start	end	text
620	4400	Can you guys see okay in the back? We have all this tech stuff for the black and white.
5100	6620	Everybody's okay? Okay.
7120	9340	Alright, thank you for attending.
10000	11440	Credit cards and everything.
11540	15800	This is the third year of this. The first year we did social engineering aspect,
15800	18140	as long as some light Wi-Fi stuff.
18320	19500	Can everybody hear me okay?
20820	21620	No.
22020	24500	Okay, and last year we did a live demo,
24500	28540	where we actually had some people in the front row interacting, trying to break in.
28540	34160	And at the very end, Spoonim was nice enough to do some cross-site scripting.
34160	35840	So thank you, Spoonim, if you're out there.
37180	39640	Okay, this year we're just going to kind of go over the basics.
39820	41760	And when I say basics, I hope you guys don't go,
41760	42900	ah, basics.
43020	47260	It's like basics on like getting into the industry kind of level.
47260	49580	So hopefully it's informative for everybody.
50220	52880	So this is credit cards, everything you have ever wanted to know.
53900	57320	And we're going to start off with a brief history of credit cards.
58400	62240	1950 Diners Club was the first credit card style thing.
62400	68620	I believe Sears Robux in the mid-20s did a credit where you can buy a washer, dryer,
68620	70500	or something like that, and then pay later.
70500	72120	But it was all on paper and books.
72120	76680	It wasn't really in the format we're used to, which is plastic or some form thereof.
77220	80040	1958 American Express was the next one to come out with it.
80040	85420	It was exclusively in New York City, and it was mostly for restaurants and hotel stays.
85420	87760	Kind of high society kind of people.
88440	91080	And this is an interesting aspect here with American Express,
91080	96480	because when they came in and Diners Club was already there, it was mostly for the high-end customers.
96680	102900	So what people wanted to do was accept these credit cards so that they can draw on the high-end clients
102900	106580	that were the only ones, the elitists, that were allowed to actually have credit cards.
106760	112080	So the credit card industry created this weird paradox where if you want to accept a credit card,
112080	115240	you have to pay us to accept credit cards.
115240	123960	So when you swipe your card, 50 bucks goes through, about 35 cents on average goes directly to the credit card company
123960	129740	for the luxury of having the ability to authorize credit cards for the merchant.
129740	138960	And that kind of set a standard and a tone for the industry, and also automatically started some security concerns in and of itself.
138960	145460	A 1958 Bank of America card started by Bank of America, which is now, as we all know, Visa.
145460	150000	That was in the late 70s when it switched over to the Visa brand when they went international.
150960	158220	1966 MasterCard International, ICA, the consortium of banks, got together and said,
158220	163600	we want to also have a credit card to compete with Bank of America and American Express.
163600	171020	And then way, way, way, way late in the game, 1986, Discover Card, which was originally started by Sears Roebuck,
171020	178700	and now Payne Webber, they just got together and merged and now they're breaking apart.
178700	185460	Payne Webber and a couple other financial institutions took over Discover Card and now they're selling it off to itself.
186300	189480	So let's talk about the technology behind credit cards.
189480	193860	Like we said before, back then it was all low-tech and everything like that.
193860	196400	I seem to be getting some sort of interruption here.
199360	202600	Hello, I am Ripshe with DC702.
202640	209000	We are doing a scavenger hunt and I'm going to give you a brief discussion about the scavenger hunt.
209160	211880	I'll read the introductory paragraph for you.
212460	216420	Welcome again to the greatest DEF CON competition brought to you by DC801.
216420	220360	On the back of this page is a list of items, tasks, and their point values.
220740	227780	From the time you get this list until noon on Sunday, collect as many of those items and complete as many tasks as possible.
228000	230840	The team with the most points at noon on Sunday wins the hunt.
230840	238300	Prizes are donated from all the vendors, many thanks to all those that donate, and whatever we were able to come up with before getting here.
238400	245780	Aside from the great time last year's teams had playing, first, second, and third place went home with plenty of shirts, books, hardware, stickers, and toys.
245780	249560	First place took home black badges, but we can't promise anything.
249640	253960	I really don't have anything original to talk about, so that's about all I'm going to do. Thank you.
253960	257300	Thank you for interrupting the speech that you were not scheduled for.
258640	264320	And somehow you were not scheduled for that speech and yet you're doing it because you're part of the scavenger hunt.
264720	266100	Hint, hint, nudge, nudge.
267740	270240	Alright, back on with the normal speech.
270240	277900	Okay, so technology. They had the knuckle busters, as we all call them today, and American Express was the first to start this.
278060	282520	And that was where the imposed imprints came on the cards originally.
282680	289020	Because you put them on the, as we all know, whoever's worked in retail at least once in their life and had a card that did not swipe.
289020	297620	You put the card down, you have a sheet of paper, and then you push over the sheet of paper and it imprints your credit card number, your name, expiration date, that kind of thing.
297620	303280	And these receipts were all collected up at the end of every night and they were mailed off to the credit card company.
303280	307560	And only when they were received by the credit card company did you actually get the money from that client.
307640	312260	So if there was any fraud or anything like that, it took a very long time before it was discovered.
312460	318060	They also did phone authorizations on certain credit cards or certain businesses of high risk.
318060	319740	That kind of mitigated that risk.
320100	324380	And then in the 80s is when dial-up authorization terminals came into play.
324380	335260	Dial-up is pretty much those trans 380s or Ingenico devices that you see now where they just swipe the card, punch in how much money, and hit enter.
335260	339800	And then it would pick up the phone line, dial out, connect to get authorization.
340240	344020	And the interesting thing about this is they originally started off at 1,200 baud.
344240	349460	And at 1,200 baud, you'd think, okay, that was so 1985, so 1991.
349460	355060	But they still use, to this day, anybody who does dial-up, they still use 1,200 baud as their connection rate.
355100	359820	Simply because they don't want to upgrade their servers or their mainframes for higher speeds.
359980	367080	If anybody wants faster authorization, they say, well, just use lease lines or use direct connections to the bank.
367840	374820	It's very fast transactions. You don't really need more than 1,200 anyways to connect in, get an authorization, and close out.
374820	381520	The only time that it actually causes a problem is at the end of the night, if you have like 300, 500 credit cards that were authorized,
381520	389200	you have to wait like 20 minutes as it slowly pushes across the 1,200 baud modem all the credit cards that need to be finalized.
389980	392660	High-speed lease lines, we kind of just talked about that.
392660	396580	High-speed lease lines is pretty much, I'm Walmart, and I have all my stores connected,
396580	403280	and it doesn't make any sense to use any third-party people, just go straight to the bank and get authorizations.
403280	409080	And so they have like Walmart, they have all their stuff consolidated into one source and then going out.
409100	415360	Same thing with CSK Auto for those that are in the United States, which is Checkers, Shooks, Cragen, if any of those sound familiar.
415420	421200	All theirs go down to Arizona, and then from Arizona, it goes out and gets authorization, comes back, and then goes to your respective store.
421880	430140	So for high volume or big names that have a lot of weight to throw around, a lot of money and that kind of stuff, they can usually get direct lines.
430140	436800	Gateway processors, these are like Go software, IC Verify, Shift 4, that sort of thing.
436840	446060	They're for like the middle tier and the low-end clients that don't do more than like anywhere between 100 transactions a month to about 200,000 a month.
446120	447800	And you usually use a front-end gateway.
447800	453260	PayPal can technically be considered a front-end gateway because you have APIs for your websites.
453620	458160	CC Bill and iBill and all those other blue light catering ones is also gateways.
458960	461860	Co-op leased line. This is actually kind of unique.
461860	465300	The only time I've ever seen a co-op leased line. Am I going too fast, guys?
466340	478500	Okay, the only time I've ever seen a co-op leased line was here in town, like at the MGM and a few others that are not even directly associated with each other through business arrangements.
478560	480020	They have like a direct line.
480020	481880	And I'm going down.
482940	485040	That's what I get for not plugging it in.
486060	488580	So, well, that's coming back up.
488840	492900	So what they did was they were all like, well, we have a direct line directly to the bank.
492900	499600	So we can resell this line or we can all cooperate in paying for the leased line to go out and work that way.
499600	502280	And it's still being stubborn.
503060	504160	Oh, there you are.
508920	510060	All right.
512440	513360	Hush.
518060	519440	I just enumerated.
519440	520300	That was great.
521540	524880	Luckily, there's no direct connects in, I don't think.
528060	529460	You'll harbor brute force it.
529460	530120	There you go.
531020	534940	Okay, so these co-ops, they're just pretty much everybody just kind of gets together.
534940	536820	We're a bunch of small businesses and we don't want to pay.
536820	542720	It's like anything else where if we all buy like a sack of potatoes, we can get it for a cheaper price kind of thing.
542720	547980	So everybody buys into the same lease line and gets better rates going through.
548580	553340	And then we already talked about PayPal a little bit with online API gateways, CC auth and iBill.
553340	554960	And I don't know.
555200	556160	I don't go to those sites.
556160	557140	What do you guys use?
557520	558360	No, I'm just kidding.
560080	562880	Okay, so marketing and technology.
562880	567660	So some of these different technologies that are coming out that everybody kind of wants to know about.
567660	570600	And I'm here to tell you guys, I'm going to burst your bubble.
570600	571960	A lot of them mean nothing.
571960	574460	Like the smart cards is the first one.
574460	577720	We all know this with the American Express Blue.
577720	583820	We have the little silver or gold smart card built into it and it's supposed to be more secure and all this other stuff.
584960	586420	Nobody uses it.
586600	587540	No vendors use it.
587540	589420	There is an actual protocol out.
589420	591920	There's a specification for how it works.
591980	596080	I know NDC, VisaNet and FDC support it.
596080	600200	But they're the only ones and that's not enough to actually get full on.
600200	604560	And here's a couple reasons why smart cards are not working and why they're not coming to market.
605120	607880	It's because the vendors are paying for all the equipment.
608040	611220	If you want a terminal to swipe cards, you have to pay for it.
611220	614020	If you want the ability to accept cards, you have to pay for it.
614020	618480	If you want each individual one, like you want to accept Visa, you have to have an agreement with them.
618480	621000	If you want to accept MasterCard, you have to have an agreement with them.
621080	622220	So on and so forth.
622300	625800	So the merchants are the ones that are really getting suckered out of a lot of money here.
625800	632000	And then all the ISOs, Independent Sales Organizations and MSPs, Merchant Service Providers,
632000	634480	they come to them and say, we have this smart card stuff.
634480	642460	All you have to do is take out that one terminal that I just charged you $350 for and put this new one in that's $900 so you can accept smart cards.
642460	650520	And then you'll be way more secure with only 1% of America actually having smart card on their cards.
650520	651780	So it's a very hard bargain.
651780	654200	So that's why smart cards just kind of floated along.
655280	657000	Virtual one-time use cards.
657140	661080	I wasn't even aware of these until somebody asked me about it after the speech last year.
661080	664840	And then I looked into it a little bit and talked to some people about it.
664840	671820	And these are pretty much... you're online and you're super, super, super paranoid that somebody's going to steal your credit card online.
671820	672600	They're going to do it.
672600	674500	I just know they're going to steal my credit card.
674500	676780	I can't handle having my credit card online.
676780	684080	So what they do is they go out and they register with... I think Bank of America supports this and Chase Bank supports it.
684540	685620	And Citibank supports it.
685620	687120	That's right, they're the big promoter of it.
688740	691540	They pretty much say, we're going to give you a laundry list of cards.
691540	694100	And you can use this card number exactly once.
694100	696620	And as soon as you use it, it's now a dead card.
696620	706360	Or I want to use this credit card for reoccurring billing, which means you're going to work out at the gym or you are part of the jello club or something like that.
706740	710840	And you want them to keep on billing you $10 a month for all the great jellos in the world.
711680	716300	So you can have a one-time use that will only be authorized to work at that merchant.
716300	717840	It won't work at any other merchant.
717840	727680	So somebody will know right away that the merchant's got a problem and that their credit card was hijacked from that merchant as soon as it gets used somewhere else.
728900	732480	And some people ask, well, how does this work? How is this possible?
732600	737720	Well, this kind of gets into a little bit of the more thicker realm of credit cards and how they work.
737920	742160	And all your authorizations go all the way back to your bank.
742160	745560	So when you swipe the card, it goes through what's called a front-end processor.
745560	750680	And they pretty much aggregate all the credit cards and say, okay, we have all the phone numbers.
750680	752920	We have all the direct links to all the banks.
752920	758400	Because back in the day, you know, you had this small trans-380 terminal and had like 56K of memory.
758400	762920	You can put one phone number, your merchant information, your BIN number in it, and that was it.
762980	770680	So if you had to call a different bank every time that somebody with a different bank came along to get an authorization, you'd fill up all that memory.
770680	773460	And it would just be a nightmare managing accounts with everyone.
773460	777880	So what they said was, well, we'll manage our accounts with everyone, and you just connect to us.
777880	779420	And that's the front-end processor.
779540	785240	And then you connect to us, and then we'll hop onto what's called Merchant Link when you go into Visa or Bank of America.
785320	794800	Or we'll hop onto the back-end processors, as they call them, which are shared networks that are just private networks that connect you directly to issuing banks.
794960	802280	So when you use this credit card online, it goes through the front-end processor, through the back-end network, and then to the exact bank that issued it.
802280	808660	So if you, say, generate a credit card online and it just generates it, the bank already has it in its database.
808660	815540	So whenever you use it somewhere else, it goes directly back to the bank, and then the bank knows, oh, hey, I just created that card.
815540	820660	Go ahead and send an authorization response back to the merchant.
820660	826840	And that's how that's possible, is because everything touches the actual issuing bank in every transaction.
828360	834600	Secured cards. These are kind of new technology and everything like that.
835420	838140	There's... oh, I'm sorry. I'm on the wrong one. Easy Pay.
838140	844900	Secured cards are those cheesy ones where it's like, hey, give us $200 and we'll give you a credit card with a $200 credit limit.
846100	851500	Okay. I have $200 on your credit card. What does that mean?
851500	854140	Well, we're going to charge you service fees and all this other stuff.
854140	861880	So you get a credit card, so when you go to the bank or you go shopping or everything, you get to be like, I'm a proud credit card holder.
862000	865780	Look at me. And you can be like 17, 18 and get these things.
865800	874480	So I'm not promoting this, but theoretically online, over 18 authorization usually means if they have a credit card, they're over 18.
874660	881220	And if you happen to go to Walgreens and get one of these secured credit cards for $200, you now have a credit card and you're 13.
883060	890040	So that's just something I heard from somebody, but I do not promote you going and doing any online transactions under the age of 18.
890040	890940	That would be bad.
891380	895780	But these are pretty much for people who have bad credit, want to rebuild their credit, that kind of thing.
896300	899500	You know, various different aspects of rebuilding credit.
899500	904220	That's not really what this speech is about, but we'll touch upon it just really briefly because we're talking secured cards.
904260	907460	It doesn't really help you out too much because people know.
907460	911400	Before they were like, oh, he has a credit card and it has a $200 limit and he pays it on time.
911400	913420	Well, yeah, he pays it on time because it's his money.
913580	918100	So he gets better credit, but they got privy to who's doing this and how they're doing it.
918100	925400	And so it really doesn't help your credit score to rebuild credit after a bankruptcy or foreclosure or things shutting down yet again.
927820	929960	It is another second form of ID.
930480	933900	And that does help out to get various different things.
933900	939020	And it's easier to get it because you can just log on to our website and say, hey, I am Joe Bob.
939020	940100	Give me this credit card.
940100	941040	And it just gives it to you.
941040	941920	Oh, you're Joe Bob.
941920	942640	Sure thing.
942640	947020	So you don't have to have actually any authorization or any proof to get that.
948000	948800	All right.
949080	949500	Okay.
949500	951620	So the easy pay RFID cards.
951800	958360	There was those guys out at the university that cracked the ones for mobile, if you guys are familiar with that.
959540	964560	And the mobile cards were pretty much, you know, those swipe ones where you're like, I want gas really quick.
964560	966520	So you just kind of wave your card, you know.
966520	968400	It's just, yeah, I'm going to do that one more time.
968460	969700	Wave your card.
970020	973220	And boom, you get your gas and everything like that.
973300	975380	And Chase also premiered these.
975380	982500	And we're trying to get a hold of one of these Chase ones because we wanted to build a RFID sniper rifle.
983060	986760	But we're working on it.
986760	988700	So maybe by...
989140	990780	Can I promote other events?
990780	991860	Maybe by...
994540	997320	Maybe by one of these other conferences we'll have it ready.
998940	1000680	So keep an eye out for that.
1000680	1005880	But we're going to work on that with Chase and see if we can crack it just like the university guys did for easy pay.
1006000	1012100	And these are just pretty much when you pass it over, the power is generated from the actual terminal you're waving over.
1012100	1014920	And that's how it activates the card to get your information.
1015920	1018980	And we'll talk about some security on that in a little bit.
1019200	1020780	All right, physical fraud features.
1020780	1023020	This is the interactive part of the demo.
1023400	1027800	Go ahead and I'll pull out your credit cards and stare at them and mask them from everybody else.
1027800	1028920	I'll do it myself.
1033700	1035100	Oh, I'm dead serious.
1035520	1037560	So I have my PayPal account here.
1037720	1038100	So we can...
1040500	1041300	It's 3348...
1041300	1042180	No, I'm just kidding.
1043000	1044600	33 would be JCB.
1044600	1048560	I mean, I don't know what's going on right now.
1049980	1056080	Okay, so if you actually want to toll it out and everything, if you're familiar with it, if you have photographic memory, you can think about your credit card for a minute.
1056420	1062680	And for those of you in front who better not have photographic memories, you can kind of stare at mine.
1062680	1068340	When we're looking at these, we're talking about the imposed numbers, those originally generated from the knuckle busters.
1068340	1072060	But they became a fraud prevention mechanism.
1072280	1079900	Because as long as the imposed one, which is a little difficult to push up, is the same as the magnetic strip, then you're okay.
1079900	1084440	Some people, we've seen a lot of fraud where people actually push it down and then re-push up new numbers.
1084520	1085980	And they're like really easy to spot.
1085980	1087800	So that's a telltale sign.
1088420	1093540	Also on them, as far as imposed is concerned, you're going to see the letter of the credit card that is on there.
1093540	1101300	If you ever notice why there's a cursive M, or a cursive V, or a cursive D, or a cursive A, those are all saying, you know, I'm a MasterCard, I'm a Visa.
1101500	1109840	So if you swipe it and it's a Visa card, and then you look on it and it says M, then you know there's something funny going on.
1110260	1114400	Also on these things, you have the logos, which says MasterCard, that's another fraud feature.
1115140	1127180	And the holograms, the hologram actually came in in the late 80s because of those guys who were watching people putting in their credit card number and phone booths to make phone calls, long distance phone calls.
1127540	1132660	And they were just like memorizing, they can just like photographic memory, stare at your card and then boom, now.
1132660	1141520	So the last four digits of your card goes over the hologram, so it's harder for these people to really visually see your card and take a snapshot and start doing fraud on that.
1141520	1152200	Of course, you got the expiration date on there in many different forms. Some banks will have, it was issued on this day and then it was expiring on that day.
1152200	1154220	And some just say it expires on this day.
1154680	1160400	What else we got? The curse of letter we talked about. First four digits non-imposed.
1161120	1166220	Okay, yeah, also on most cards, when you're looking at the first four digits, non-imposed is also printed on the card.
1166220	1170180	The first four digits of the card, that's a little bit of a fraud thing there.
1171160	1175600	Magnetic strip, of course, we're all privy to the magnetic strip. I happen to have a swiper here.
1176000	1181460	There are $35 on eBay, from what I understand. They plug right into your keyboard.
1181940	1188620	And you can just pretty much swipe any card you want. You want to see what's on your Blockbuster card, you want to see what's on your PayPal card, you can just swipe it.
1188620	1194280	And we'll do a quick demo here, I think, if the software's going to work, that X's out my account number when I swipe.
1194720	1197460	So, we'll see how that works out.
1198220	1206720	The signature panel on the back. The signature panel says the card types. It'll say discover, discover, discover, and 45-degree angle, or MasterCard, MasterCard, MasterCard.
1206720	1211020	And underneath that, if you scratch it with a coin, like it's a lottery ticket, it says void.
1211020	1214260	So as soon as you see the void, merchants are not supposed to accept the card.
1215160	1219820	CVV2 code, that's kind of relatively new. It means Card Verification Version 2.
1220300	1221900	What was Version 1?
1221900	1228900	Well, Version 1 was magnetic data. The unique data, discretionary data, as they call it, on the card itself.
1229760	1235680	So, Card Verification Version 2 is mostly used in over-the-phone sales and online sales.
1236180	1239960	Okay, credit card magnetic data. Two tracks for credit cards.
1240160	1244100	I wasn't sure if I was going to talk about it last year, and people said, ah, just go ahead and do it.
1244260	1250800	It's pretty much public knowledge, and since you can get one of these anywhere, and you can look up the specs, I'll give you guys the details of what's going on there.
1250800	1258880	Okay, so you have three tracks. Each piece of information that gets swiped off of it on the magnetic strip card reader is a track of data,
1258880	1264480	and they were originally specified throughout the years of what track 1 would be, what track 2 would be, and what track 3 would be.
1264740	1271700	So let's talk about track 1. Track 1 is pretty much, if you're going to be parsing a credit card,
1271700	1281000	it's going to be a caret, the shift 6 caret. That's your deliminator to parse it out.
1281580	1286220	When you have a successful swipe on a credit card, it's going to be percent B, capital B.
1286220	1293740	That's going to be the very first two digits. If you don't see that, it's probably not a credit card, or it's a fake, and it shouldn't go through in any credit card transaction.
1294440	1296780	Next, you'll get the caret that says, hey, I'm going to start the next field.
1296780	1302520	The next field is your name, and it's usually in all uppercase, and as much of your name as they can squeeze on there.
1302600	1308540	Some people actually append the name. So if you have a really, really long name like mine, if you noticed on the cue cards,
1308540	1311820	Imhoff Ducharme, they actually parsed mine, so it's Imhoff D.
1312740	1319680	So that's how that works out, because they found that some readers can't read all the characters, and it actually drops it off.
1319700	1324740	So they just said, well, and then it won't even authorize, because it breaks. It kind of crashes the box.
1324740	1329820	So if you have a really long name, don't go to checkers, because your card won't work.
1330600	1335040	Okay, so and then after that caret, you're going to have your credit card number.
1335040	1339600	And then it's going to have the credit card number, which is anywhere between 13 and 16 digits.
1340100	1347000	13 was the original American Express and Diners Club, and Visa cards were 14 and 15.
1347500	1350980	And now American Express is 15 and 16.
1351160	1354360	So you can have between 13 and 16. You're allowed up to 19.
1354360	1358080	There's some cards that they're trying to put on the market that will be 19 digits long.
1358600	1359980	So look forward to those.
1360380	1363560	And then after that, you'll have equals, and then you'll have four digits.
1363560	1368180	Now, these four digits are very special digits, because you have to really pay close attention.
1368180	1370040	It'll be your expiration date.
1370040	1378660	But if your expiration date is, I don't know, January 2008, so 01-08, it will not show up equals 01-08.
1378660	1381180	It'll show up 08-01.
1381180	1386100	So that's like their little security through obscurity thing, where they just kind of flip them around.
1386380	1390540	And it's also susceptible to the Y2K bug. I know we all felt that.
1392660	1394640	Notetakers on that joke? Okay.
1395000	1401760	Okay, right after that, it's going to be your country code, your three-digit country code, because there's two-digit country codes, two-letter country codes, all that fun stuff.
1401760	1403900	So your three-digit country code, which...
1403900	1410860	So you'll usually see the expiration date, and you'll immediately see 101 for everybody here in the United States, because that's our international three-digit country code.
1410860	1414420	And after that's the fun data. That's the stuff that everybody really wants.
1414420	1416900	Because you can get the credit card number off the front.
1416900	1419100	You can get the expiration date off the front.
1419100	1420900	You even know which country it came from.
1420900	1422360	Okay, so what's next?
1422360	1424420	Well, that's the card verification version 1.
1424420	1425960	That's the discretionary data.
1426300	1428640	And that's immediately following all that.
1428700	1431360	And after that, you get a caret, which says, I'm done.
1431360	1436400	And then when track 2 starts, you get a semicolon saying, I'm now ready for track 2.
1436480	1438380	Credit cards only use track 1 and track 2.
1438380	1439660	They do not use track 3.
1439660	1447360	That's mostly used for, like, players' club cards here in town at the casinos and the Moose Lodge, if you're into that sort of thing.
1448000	1450980	You know, they have your pin there, maybe. I don't know.
1451300	1456600	So track 2 now switches the format in which you're going to have discretionary data.
1456600	1460200	It's going to be semicolons separating everything.
1460200	1463140	So you're going to parse everything out based on semicolons instead of carets.
1463480	1466320	And so you're going to get, once again, the full credit card number.
1466320	1469800	Then you're going to get equals, and then you're going to get the expiration date, which is traversed.
1469800	1471700	Then the country code, 101.
1471700	1473380	Then your discretionary data.
1474240	1475200	That's it.
1476340	1478480	Okay, so you guys are like, well, that's just like track 1.
1478480	1479360	What's GIVS?
1479380	1481440	Well, I don't know.
1481740	1484500	You get less... nobody knows the answer to that.
1484500	1486720	They added track 2 as a security feature.
1486720	1491780	They're like, well, that's card verification version 1, even though it's the same exact discretionary data as track 1.
1491780	1497100	And by having that, pretty much what that meant is we're tired of using these old and busted.
1497120	1498220	You know, so old and busted.
1498220	1501180	These new hotness and genicodes.
1501920	1505640	So we want you to switch over to those, which are giving us more revenue.
1505640	1510220	Which means that you can accept track 2, which will give you a better rate on your transactions.
1510920	1511920	So you have track 2.
1512100	1512940	And that's what that's all about.
1512940	1515760	And it ends with a semicolon, and that's the end of the story there.
1515760	1520480	If it doesn't work, if you swipe your card and kind of half swipe, or you swipe it too quick, or it's a dirty scanner,
1520480	1526180	then you're going to get a percent E semicolon percent E semicolon, which means error reading card.
1526180	1526900	Try again.
1528440	1529080	Okay.
1529380	1530340	Transaction flow.
1530580	1531120	Authorization.
1531120	1532560	There's two flows, we should say.
1532560	1534680	I didn't really put a slide before this.
1535280	1538960	Flow 1 is authorizing the card.
1538960	1540080	Flow 2 is settling the card.
1540080	1541480	And we'll talk about the differences.
1541980	1547040	So when you swipe the credit card and you have the dollar amount and all that fun stuff, you're going to get an initial authorization.
1547040	1553460	And when that initial authorization goes through, like we said, it goes through the front-end processor, which is our local loop that connects everybody.
1553680	1565820	If we had a yardstick, and we're talking about processors, by the way, and you have a big, huge, long yardstick, we'd say the entire bit of that yardstick, except for one inch, is First Data Corporation, FDC.
1565920	1569240	They are the biggest front-end processor out there, hands down.
1569240	1576080	And then everybody else, Nova, NDC, MAP, Citco Alliance, all those guys, they're one inch.
1576180	1578700	And that's the competition you have to work with out there.
1579380	1583420	So that's something I'll leave aside, a little extra nugget for you guys.
1583920	1586160	So then you get to the front-end processor.
1586160	1587940	Front-end processor checks the card number.
1587940	1592400	First six digits are going to tell you, on the credit card number, who the issuing bank is.
1592640	1598620	So when you have, I don't know, five, you automatically know that's a MasterCard.
1598620	1603240	When you have six, you automatically, or 6011, you automatically know that's Discover.
1603360	1606680	When you have four, you automatically know that that's Visa.
1606680	1610060	When you have three, eight, it's American Express.
1610060	1611640	Three, six, it's JCB.
1611640	1617600	Three, five, it's old-school Visas that were 13 digits long.
1617720	1621720	And I don't believe there's any cards that's now still in existence that had two.
1621720	1625380	There were some people that played around with it, but that was mostly reserved.
1625380	1632480	00 and 10 are reserved for private label cards and stuff like that, which we'll get into in a little bit.
1633000	1636200	So the first digit, right off the bat, tells you what type of credit card it is.
1636280	1642220	Then the next five digits, or the first six-digit chunk, will tell you exactly which bank it's coming from.
1642300	1646180	And I believe there's somebody that's actually working on a project out there right now.
1646180	1647900	It was on Slashdown about six months ago.
1647900	1651480	Who is trying to get everybody's first six digits and say, which bank do you have?
1651480	1657660	And trying to reverse enumerate everybody's credit card banks and everything.
1658960	1662240	So far, what we know is that there's some specifications.
1662240	1668880	If you ask really, really nicely and say you're an ISO bank, they will give you some customer service places
1668880	1672000	that you can just call and say, I need the list, and the list will email it to you.
1672420	1676720	So, yeah, it's kind of goofy. We'll get into that in a little bit, too.
1677900	1680080	FEP, the front-end processor, this is the beauty.
1680080	1683880	These are the awesome guys. They're like, we have a lot of money, and we want to get a lot of more money.
1683880	1685820	How can we possibly do that?
1686280	1689160	Well, we're going to just authorize people's credit cards.
1689340	1692740	And then not even have to worry about doing anything with them.
1692740	1696240	So that's why I say FEPs are hands-off, because they're bonded.
1696240	1701040	They have like, you know, $1 billion insurance policies on all the cards that go through.
1701340	1708000	And all they do is say, I have the money to say that I can vouch for this process going through, and nothing bad will happen.
1708000	1710260	And then they just let transactions float by them.
1710260	1718900	They just pretty much, you know, grab the card, take it, hand it off to the issuing bank, get the response from the issuing bank, record the result, and then send it back.
1718900	1727040	And they record the result on behalf of the merchant, because they have these little trans-tradies, only got 56K of memory, don't have enough to remember everything.
1728480	1734800	Which is now changing with the new virtual world and the front-end processor gateways and everything like that, which they're losing revenue on.
1734800	1740260	But they pretty much just say, oh, I'll just remember that you had an authorization, and just let me know when to close it out.
1740260	1742260	So they're just handing money back and forth.
1742340	1746580	That's their only purpose, is we connect you to us and us to them.
1746580	1755020	And they charge you to connect to them, and then front-end processors like FDC will charge them, because they have all the clients.
1755580	1761380	So they get money from leasing the lines, they get money from the merchants, they get money from the transactions, and they get money from the banks.
1761400	1763880	And all they do is just say, thank you, you're welcome.
1763880	1769160	So it's a pretty sweet gig to get into if you want to get on the new hotness there.
1769160	1772380	Just have like $1 billion laying around to bond yourself, and you'll be all set.
1773460	1775660	Okay, back-end merchant link.
1775660	1777480	We kind of briefly talked about that earlier.
1777600	1779480	How are we doing on time, by the way?
1780420	1781800	Where are my folks?
1781800	1783620	Because I can just ramble for a while.
1786020	1786820	Where's my...
1786820	1788180	20 more minutes?
1788180	1789860	We should probably speed up then.
1790040	1791400	You guys ready to go into high gear?
1791900	1792900	All right.
1792900	1794400	So back-end processor merchant link.
1794400	1795960	We already talked about it, so we're skipping it.
1795960	1798220	Issuing banks, we already talked about it, so we're skipping it.
1798740	1800480	Front-end processor record updates.
1800480	1802120	We kind of just talked about it.
1802720	1806120	They just update the records, say, hey, I know that you did a transaction.
1806120	1806800	All right.
1807420	1811500	And then in return, the terminal prints out a receipt having the authorization code.
1811500	1812660	You see that authorization code?
1812660	1814280	It's a six-digit code on all the receipts.
1814280	1816000	It comes directly from the issuing bank.
1816000	1818020	Your bank itself gave that authorization code.
1818020	1821900	Not the back-end processor, not the front-end processor, not the merchant itself.
1821900	1824040	But your actual issuing bank talked to them.
1824800	1825100	All right.
1825100	1826360	Transaction flow settlement.
1826360	1829180	Now, at the end of the night, you want to settle everything out.
1829180	1830240	Has anybody ever had this?
1830240	1833140	Because I certainly haven't, because I'm really responsible with my money.
1833320	1841340	Has anybody ever had this where it says available balance is $500, but it says that your account balance is $800?
1841620	1844820	You're like, how in the heck can I have two separate balances in my account?
1844820	1845940	How is this possible?
1845940	1851140	And this is because when CheckCard switched over to Visa and MasterCard to accept that logo,
1851140	1855660	they went through an authorization and settlement cycle that they now acquired from the banks.
1855660	1860680	And authorization pretty much means I authorize this money on your account and I hold it on your account,
1860680	1862700	but I don't actually take it out of your account.
1862720	1865500	That's the important thing to remember about authorization and settlement.
1865500	1866780	I'm just going to hold it.
1866780	1868120	I'm not going to do anything with it yet.
1868120	1874420	I'm just making sure... well, I can't say that's derogatory, but I'm C-blocking you from actually using that money.
1875620	1879520	So you have that money held, but let's say they don't take it out in a timely manner.
1879520	1880700	Let's say a week or two.
1880820	1885180	Well, then that money just absorbs away and just disappears and it no longer is held
1885180	1888940	because they can only hold it out of your account for so long before they take it out.
1888940	1891480	So they say, okay, they never took it.
1891480	1892800	Maybe they were just kidding.
1892880	1893580	I don't know.
1893660	1895480	And so then they just release the authorization.
1895480	1898460	So now your money comes back available to you.
1898460	1902460	So you're like, wow, they forgot to charge me.
1902600	1904160	How cool is that?
1904160	1906640	I'm going to go pick me up a new pair of pants.
1906640	1907240	I don't know.
1907240	1910360	I'm going to go get some pantalones and all that fun stuff.
1910480	1912960	And so then they go, oh, we forgot to charge them.
1912960	1913580	Oh, my goodness.
1913580	1914660	Close that terminal.
1914680	1915540	And then they charge you.
1915540	1916320	And then what happens?
1916320	1917180	You overdraw.
1917180	1919820	You incur bank fees and all that stuff.
1919820	1921000	Why are you irresponsible?
1921300	1922340	Although they were.
1922420	1923840	Well, we're still going to charge you.
1923900	1928320	So that's how that comes into play because of this authorization and settlement thing.
1928320	1931000	And this has happened since the beginning of credit cards.
1931000	1932920	And it's like a very bad process.
1932920	1936000	And it's impossible to get rid of because it's just so thick.
1937720	1940340	So we just kind of went through that whole thing right here.
1940340	1941840	So we're going to go on to the next slide.
1941840	1942860	Data storage.
1945960	1949220	So there's a lot of grab ass going on with your personal data.
1949820	1951340	Especially by MasterCard.
1951380	1953880	What they like to do is do a lot of data mining.
1953880	1960700	If you guys ever subscribe to a network security magazine or networking magazine, one of those CMP press ones,
1960700	1964860	it's just like there's a whole bunch of ads and fluff and one good article every month.
1965260	1967100	Sorry to CMP if you're out there.
1968080	1973120	So they actually had a really great article about MasterCard and everything.
1973120	1976940	And after reading it, I had to like go dive in and call them and see if this was true.
1976940	1983760	And they have like terabytes upon terabytes upon terabytes of every single transaction that you ever did stored at MasterCard International.
1983900	1988580	Even though it's going to the issuing bank, we kind of talked briefly about that back-end processors.
1988580	1990180	Who are those back-end processors?
1990180	1992480	Well, MasterCard is just this entity.
1992740	1994320	They're just on paper.
1994320	1995380	They don't really exist.
1995380	1996240	They don't do anything.
1996240	1998120	They just sell their MasterCard name.
1998120	2000680	Visa just sells its Visa name.
2000680	2002460	It doesn't really do anything.
2002560	2004460	Well, they're like, well, we can still do stuff with it.
2004460	2007440	So MasterCard decided it's going through us anyways.
2007900	2011340	And it just goes through us because it has to because we're MasterCard.
2011340	2014620	We might as well store that data and do some data mining.
2014620	2021460	So every single transaction you've ever done in your whole life on a MasterCard starting from 2004 is recorded in their database.
2021460	2023540	And it's there for the highest bidder.
2023660	2025580	They can say, hey, what's going on?
2025580	2029380	I want to know more about people who like cheesecake.
2029820	2030800	What else do they like?
2030800	2031820	And they can make correlations.
2031820	2036620	Well, guys who like cheesecake also like to buy lipsticks that vibrate for their wives.
2036620	2037600	How about that?
2037940	2040180	So let's have a special.
2040180	2043380	Let's go down to Deja Vu and have Cheesecake and Lipstick Vibrator Day.
2043380	2045000	Oh, wow, how did they know?
2045000	2046380	That's just amazing.
2048180	2053180	So if you ever wondered like, wow, how do they really know that I like this and that?
2053180	2057600	It's because they data mine all of your credit cards and they see the trends in everything you do.
2057600	2060020	And this has two good benefits, believe it or not.
2060020	2067660	One of the good benefits is if you're just a guy who just goes to Starbucks every single day and gets a latte every single day.
2067660	2071540	And then afterward you pick up the newspaper and a carton of milk from the store.
2071540	2073660	And it's just repetitive over and over.
2073660	2080400	And then one day you're like, I want 18 Starbucks coffees and I bought a big screen TV.
2080400	2082820	They're going to be like, well, wait a minute, that's kind of funny.
2082820	2084500	So it does have a benefit there.
2084700	2094920	And those of you with MasterCards actually do get better call responses than some of the other issuing banks or card associations that license their name out.
2095020	2096460	So you do get that benefit.
2096460	2100920	But mostly it's just for, hey, we want to sell telemarketers your information.
2100920	2104840	We want to sell marketing firms your stuff because they've got to do a new commercial this month.
2105200	2106740	So who else holds it?
2106740	2108700	The front-end processor we talked about, right?
2108840	2115100	They temporarily hold it, but they have to actually hold it for five years for auditing and accounting purposes and accountability.
2115220	2117380	So the front-end processor has your information.
2117380	2127300	And of course, you know, if you guys were ever like driving across country, because that's always fun, just kind of cruise from Florida to Texas, you know, pick two obscure states.
2127300	2130180	And somewhere in between there, there's this place called Louisiana.
2131040	2134440	And, you know, you go into the gas station and they don't have a cooler.
2134440	2138480	They have like an igloo cooler for their sodas and everything like that.
2138480	2140820	And, you know, they just got stuff all over the place.
2140820	2146300	And you're swiping your card and it's an old terminal and your credit card data is just showing up on all the receipts.
2146300	2152480	And they're just stuffing it in a shoebox because they were told to do that, but they didn't know that they only had to stuff it in a shoebox for two years.
2152480	2161760	So they got ten years of like, you know, every guy that traveled from Florida to wherever else through Louisiana who just wanted a cola out of their igloo cooler.
2162280	2164940	They got all their credit card information is sitting there.
2165280	2166840	So they're holding your data.
2168300	2171520	Hotels, auto rental, the worst of the worst.
2171520	2174980	Because hotels, very high rate for fraud.
2174980	2178280	Auto rentals, it's a car, you're going to break it, that kind of stuff.
2178280	2179580	It's probably no good.
2180240	2185060	So you're running into these two things where they take a bunch of information from you.
2185060	2186180	I need your address.
2186180	2187640	I need your zip code.
2187640	2189460	I need your first born.
2189580	2191620	I need, you know, all this other stuff.
2191740	2199600	And you're just like, oh my god, they have my address, my full name, social security number, I don't know, all this other goofy stuff just for me to check in.
2199600	2202200	And that's bundled right there with your credit card.
2202660	2209740	So if I were some guy who's a carter, as they're called in this scene, the test scene, right?
2210840	2216160	If I was one of those guys, I would go out and I would probably be going after a hotel or an auto rental.
2216260	2223440	Especially one of those podunk ones way out in the middle of Louisiana that has all their stuff sitting in a shoe box along with your full address and everything like that.
2223440	2225880	And they can just mine all your stuff and you'll never know.
2226560	2228940	So there you got some information there.
2228940	2232000	And of course your issuing bank also keeps a record of everything.
2232000	2237100	So you got issuing bank, you got the card association, you got the front end processor, and you got the merchant.
2237100	2239000	All these people have your information.
2239880	2241280	Is that a good thing?
2241340	2242440	Probably not.
2242460	2243640	Are they changing it?
2243640	2245120	Not in the least bit.
2245480	2247400	But that's just the way things are.
2247520	2248160	Time?
2249040	2251000	Where's my speaker goon guy at?
2254340	2255540	He's supposed to tell me.
2255540	2256380	How much?
2257700	2259340	Twelve minutes, okay.
2259920	2261380	Oh, hey, there you go.
2261380	2263660	We actually are at the questions and answers section.
2263660	2265580	So we actually made it in time.
2266620	2269480	We are at the questions and answers section.
2270860	2272480	Hint, hint, nudge, nudge.
2278840	2279640	RFID.
2280020	2282760	RFID, what exactly do you want to know about RFID?
2289020	2290400	They want to make money.
2291120	2292240	They really want to make money.
2292240	2293740	It's all about marketing and money.
2293740	2302540	They want RFID because you have to pay for, you know, you have to have new vendors come in to get the RFID enabled.
2302720	2304500	And it's going to speed up the process.
2304540	2306560	McDonald's wants RFID really, really badly.
2306560	2307100	Why?
2307100	2311100	Because I can sling you a microwaved hamburger and get you the hell out of there.
2311100	2314560	So I can get somebody else to sling him a microwaved hamburger and get him the hell out of there.
2314560	2315600	So it just swipes.
2316060	2316760	So does Walmart.
2316760	2317360	They're working on it.
2317360	2318320	Yes, right there.
2318960	2319560	Bees!
2319620	2320840	Bees everywhere!
2323460	2326160	I believe that man has bees on him.
2327000	2329020	Damn scavenger hunt kids.
2330480	2331520	Okay, I'm sorry.
2331520	2332480	You were saying?
2343130	2349350	Well, I can't repeat what you said to everybody else because that's not supposed to be disseminated.
2350110	2355750	But yes, he was talking about encryption and stuff like that.
2355750	2357450	We didn't really get into debit cards.
2357450	2358650	I really wish we could.
2358650	2362790	They didn't have enough room for a two-hour because we can talk about Duck Put.
2362790	2366730	By the way, Duck Put and all that fun stuff is the encryption used for debit pin cards.
2366730	2369890	So if you know how to crack that one, which is super easy, it's like a one-way.
2369910	2373270	You can get people's pin numbers flying across the line.
2373270	2373990	Yes, sir?
2379260	2383140	I cannot give you a concrete answer personally, but I would assume so.
2383500	2384460	Oh, for sure.
2384460	2390520	Personally, that would be a much easier way to data mine because it takes time for...
2390520	2393540	The question was, do they data mine pin cards and debit cards?
2393540	2394800	And I'd probably say yes.
2394800	2396740	I'm not going to say yes, but probably yes.
2396760	2402780	Because as soon as you swipe, it doesn't say this was at some place somewhere and we'll tell you later where it was.
2402780	2406340	It says right away, he bought cookies at an a.m. p.m.
2406340	2407340	Like right away.
2407400	2409420	So it's actually more data in that.
2409420	2411740	Because it's a newer technology, they can add more data.
2411740	2416240	So I would believe that that would be the juicy nugget, so-called, that they would really want.
2417540	2419760	Anybody else that doesn't have B problems?
2419760	2421720	That gentleman right back there.
2432630	2434790	It's similar and easier.
2435150	2444130	The question was, the EasyPay, is the new ones that are coming out from RFID in general, and Chase has been promoting theirs.
2444130	2447790	Is it anything like the EasyPay that's promoted by mobile?
2447790	2450290	It's not exactly like it.
2450290	2456250	But it's actually easier because the mobile one actually has strong encryption that was Texas Instruments proprietary.
2456250	2458730	Until those cats over at the university broke it.
2459110	2461550	But this one is not even proprietary.
2461630	2465690	I don't remember it off the top of my head because you put me on the spot there.
2465690	2468570	But it would be the equivalent of like ROT13.
2468570	2469870	It's almost embarrassing.
2473010	2477330	Actually, if you want to do some war driving fun with gas stations and stuff like that,
2478770	2480330	which I would not promote,
2481810	2484670	but if on the off chance you wanted to do something like that,
2484670	2491590	all the terrible herps here in town use radio frequencies to throw all those LCD video onto those screens.
2491590	2493490	And it's push, not pull.
2493490	2499330	So if you just push data to it, you can push, you know, Goatsy onto all the screens.
2499330	2501150	And we'd get a crack out of that.
2501530	2503990	I've got to give my friend Ripsy here shouts out.
2503990	2506630	He's the one that actually war drived that one and found out all that.
2507370	2508310	Yes, sir.
2510190	2511870	Actually, no.
2512390	2516170	We actually had a hard enough time to actually get to the laptop
2516170	2519610	because we screwed up with a lot of stuff organizing, getting here,
2519610	2522350	like dropping off cars and picking new ones up, and it was in it.
2522390	2524470	And we didn't get the program on here.
2524470	2528110	I can swipe it and you can see it, but then you'd all see my credit card that's still active.
2528590	2529870	And that wouldn't be fun.
2530390	2532990	If you have a canceled credit card, I would be more than happy.
2532990	2534910	Thank you. This is a team player right here.
2540960	2541760	And now...
2547260	2549200	A dingo ate her baby.
2550760	2551680	All right.
2551780	2554540	Dance scavenger hunt kids, I tell you what.
2555880	2556680	Awesome.
2557100	2560280	So, okay, if you guys just noticed up on the screen, I just opened up...
2560280	2561920	Hey, how are we doing on time?
2562760	2563700	He doesn't know.
2564540	2565900	Six minutes, all right.
2565900	2568900	If you noticed, I just opened up a notepad.
2568940	2570400	Notepad, nothing special.
2570440	2573800	Hell, I can make a new file and just, like, rename it and then swipe my card.
2573800	2576100	So we're just going to swipe this really quick and see what happens.
2585300	2587200	And somehow his name is not there.
2587200	2589320	Is this a, like, ghost card or something killer?
2589780	2592340	I don't know if your corporate would like that too much.
2592880	2596100	Okay, so your name didn't pop up at the very beginning there.
2596700	2599620	For whatever reason, is it just font issues?
2602820	2605580	Well, we'll try this Vons card as well and show you the differences.
2610820	2612460	All right, there's that Vons card.
2612460	2614580	Well, at the very beginning, the first one you see there...
2614580	2619100	And we probably should do this for you people with the Coke bottle glasses.
2627060	2629180	Okay, I'm just kidding.
2630680	2632880	All right, let's do 36.
2634820	2636080	That's good enough.
2636900	2638840	So we can kind of see this discretionary data.
2638840	2640120	And I'll go through this.
2640120	2644340	If we notice right here, right, this is not an expired card.
2645180	2648260	Oh, it's canceled, okay.
2648260	2651100	If we notice, we talked before about how they reverse them.
2651100	2653760	So can everybody shout out what the expiration date is?
2655740	2658320	Oh, that's right, February 2007.
2658520	2660740	And then what did we say was the next three digits?
2662160	2663440	March, I know my...
2664460	2666280	Valentine's Day, I get suckered every time.
2666280	2667660	I thought it was the third month.
2667660	2668980	Come on, give me some slack.
2670040	2672140	March, March 2007.
2672140	2674820	Okay, so then what did we say was the next three digits?
2675840	2677860	Country code, and 101 is?
2678540	2681120	U.S., don't ask me to call anything else.
2681120	2682960	And then here's all this discretionary data.
2682960	2686940	It's just a bunch of zeros, and then there's that 5, 6, 4, 0, whatever.
2687500	2688900	And then you see there's the question mark.
2688900	2690620	That's actually, good thing we swiped it.
2690620	2693000	Good thing we swiped this, because I left out that delimiter.
2693000	2695200	Question mark means end of track one.
2695400	2696660	Then you have the semicolon.
2696680	2698940	Then once again, you have the credit card number in full.
2700460	2703320	Equals 0703, which is backwards, just as we said.
2703320	2704760	101, international code.
2704760	2707740	And look, the discretionary data is exactly the same.
2707820	2709720	And then question mark to say it's done.
2709840	2711320	And then the next one is a bonds card.
2711320	2717980	As you can see, you know, private label cards and stuff, and fun stuff to get discounts on stuff that should already be that cheap.
2720020	2722320	It has its own format and everything.
2722760	2724640	So that's your swipe code.
2724640	2726500	And once again, let me remind you.
2726500	2729640	If you go to the Hackajar eBay sale for $35...
2729640	2731060	No, I'm just kidding. I don't have one.
2731580	2734300	For like $35 to $40, you can get these online.
2734360	2740220	Believe it or not, the PS2 ones are more expensive than the USBs.
2740220	2740660	I used the...
2742920	2743640	Excuse me.
2743640	2746440	I used PS2 ones because they're universal across everything.
2746440	2751240	You don't have to deal with USB drivers or stuff that thinks it needs drivers but doesn't really need drivers and all that.
2751240	2752600	So that's why they're a little bit more expensive.
2752600	2753940	And they're also harder to find.
2754340	2755560	So, are we done?
2755560	2756300	Are we got more time?
2756300	2758000	We got a couple more questions maybe?
2758680	2759400	Time check?
2760880	2761920	Four minutes.
2761920	2762720	Yes, sir.
2766100	2768560	The one-time virtual cards, do they recycle their numbers?
2768780	2770440	The numbers, one thing we didn't get into.
2770440	2773940	We should probably cover that real fast for all you guys that are team players that stuck around.
2774900	2775960	LUNMOD10 check.
2776820	2781000	It's pretty much just barcodes, UPC codes.
2781020	2782760	You put the number through an algorithm.
2782760	2785120	And if it returns one, then that means that it's valid.
2785120	2786040	If it doesn't, it's not.
2786040	2788980	LUNMOD10 is the algorithm they use to verify the cards.
2789200	2791160	So, it's very possible.
2791160	2792220	It's just like MD5.
2792220	2793500	You know, you're going to have some collisions.
2793500	2799640	It's very possible that, you know, you go through so many cards and that have to conform to this LUNMOD10 that you're going to run into it again.
2799640	2802760	It's not too much of an issue right now because there's so many combinations.
2802960	2811380	But when those things get really popular, it might be an issue for those individual banks for credit cards colliding when you have virtual cards.
2811460	2814360	And I think we can do one more question and then that way we can get everybody out.
2814360	2817660	So, there's some guy waving like a banshee back there.
2817660	2819220	I think it's a girl, actually.
2821560	2827240	The CISSP, C-I-S-S, or C-I-S-P, the Cardholder Information Security Program.
2827280	2831480	That's nothing like the Cubix information security stuff.
2832100	2834960	CISSP, it was created by Visa.
2834960	2836300	And it sucks.
2836700	2837680	Hands down.
2837680	2840700	They have what's called the Dirty Digital Dozen.
2840700	2849640	And it's stuff like, you have to conform to this in order to authorize credit cards in an internet world or in a brick-and-mortar to internet authorization world.
2850440	2853620	And they're like stuff like, do you have a firewall?
2854280	2856300	Does everybody log in with their own account?
2856300	2858180	It's like, well, thank you, Captain Obvious.
2859480	2862580	But they certify these independent auditors.
2862580	2865300	No offense to you guys because it's good money for you, I know.
2866200	2875220	They certify these independent auditors to go out and be CISSP certified auditors that charge $25,000 to $40,000 per site just to say, yep, you have a firewall.
2875220	2876720	Yep, you have limited access.
2876720	2878940	Yep, you have individual account names.
2879040	2880820	Great, you're certified.
2880860	2882260	Give us $25,000.
2882820	2886300	And you've got to do this every year in some cases.
2886520	2888020	So I think it sucks.
2888020	2894020	I think they're just using it as another way to grab money and not using what it's supposed to be used for, to secure credit cards.
2894020	2895880	Make sure our transactions are safe.
2896460	2897720	All that fun stuff.
2897840	2901920	And I believe that's the last question we're going to have unless you're like, no, no, what about that last thing?
2901920	2902440	Anybody?
2904520	2906040	The who's? The bees?
2906080	2908600	These scavenger hunt guys, man, I tell you what.
2908740	2910200	You know, they just go nuts.
2910300	2912900	All right, well, thank you so much, guys, for your patience and everything.
2912900	2915760	And I appreciate everything you've done.