of various ways that fraud can be prevented using smart cards. This wiki page mainly deals with fraud in '''Credit Cards''' and '''Debit Cards'''.

== General Facts about fraud ==
*44 Million dollars lost in 2003 due to debit card fraud.
*100 Million in 2006
*Numbers on the rise every year.
*Takes less then a second and your Card is compromised.
*Smart card technology can prevent this.

== General Facts about Smart Cards ==
*Smart cards use a microchip embedded onto the card.
*The chip uses no power, the reader provides the power and reads the information from the chip
*Smart card chips are encrypted
*They use RSA and DSA encryption algorithms
*Invented in 1968. German rocket scientist.
*Helmut Gröttrup
*French debit cards in 1992.
*Carte Bleue.
*EMVco
*Company that updates the card specifications. Visa/Debit cards must meet their worldwide standards if the Card is to be successful.

== Problems with Smart Cards ==
*Chip is not flexible.
*Big banks estimate it would cost 500 million to convert the system to use smart cards.
*They have been cracked in the past.

== Future of Smart Cards ==
RFID.

== General Tips to Prevent fraud ==
*Hide your PIN
*Watch for signs of tampered card readers
*Don't lend out your Credit card or Debit Card

== See Also ==
[[HaveFunWithCasWiki]] 
[[http://www.cas.mcmaster.ca/wiki/index.php/User:SJakubowski SJakubowski]] 
[[http://www.cas.mcmaster.ca/wiki/index.php/User:Cavaliaj Cavaliaj]] 
[[Electronic Voting Systems]] 
[[Social engineering]] 
[[Piggybacking]] 
[[Identity Theft]] 
[[The Mitnick attack]] 
[[Security and Storage Mediums]] 
[[Operating Systems Security]] 
[[Honeypot]] 
[[Payment Card Industry Data Security Standard]]

Smart Card technology to prevent fraud

2007-12-02T03:59:35Z

SJakubowski: /* Problems with Smart Cards */

Smart Card technology to prevent fraud is a summary of various ways that fraud can be prevented using smart cards. This wiki page mainly deals with fraud in '''Credit Cards''' and '''Debit Cards'''.

== General Facts about fraud ==
*44 Million dollars lost in 2003 due to debit card fraud.
*100 Million in 2006
*Numbers on the rise every year.
*Takes less then a second and your Card is compromised.
*Smart card technology can prevent this.

== General Facts about Smart Cards ==
*Smart cards use a microchip embedded onto the card.
*The chip uses no power, the reader provides the power and reads the information from the chip
*Smart card chips are encrypted
*They use RSA and DSA encryption algorithms
*Invented in 1968. German rocket scientist.
*Helmut Gröttrup
*French debit cards in 1992.
*Carte Bleue.
*EMVco
*Company that updates the card specifications. Visa/Debit cards must meet their worldwide standards if the Card is to be successful.

== Problems with Smart Cards ==
*Chip is not flexible.
*Big banks estimate it would cost 500 million to convert the system to use smart cards.
*They have been cracked in the past.

== Future of Smart Cards ==
fsdf

== General Tips to Prevent fraud ==
*Hide your PIN
*Watch for signs of tampered card readers
*Don't lend out your Credit card or Debit Card

== See Also ==
[[HaveFunWithCasWiki]] 
[[http://www.cas.mcmaster.ca/wiki/index.php/User:SJakubowski SJakubowski]] 
[[http://www.cas.mcmaster.ca/wiki/index.php/User:Cavaliaj Cavaliaj]] 
[[Electronic Voting Systems]] 
[[Social engineering]] 
[[Piggybacking]] 
[[Identity Theft]] 
[[The Mitnick attack]] 
[[Security and Storage Mediums]] 
[[Operating Systems Security]] 
[[Honeypot]] 
[[Payment Card Industry Data Security Standard]]

Smart Card technology to prevent fraud

2007-12-02T03:59:12Z

SJakubowski: /* General Facts about Smart Cards */

Smart Card technology to prevent fraud is a summary of various ways that fraud can be prevented using smart cards. This wiki page mainly deals with fraud in '''Credit Cards''' and '''Debit Cards'''.

== General Facts about fraud ==
*44 Million dollars lost in 2003 due to debit card fraud.
*100 Million in 2006
*Numbers on the rise every year.
*Takes less then a second and your Card is compromised.
*Smart card technology can prevent this.

== General Facts about Smart Cards ==
*Smart cards use a microchip embedded onto the card.
*The chip uses no power, the reader provides the power and reads the information from the chip
*Smart card chips are encrypted
*They use RSA and DSA encryption algorithms
*Invented in 1968. German rocket scientist.
*Helmut Gröttrup
*French debit cards in 1992.
*Carte Bleue.
*EMVco
*Company that updates the card specifications. Visa/Debit cards must meet their worldwide standards if the Card is to be successful.

== Problems with Smart Cards ==
dsfds

== Future of Smart Cards ==
fsdf

== General Tips to Prevent fraud ==
*Hide your PIN
*Watch for signs of tampered card readers
*Don't lend out your Credit card or Debit Card

== See Also ==
[[HaveFunWithCasWiki]] 
[[http://www.cas.mcmaster.ca/wiki/index.php/User:SJakubowski SJakubowski]] 
[[http://www.cas.mcmaster.ca/wiki/index.php/User:Cavaliaj Cavaliaj]] 
[[Electronic Voting Systems]] 
[[Social engineering]] 
[[Piggybacking]] 
[[Identity Theft]] 
[[The Mitnick attack]] 
[[Security and Storage Mediums]] 
[[Operating Systems Security]] 
[[Honeypot]] 
[[Payment Card Industry Data Security Standard]]

Smart Card technology to prevent fraud

2007-12-02T03:50:30Z

SJakubowski: /* General Facts about fraud */

Smart Card technology to prevent fraud is a summary of various ways that fraud can be prevented using smart cards. This wiki page mainly deals with fraud in '''Credit Cards''' and '''Debit Cards'''.

== General Facts about fraud ==
*44 Million dollars lost in 2003 due to debit card fraud.
*100 Million in 2006
*Numbers on the rise every year.
*Takes less then a second and your Card is compromised.
*Smart card technology can prevent this.

== General Facts about Smart Cards ==
*Smart cards use a microchip embedded onto the card.
*The chip uses no power, the reader provides the power and reads the information from the chip
*Smart card chips are encrypted
*They use RSA and DSA encryption algorithms

== Problems with Smart Cards ==
dsfds

== Future of Smart Cards ==
fsdf

== General Tips to Prevent fraud ==
*Hide your PIN
*Watch for signs of tampered card readers
*Don't lend out your Credit card or Debit Card

== See Also ==
[[HaveFunWithCasWiki]] 
[[http://www.cas.mcmaster.ca/wiki/index.php/User:SJakubowski SJakubowski]] 
[[http://www.cas.mcmaster.ca/wiki/index.php/User:Cavaliaj Cavaliaj]] 
[[Electronic Voting Systems]] 
[[Social engineering]] 
[[Piggybacking]] 
[[Identity Theft]] 
[[The Mitnick attack]] 
[[Security and Storage Mediums]] 
[[Operating Systems Security]] 
[[Honeypot]] 
[[Payment Card Industry Data Security Standard]]

Smart Card technology to prevent fraud

2007-12-02T03:47:52Z

SJakubowski:

Smart Card technology to prevent fraud is a summary of various ways that fraud can be prevented using smart cards. This wiki page mainly deals with fraud in '''Credit Cards''' and '''Debit Cards'''.

== General Facts about fraud ==
* Data Protection
* Ease of Use
* Easy to Transport Information
* Relatively Cheap and Efficient

== General Facts about Smart Cards ==
*Smart cards use a microchip embedded onto the card.
*The chip uses no power, the reader provides the power and reads the information from the chip
*Smart card chips are encrypted
*They use RSA and DSA encryption algorithms

== Problems with Smart Cards ==
dsfds

== Future of Smart Cards ==
fsdf

== General Tips to Prevent fraud ==
*Hide your PIN
*Watch for signs of tampered card readers
*Don't lend out your Credit card or Debit Card

== See Also ==
[[HaveFunWithCasWiki]] 
[[http://www.cas.mcmaster.ca/wiki/index.php/User:SJakubowski SJakubowski]] 
[[http://www.cas.mcmaster.ca/wiki/index.php/User:Cavaliaj Cavaliaj]] 
[[Electronic Voting Systems]] 
[[Social engineering]] 
[[Piggybacking]] 
[[Identity Theft]] 
[[The Mitnick attack]] 
[[Security and Storage Mediums]] 
[[Operating Systems Security]] 
[[Honeypot]] 
[[Payment Card Industry Data Security Standard]]

Smart Card technology to prevent fraud

2007-12-02T03:46:33Z

SJakubowski:

Smart Card technology to prevent fraud is a summary of various ways that fraud can be prevented using smart cards. This wiki page mainly deals with fraud in Visa and Debit cards.

== General Facts about fraud ==
* Data Protection
* Ease of Use
* Easy to Transport Information
* Relatively Cheap and Efficient

== General Facts about Smart Cards ==
*Smart cards use a microchip embedded onto the card.
*The chip uses no power, the reader provides the power and reads the information from the chip
*Smart card chips are encrypted
*They use RSA and DSA encryption algorithms

== Problems with Smart Cards ==
dsfds

== Future of Smart Cards ==
fsdf

== General Tips to Prevent fraud ==
*Hide your PIN
*Watch for signs of tampered card readers
*Don't lend out your Credit card or Debit Card

== See Also ==
[[HaveFunWithCasWiki]] 
[[http://www.cas.mcmaster.ca/wiki/index.php/User:SJakubowski SJakubowski]] 
[[http://www.cas.mcmaster.ca/wiki/index.php/User:Cavaliaj Cavaliaj]] 
[[Electronic Voting Systems]] 
[[Social engineering]] 
[[Piggybacking]] 
[[Identity Theft]] 
[[The Mitnick attack]] 
[[Security and Storage Mediums]] 
[[Operating Systems Security]] 
[[Honeypot]] 
[[Payment Card Industry Data Security Standard]]

Smart Card technology to prevent fraud.

2007-12-02T03:43:30Z

SJakubowski: Replacing page with 'See Smart_Card_technology_to_prevent_fraud'

See [[Smart_Card_technology_to_prevent_fraud]]

Smart Card technology to prevent fraud

2007-12-02T03:42:48Z

SJakubowski: New page: Smart Card technology to prevent fraud is a summary of various ways that fraud can be prevented using smart cards. This wiki page mainly deals with fraud in Visa and Debit cards. == Gener...

Smart Card technology to prevent fraud.

2007-12-02T03:36:05Z

SJakubowski: /* General Facts about Smart Cards */

Smart Card technology to prevent fraud.

2007-12-02T03:32:52Z

SJakubowski:

Electronic Voting Systems

2007-12-02T03:26:22Z

SJakubowski: /* Security Implementations and Certification */

An '''Electronic Voting System''' is an innovative new method of distributing, voting, collecting and tabulating ballots through the use of computer technology.
 The software implementations which are input into this technology expand every day to improve security and integrity of the results.

__TOC__

=Electronic Voting Systems=
==DRE Machines==
 '''DRE (Direct Recording Electronic)'''

 A '''DRE''' machine is a recent implementation of a fully self-operated computer voting system.
 DRE's are user-friendly and time-efficient which makes them an attractive alternative to traditional pen-and-paper voting. A DRE machine consists of a user screen
 for information and ballot display, a keypad involving buttons or a touchscreen, and other assisting tools such as head-phones for the handicapped.

[[Image:sequoia_dre.jpg]]

 DRE's have been implemented worldwide but most frequently used in countries such as Brazil, India and United States.

 To access a DRE machine, a voter must be provided with a Voter Authentication Card (SmartCard or another type of Memory Card) by an Election Official. The Voter card
 becomes automatically deactivated by the DRE once a vote is fully cast.

==Optical Scan==

Optical Scanning machines were introduced shortly after the Punch Card system, incorporating paper ballots with computer technology. There are two common Optical Scanning Machines
 used in todays elections, Marksense and the Digital Pen.
 '''Marksense''' is a system developed ... Using a dark marker, a voter shades in a selection on the paper ballot, once completed the paper ballot is run through an optical scanning
 machine which uses 'dark mark' logic to select the correct choice.
 A '''Digital Pen''' is a similar version to Marksense except the pen communicates with the paper ballot and knows at all times its location on the ballot.

[[Image:opticalScan.jpg | 200 px]]

==Internet Voting==

=Electoral Fraud=
==Insider Attacks==
==Man-In-The-Middle Attacks==
=Reported Problems=
=Security Implementations and Certification=

* " :) " [[HaveFunWithCasWiki]]
__NOTOC__

Payment Card Industry Data Security Standard

2007-12-02T03:24:43Z

SJakubowski: /* Summary */

The Payment Card Industry Data Security Standard (PCI DSS) is a security document created by the Payment Card Industry Security Standards Council (PCI SSC). To make the explanation of the PCI DSS a bit more interesting, I will be presenting it as an Industry Wide security do

== Terms Used In This Article ==
* ''PCI'' '''P'''ayment '''C'''ard '''I'''ndustry: A Payment Card is any "card" form of payment. This can cover everything from credit cards to debit cards. The Payment Card Industry consists of all the companies which make up the many different brands of payment cards in use today. (ie Visa, Mastercard, ect..)
* ''PCI DSS'' '''P'''ayment '''C'''ard '''I'''ndustry '''D'''ata '''S'''ecurity '''S'''tandard
* ''PCI SSC'' '''P'''ayment '''C'''ard '''I'''ndustry '''S'''ecurity '''S'''tandards '''C'''ouncil: A council made up of Visa, Mastercard, American Express, Discover and JCB (Japan Credit Bureau) created in order to align their individual security goals into one document - the PCI DSS.
* ''Card Holder'': Any customer of a Payment Card company.
* ''Merchant'': Any company which accepts Payment Cards as a form of payment.
== Security System Life Cycle ==
[[Image:PCICouncil.JPG|frame|right|Formation of the PCI SSC]]
=== Threats ===
The main threat to the Payment Card Industry as a whole is more of a threat to the card holders than the industry itself. The card holders are taking a chance whenever they use their credit cards to make a purchase. This threat is not only present when purchasing online, but also when purchasing in stores. The threat originates from a lack of industry wide standards on how card holder information should be stored, processed or transmitted.

This security threat directly affects the Payment Card Industry because if cardholders don't trust that their information is secure, then they will not use their credit cards and hence the Payment Card Vendors loose business. This is why the Payment Card Industry is moving forward with their industry wide standard for security, the Payment Card Industry Data Security Standard.

=== Policy ===
Before December 14th 2004, the 5 major Payment Card companies (Visa, Mastercard, American Express, Discover and JCB (Japan Credit Bureau)) each had their own set of Information Security Standards. This meant that retailers had 5 different security policies to comply to.
After December 14th 2004, these 5 brands of cards collaborated to create the Payment Card Industry Security Standards Council (PCI SSC). The purpose of this council is to align the goals of each of the Payment Card companies an industry wide security policy for merchants to follow.

=== Security System Development ===

----

==== Requirements Specifications ====
An overview of the list of requirements needed to maintain Payment Card Industry Data Security Standard (PCI DSS) compliance is available here [https://www.pcisecuritystandards.org/tech/index.htm About the PCI Data Security Standard (PCI DSS)]. The full list of requirements is available here: [https://www.pcisecuritystandards.org/tech/download_the_pci_dss.htm Download the PCI DSS]. Below is the summarized list and an explaination of what each item means. There are 12 major requirements which can be broken up into 6 categories.
 

''Build and Maintain a Secure Network'' 
1.)Install and maintain a firewall configuration to protect cardholders' data 
2.)Do not use vendor-supplied defaults for system password and other security parameters 
* This set of requrements is meant to keep any network of computers which contain Card Holder information in a secure state 
 

''Protect Cardholder Data'' 
3.)Protect stored cardholder data 
* This requirement is meant to protect the card holder data while it is stored on merchant computers 
4.)Encrypt transmission of cardholder data across open, public networks 
* This requirement is meant to protect cardholder data when it might be necessary to transmit it accross a public network (ie when contacting the Payment Card server) 
 

''Maintain a Vulnerability Management Program'' 
5.)Use and regularly update anti-virus software 
* This requirement is meant to ensure that all merchants do take advantage of some form of anti-virus software. 
6.)Develop and maintain secure systems and applications 
* This requirement is meant to put security as a top priority during the development of software. This is an important requirement because many times when software is being designed, security is tacked on as an afterthought. By at least making developers aware of security as being a requirement of their software, this ensures better quality of any security mechanisms built into the software. 
 

''Implement Strong Access Control Measures'' 
7.)Restrict access to cardholder data by business need-to-know 
* This requirement is meant to ensure that only people who need to know about cardholder data have access to it. This is similar to the principle of least privilege. 
8.)Assign a unique ID to each person with computer access 
* This requirement is meant to add a level of accountability to all users on the system. If each user has their own unique ID on the merchant's system, then actions can be tracked on linked to the person who did them. 
9.)Restrict physical access to cardholder data 
* This requirement is meant to extend the coverage of the PCI DSS to any form of Card Holder data which may not be on a computer. Hence, the PCI DSS is extended to cover not only digital information but also physical coppies of the information. However, this does not prevent the threat of customer data being stolen entirely. There is nothing to prevent an employee from copying down information with a pencil and paper. Though this is a problem, it is partially alleviated by requirement 7: Restrisct access to cardholder data by business need-to-know. If only a small number of employees can access the Card Holder data, then it is much easier to track down who may have stolen Card Holder data if there is a security breech from the inside. 
 

''Regularly Monitor and Test Networks'' 
10.) Track and monitor all access to network resources and cardholder data 
* This requirement is designed to catch any unauthorized accesses to cardholder data. If an anomoly is detected, then the system should be able to detect it and steps should be taken to fix the problem 
11.) Regularly test security systems and processes 
* This requirement is meant to ensure that merchants don't just set and forget their security systems. It reminds them that security is a fulltime job and must constantly be maintaned. 
 
''Maintain an Information Security Policy'' 
12.) Maintain a policy that addresses information security 
* Though this may seem a bit redundant, this is an important requirement. It means that every merchant that deals with Cardholder Data must have their own security policy as well in order to protect cardholder data. 

----

==== Design/Implementation ====

There is no design or implementation specified in the PCI DSS. This is because the application of this security policy is so broad that it is impossible to have one design that will work for every company. For example Soney, which may handle millions of transactions a year, will need a different implementatino than a small "mom and pop" company, who may handle only a few hundred transactions a year. However, requirements must still be met to some degree depending on the volume of Payment Card transactions which occur per given merchant. This makes the PCI DSS sound rather weak. However, there is a way which the Payment Card Industry Security Standards Council can keep track of whether or not the requirements are being met. This is through the use of QSA's and ASV's.
*[https://www.pcisecuritystandards.org/programs/qsa_program.htm Qualified Security Assessors (QSA's)] are companies who have been approved by the PCI Security Standrads Council to assess the compliance of merchants to the PCI DSS. The way the PCI Security Standards Council does this is through a certification program. This requires not only the company to be certified, but also all of it's employees to be certified on a yearly bases.
*[https://www.pcisecuritystandards.org/programs/asv_program.htm Approved Scanning Vendors (ASV's)] are companies who are approved by the PCI Security Standards Council to assess merchants' networks for security vulnerabilities. They accomplish this by simulating both normal and abnormal processes on the merchants networks. Again, ASV's must also be certified by the PCI Security Standards Council on a yearly basis.
 

----

==== Operation and Maintenance ====

== Summary ==
[[HaveFunWithCasWiki]] :D

== References ==
#{{note|PCS_SSC}}PCI SSC

== See Also ==
[[Electronic Voting Systems]] 
[[Social engineering]] 
[[Piggybacking]] 
[[Identity Theft]] 
[[The Mitnick attack]] 
[[Security and Storage Mediums]] 
[[Operating Systems Security]] 
[[Honeypot]]

HaveFunWithCasWiki

2007-12-02T03:22:14Z

SJakubowski:

A group of individuals enjoying themselves.

Tag yourself here:

SJakubowski!

User:Cavaliaj

2007-12-02T03:21:29Z

SJakubowski:

Has been taken over by SJakubowski.

Is rumored to have a horrible monitor that he will not upgrade from.

Considers himself to be a "1337 g4m3r."

Has interesting presentations.

Is a member of the [[HaveFunWithCasWiki]] group. Member 2/2.

HaveFunWithCasWiki

2007-12-02T03:20:57Z

SJakubowski: New page: A group of individuals enjoying themselves.

A group of individuals enjoying themselves.

User:SJakubowski

2007-12-02T03:17:12Z

SJakubowski:

Needs to work on his own wikipage, get pzed.
-Andrew!

Drives a Miata. Enjoys posting amusing things on others wiki pages.

[[Image:Turbo009.jpg]]

File:Turbo009.jpg

2007-12-02T03:17:00Z

SJakubowski: SJakubowski's New Snail.

SJakubowski's New Snail.

User:SJakubowski

2007-12-02T03:15:21Z

SJakubowski:

Needs to work on his own wikipage, get pzed.
-Andrew!

Drives a Miata. Enjoys posting amusing things on others wiki pages.

[[Image:Turbo_009.jpg]]

File:Turbo 009.jpg

2007-12-02T03:14:34Z

SJakubowski: SJakubowski's New Snail.

SJakubowski's New Snail.

Smart Card technology to prevent fraud.

2007-12-02T03:12:56Z

SJakubowski: /* General Tips to Prevent fraud */

User:Cavaliaj

2007-12-02T03:10:29Z

SJakubowski: New page: Has been taken over by SJakubowski.

Has been taken over by SJakubowski.

User:SJakubowski

2007-12-02T03:09:44Z

SJakubowski:

Needs to work on his own wikipage, get pzed.
-Andrew!

Drives a Miata. Enjoys posting amusing things on others wiki pages.