Okay, cool.
So, and this is really,
like when we were talking about this earlier on and you
were saying attacks used to happen in certain ways and
now they're evolving --- Yeah, that's right.
--- should we maybe start by talking about how those attacks used to happen?
So, run us through.
So, criminals have been for a long time trying to steal payment card data.
Because they worked out that they could steal it and make money from it.
Sure.
And when people started taking payment cards over the internet,
which was a thing to begin with,
you would see that people would put up a web server and
start putting payment card data on it,
and then people would just steal the payment card data,
mostly because it was written into databases.
So PCI DSS came out, and we thought we'd fixed the problem, okay?
So we have a nice model,
I'm going to show you the nice model of what e-commerce looks like now.
So this is what e-commerce typically looks like,
or certainly looked like maybe seven years ago.
The consumer would go to a web server,
by that stage people had worked out that firewalls were a good
thing to put in front of the web server.
Sure.
The web server would do the transaction,
and then the web server would throw the cardholder data,
and I've put a firewall in there, because,
you know, PCI DSS said you have to have a firewall,
but it would throw the data through the firewall into a payment system,
which the merchant would have had,
maybe because they also have a point of sale system,
but you could just go and buy these payment systems.
And just to be clear here, like when you say merchant,
you're talking about, say,
the shop that you go to to purchase --- I'm talking about retailers.
So the online shop, or the actual, and some people are online and offline,
so the shop you go into that also has a web presence.
Okay, cool.
And they would tend to be because they bought a payment system,
use the same payment system for both.
And the cool thing is the payment system would write
the cardholder data to the database.
Because they're marketing, people thought this was a brilliant idea.
Because then they could track you if you bought
online and then offline; it's like, oh,
Troy came into my shop and then three days later he
went to my e-commerce website.
So they use card numbers as a tracking thing.
Okay, so they collect all the data --- Yep.
--- because we might get insights or something like that from it later on.
Okay, cool, so I mean,
this you said was kind of like the seven year ago kind of timeframe.
Yeah, this is what everything used to look like about seven years ago.
And what typically went wrong in that model?
Well, we've got a big database here full of cardholder data,
so criminals went and stole the cardholder data from the database.
Right, so, and again, this is the merchant's database,
so this is sort of your store,
which as you said may have a physical and an online presence,
they're storing the data, a criminal gets in,
steals the data right out of the database,
no protection on the card data, game over.
Game over.
Right.
And also, really easy hack.
You walk in, all the data is sitting in the database,
you take it away, you've gone; like, a three-minute hack.
Yeah.
Or, a very big database, a few day hack.
Yeah.
Right.
So, people stopped doing that.
People thought, you know,
that actually storing cardholder data in the database was a really bad idea.
PCI DSS tried to force people to do that.
And so we then got the model, which I call an API model.
So,
rather than the merchant taking the cardholder data into their internal systems,
what they did was they connected the web server to
the payment process of our own API.
So the card data went into the merchant's web server,
and then from the merchant's web server,
you can see the arrow down to the payment processor,
it filed an API core off straight from the web server to the payment processor.
Excellent.
So now there's no cardholder data in the rest of the merchant's infrastructure.
So to be clear, if I was the person going to the website making the purchase,
I would still post my card data to that website,
they'd receive that, then server-side, they'd call out down to the bank and say,
okay, you're the payment processor, as you say,
here is the card data, please process it.
Now it's not stored in the database,
someone can't go and take it from the database because there's
no persistent on behalf of the merchant.
Yeah.
So there's no way to go and take all the card data that merchant's overseeing.
Gotcha.
So what do the criminals do?
They hack the web server, they rewrite the code on the web server,
and then they start creating temporary files that
contains all the cardholder data.
Okay, so in the model before, this was attacker gets access to the database,
so that this could have been by hacking the
environment that shows the web server, it could have been a database backup,
could have been a sys admin gone rogue.
All of those things.
Now what we're saying is that the goalpost moved to the point
where you actually had to have access to the web server itself
whilst it was doing the processing.
So you wouldn't be able to go and get historical stuff either,
unless you stored it in the logs, which is another problem.
But if you could get that process flow,
as the card data went into the web server,
before it went down to the payment process,
you would have a problem.
Yeah.
And what you see there, this is a harder hack.
Right.
Although the web server is connected to the internet,
which is connected to the criminal's.
Right.
So, your web server is out there, so an unpatched web server,
you know, a vulnerability, some CMS problems.
So this is quite common.
And people started looking for files being created,
so that's --- And when you say people,
you mean like the people running the web server,
and sys admins.
Yeah, sys admins realize,
and then that's when you start and get in these in-memory
ones that then start to run a post back out.
And can I just clarify what you mean there,
because I think you just introduced a new concept,
so you're saying that those protecting the systems became
aware that criminals were getting access,
they're storing the files to the file systems somewhere,
so criminals then moved the goalpost and said we're going to just
grab it in-memory now and post it back out.
Yeah.
All right, so now there is no trace to be able to look at,
say, on the file system server.
Yeah, so basically you're relying on your log files,
telling you that you've got someone in your web server
that shouldn't be in your web server.
And it also makes forensics a lot harder because there's no
evidence of a log file or a hidden file put there by the
criminal that had card data in it.
And even when you say the web server logs,
and some criminal has got a remote shell on the web server,
there might be very minimal logging around that as well.
Yeah, there is, that typically happens.
And also,
although PCI DSS really says things like keep your
logs for 12 months-- you know,
people don't really keep 12 month logs of web servers.
So if you go to forensic investigations to try and find out
when the criminal got into the web server,
you can often not find that information.
Gotcha.
Okay.
So, yeah, you're right,
you're absolutely right is that we've seen the criminals move from attacking
a database and getting all the transactions at once to then attacking the web
server and getting transactions one at a time,
and as people get better at finding the criminals,
because we all talk about what's happened,
that the criminal changes the way that they work.
And that brings us to what we want to talk about today,
which is the way criminals have been stealing card data probably in
about 50% of attacks over the past couple of years.