WEBVTT 00:00.620 --> 00:02.140 Can you guys see okay in the back? 00:02.140 --> 00:04.400 We have all this tech stuff for the black and white. 00:05.100 --> 00:05.880 Everybody's okay? 00:05.880 --> 00:06.620 Okay. 00:07.120 --> 00:09.340 Alright, thank you for attending. 00:10.000 --> 00:11.440 Credit cards and everything. 00:11.540 --> 00:12.920 This is the third year of this. 00:12.920 --> 00:18.140 The first year we did social engineering aspect, as long as some light Wi-Fi stuff. 00:18.320 --> 00:19.500 Can everybody hear me okay? 00:20.820 --> 00:21.620 No. 00:22.020 --> 00:28.540 Okay, and last year we did a live demo, where we actually had some people in the front row interacting, trying to break in. 00:28.540 --> 00:34.160 And at the very end, Spoonim was nice enough to do some cross-site scripting. 00:34.160 --> 00:35.840 So thank you, Spoonim, if you're out there. 00:37.180 --> 00:39.640 Okay, this year we're just going to kind of go over the basics. 00:39.820 --> 00:42.900 And when I say basics, I hope you guys don't go, ah, basics. 00:43.020 --> 00:47.260 It's like basics on like getting into the industry kind of level. 00:47.260 --> 00:49.580 So hopefully it's informative for everybody. 00:50.220 --> 00:52.880 So this is credit cards, everything you have ever wanted to know. 00:53.900 --> 00:57.320 And we're going to start off with a brief history of credit cards. 00:58.400 --> 01:02.240 1950 Diners Club was the first credit card style thing. 01:02.400 --> 01:10.500 I believe Sears Robux in the mid-20s did a credit where you can buy a washer, dryer, or something like that, and then pay later. 01:10.500 --> 01:12.120 But it was all on paper and books. 01:12.120 --> 01:16.680 It wasn't really in the format we're used to, which is plastic or some form thereof. 01:17.220 --> 01:20.040 1958 American Express was the next one to come out with it. 01:20.040 --> 01:25.420 It was exclusively in New York City, and it was mostly for restaurants and hotel stays. 01:25.420 --> 01:27.760 Kind of high society kind of people. 01:28.440 --> 01:36.480 And this is an interesting aspect here with American Express, because when they came in and Diners Club was already there, it was mostly for the high-end customers. 01:36.680 --> 01:46.580 So what people wanted to do was accept these credit cards so that they can draw on the high-end clients that were the only ones, the elitists, that were allowed to actually have credit cards. 01:46.760 --> 01:55.240 So the credit card industry created this weird paradox where if you want to accept a credit card, you have to pay us to accept credit cards. 01:55.240 --> 02:09.740 So when you swipe your card, 50 bucks goes through, about 35 cents on average goes directly to the credit card company for the luxury of having the ability to authorize credit cards for the merchant. 02:09.740 --> 02:18.960 And that kind of set a standard and a tone for the industry, and also automatically started some security concerns in and of itself. 02:18.960 --> 02:25.460 A 1958 Bank of America card started by Bank of America, which is now, as we all know, Visa. 02:25.460 --> 02:30.000 That was in the late 70s when it switched over to the Visa brand when they went international. 02:30.960 --> 02:43.600 1966 MasterCard International, ICA, the consortium of banks, got together and said, we want to also have a credit card to compete with Bank of America and American Express. 02:43.600 --> 02:58.700 And then way, way, way, way late in the game, 1986, Discover Card, which was originally started by Sears Roebuck, and now Payne Webber, they just got together and merged and now they're breaking apart. 02:58.700 --> 03:05.460 Payne Webber and a couple other financial institutions took over Discover Card and now they're selling it off to itself. 03:06.300 --> 03:09.480 So let's talk about the technology behind credit cards. 03:09.480 --> 03:13.860 Like we said before, back then it was all low-tech and everything like that. 03:13.860 --> 03:16.400 I seem to be getting some sort of interruption here. 03:19.360 --> 03:22.600 Hello, I am Ripshe with DC702. 03:22.640 --> 03:29.000 We are doing a scavenger hunt and I'm going to give you a brief discussion about the scavenger hunt. 03:29.160 --> 03:31.880 I'll read the introductory paragraph for you. 03:32.460 --> 03:36.420 Welcome again to the greatest DEF CON competition brought to you by DC801. 03:36.420 --> 03:40.360 On the back of this page is a list of items, tasks, and their point values. 03:40.740 --> 03:47.780 From the time you get this list until noon on Sunday, collect as many of those items and complete as many tasks as possible. 03:48.000 --> 03:50.840 The team with the most points at noon on Sunday wins the hunt. 03:50.840 --> 03:58.300 Prizes are donated from all the vendors, many thanks to all those that donate, and whatever we were able to come up with before getting here. 03:58.400 --> 04:05.780 Aside from the great time last year's teams had playing, first, second, and third place went home with plenty of shirts, books, hardware, stickers, and toys. 04:05.780 --> 04:09.560 First place took home black badges, but we can't promise anything. 04:09.640 --> 04:13.280 I really don't have anything original to talk about, so that's about all I'm going to do. 04:13.280 --> 04:13.960 Thank you. 04:13.960 --> 04:17.300 Thank you for interrupting the speech that you were not scheduled for. 04:18.640 --> 04:24.320 And somehow you were not scheduled for that speech and yet you're doing it because you're part of the scavenger hunt. 04:24.720 --> 04:26.100 Hint, hint, nudge, nudge. 04:27.740 --> 04:30.240 Alright, back on with the normal speech. 04:30.240 --> 04:31.960 Okay, so technology. 04:32.440 --> 04:37.900 They had the knuckle busters, as we all call them today, and American Express was the first to start this. 04:38.060 --> 04:42.520 And that was where the imposed imprints came on the cards originally. 04:42.680 --> 04:49.020 Because you put them on the, as we all know, whoever's worked in retail at least once in their life and had a card that did not swipe. 04:49.020 --> 04:57.620 You put the card down, you have a sheet of paper, and then you push over the sheet of paper and it imprints your credit card number, your name, expiration date, that kind of thing. 04:57.620 --> 05:03.280 And these receipts were all collected up at the end of every night and they were mailed off to the credit card company. 05:03.280 --> 05:07.560 And only when they were received by the credit card company did you actually get the money from that client. 05:07.640 --> 05:12.260 So if there was any fraud or anything like that, it took a very long time before it was discovered. 05:12.460 --> 05:18.060 They also did phone authorizations on certain credit cards or certain businesses of high risk. 05:18.060 --> 05:19.740 That kind of mitigated that risk. 05:20.100 --> 05:24.380 And then in the 80s is when dial-up authorization terminals came into play. 05:24.380 --> 05:35.260 Dial-up is pretty much those trans 380s or Ingenico devices that you see now where they just swipe the card, punch in how much money, and hit enter. 05:35.260 --> 05:39.800 And then it would pick up the phone line, dial out, connect to get authorization. 05:40.240 --> 05:44.020 And the interesting thing about this is they originally started off at 1,200 baud. 05:44.240 --> 05:49.460 And at 1,200 baud, you'd think, okay, that was so 1985, so 1991. 05:49.460 --> 05:55.060 But they still use, to this day, anybody who does dial-up, they still use 1,200 baud as their connection rate. 05:55.100 --> 05:59.820 Simply because they don't want to upgrade their servers or their mainframes for higher speeds. 05:59.980 --> 06:07.080 If anybody wants faster authorization, they say, well, just use lease lines or use direct connections to the bank. 06:07.840 --> 06:09.560 It's very fast transactions. 06:09.560 --> 06:14.820 You don't really need more than 1,200 anyways to connect in, get an authorization, and close out. 06:14.820 --> 06:29.200 The only time that it actually causes a problem is at the end of the night, if you have like 300, 500 credit cards that were authorized, you have to wait like 20 minutes as it slowly pushes across the 1,200 baud modem all the credit cards that need to be finalized. 06:29.980 --> 06:32.660 High-speed lease lines, we kind of just talked about that. 06:32.660 --> 06:43.280 High-speed lease lines is pretty much, I'm Walmart, and I have all my stores connected, and it doesn't make any sense to use any third-party people, just go straight to the bank and get authorizations. 06:43.280 --> 06:49.080 And so they have like Walmart, they have all their stuff consolidated into one source and then going out. 06:49.100 --> 06:55.360 Same thing with CSK Auto for those that are in the United States, which is Checkers, Shooks, Cragen, if any of those sound familiar. 06:55.420 --> 07:01.200 All theirs go down to Arizona, and then from Arizona, it goes out and gets authorization, comes back, and then goes to your respective store. 07:01.880 --> 07:10.140 So for high volume or big names that have a lot of weight to throw around, a lot of money and that kind of stuff, they can usually get direct lines. 07:10.140 --> 07:16.800 Gateway processors, these are like Go software, IC Verify, Shift 4, that sort of thing. 07:16.840 --> 07:26.060 They're for like the middle tier and the low-end clients that don't do more than like anywhere between 100 transactions a month to about 200,000 a month. 07:26.120 --> 07:27.800 And you usually use a front-end gateway. 07:27.800 --> 07:33.260 PayPal can technically be considered a front-end gateway because you have APIs for your websites. 07:33.620 --> 07:38.160 CC Bill and iBill and all those other blue light catering ones is also gateways. 07:38.960 --> 07:40.440 Co-op leased line. 07:40.440 --> 07:41.860 This is actually kind of unique. 07:41.860 --> 07:43.940 The only time I've ever seen a co-op leased line. 07:43.940 --> 07:45.300 Am I going too fast, guys? 07:46.340 --> 07:58.500 Okay, the only time I've ever seen a co-op leased line was here in town, like at the MGM and a few others that are not even directly associated with each other through business arrangements. 07:58.560 --> 08:00.020 They have like a direct line. 08:00.020 --> 08:01.880 And I'm going down. 08:02.940 --> 08:05.040 That's what I get for not plugging it in. 08:06.060 --> 08:08.580 So, well, that's coming back up. 08:08.840 --> 08:12.900 So what they did was they were all like, well, we have a direct line directly to the bank. 08:12.900 --> 08:19.600 So we can resell this line or we can all cooperate in paying for the leased line to go out and work that way. 08:19.600 --> 08:22.280 And it's still being stubborn. 08:23.060 --> 08:24.160 Oh, there you are. 08:28.920 --> 08:30.060 All right. 08:32.440 --> 08:33.360 Hush. 08:38.060 --> 08:39.440 I just enumerated. 08:39.440 --> 08:40.300 That was great. 08:41.540 --> 08:44.880 Luckily, there's no direct connects in, I don't think. 08:48.060 --> 08:49.460 You'll harbor brute force it. 08:49.460 --> 08:50.120 There you go. 08:51.020 --> 08:54.940 Okay, so these co-ops, they're just pretty much everybody just kind of gets together. 08:54.940 --> 08:56.820 We're a bunch of small businesses and we don't want to pay. 08:56.820 --> 09:02.720 It's like anything else where if we all buy like a sack of potatoes, we can get it for a cheaper price kind of thing. 09:02.720 --> 09:07.980 So everybody buys into the same lease line and gets better rates going through. 09:08.580 --> 09:13.340 And then we already talked about PayPal a little bit with online API gateways, CC auth and iBill. 09:13.340 --> 09:14.960 And I don't know. 09:15.200 --> 09:16.160 I don't go to those sites. 09:16.160 --> 09:17.140 What do you guys use? 09:17.520 --> 09:18.360 No, I'm just kidding. 09:20.080 --> 09:22.880 Okay, so marketing and technology. 09:22.880 --> 09:27.660 So some of these different technologies that are coming out that everybody kind of wants to know about. 09:27.660 --> 09:30.600 And I'm here to tell you guys, I'm going to burst your bubble. 09:30.600 --> 09:31.960 A lot of them mean nothing. 09:31.960 --> 09:34.460 Like the smart cards is the first one. 09:34.460 --> 09:37.720 We all know this with the American Express Blue. 09:37.720 --> 09:43.820 We have the little silver or gold smart card built into it and it's supposed to be more secure and all this other stuff. 09:44.960 --> 09:46.420 Nobody uses it. 09:46.600 --> 09:47.540 No vendors use it. 09:47.540 --> 09:49.420 There is an actual protocol out. 09:49.420 --> 09:51.920 There's a specification for how it works. 09:51.980 --> 09:56.080 I know NDC, VisaNet and FDC support it. 09:56.080 --> 10:00.200 But they're the only ones and that's not enough to actually get full on. 10:00.200 --> 10:04.560 And here's a couple reasons why smart cards are not working and why they're not coming to market. 10:05.120 --> 10:07.880 It's because the vendors are paying for all the equipment. 10:08.040 --> 10:11.220 If you want a terminal to swipe cards, you have to pay for it. 10:11.220 --> 10:14.020 If you want the ability to accept cards, you have to pay for it. 10:14.020 --> 10:18.480 If you want each individual one, like you want to accept Visa, you have to have an agreement with them. 10:18.480 --> 10:21.000 If you want to accept MasterCard, you have to have an agreement with them. 10:21.080 --> 10:22.220 So on and so forth. 10:22.300 --> 10:25.800 So the merchants are the ones that are really getting suckered out of a lot of money here. 10:25.800 --> 10:34.480 And then all the ISOs, Independent Sales Organizations and MSPs, Merchant Service Providers, they come to them and say, we have this smart card stuff. 10:34.480 --> 10:42.460 All you have to do is take out that one terminal that I just charged you $350 for and put this new one in that's $900 so you can accept smart cards. 10:42.460 --> 10:50.520 And then you'll be way more secure with only 1% of America actually having smart card on their cards. 10:50.520 --> 10:51.780 So it's a very hard bargain. 10:51.780 --> 10:54.200 So that's why smart cards just kind of floated along. 10:55.280 --> 10:57.000 Virtual one-time use cards. 10:57.140 --> 11:01.080 I wasn't even aware of these until somebody asked me about it after the speech last year. 11:01.080 --> 11:04.840 And then I looked into it a little bit and talked to some people about it. 11:04.840 --> 11:11.820 And these are pretty much... you're online and you're super, super, super paranoid that somebody's going to steal your credit card online. 11:11.820 --> 11:12.600 They're going to do it. 11:12.600 --> 11:14.500 I just know they're going to steal my credit card. 11:14.500 --> 11:16.780 I can't handle having my credit card online. 11:16.780 --> 11:24.080 So what they do is they go out and they register with... I think Bank of America supports this and Chase Bank supports it. 11:24.540 --> 11:25.620 And Citibank supports it. 11:25.620 --> 11:27.120 That's right, they're the big promoter of it. 11:28.740 --> 11:31.540 They pretty much say, we're going to give you a laundry list of cards. 11:31.540 --> 11:34.100 And you can use this card number exactly once. 11:34.100 --> 11:36.620 And as soon as you use it, it's now a dead card. 11:36.620 --> 11:46.360 Or I want to use this credit card for reoccurring billing, which means you're going to work out at the gym or you are part of the jello club or something like that. 11:46.740 --> 11:50.840 And you want them to keep on billing you $10 a month for all the great jellos in the world. 11:51.680 --> 11:56.300 So you can have a one-time use that will only be authorized to work at that merchant. 11:56.300 --> 11:57.840 It won't work at any other merchant. 11:57.840 --> 12:07.680 So somebody will know right away that the merchant's got a problem and that their credit card was hijacked from that merchant as soon as it gets used somewhere else. 12:08.900 --> 12:11.180 And some people ask, well, how does this work? 12:11.180 --> 12:12.480 How is this possible? 12:12.600 --> 12:17.720 Well, this kind of gets into a little bit of the more thicker realm of credit cards and how they work. 12:17.920 --> 12:22.160 And all your authorizations go all the way back to your bank. 12:22.160 --> 12:25.560 So when you swipe the card, it goes through what's called a front-end processor. 12:25.560 --> 12:30.680 And they pretty much aggregate all the credit cards and say, okay, we have all the phone numbers. 12:30.680 --> 12:32.920 We have all the direct links to all the banks. 12:32.920 --> 12:38.400 Because back in the day, you know, you had this small trans-380 terminal and had like 56K of memory. 12:38.400 --> 12:42.920 You can put one phone number, your merchant information, your BIN number in it, and that was it. 12:42.980 --> 12:50.680 So if you had to call a different bank every time that somebody with a different bank came along to get an authorization, you'd fill up all that memory. 12:50.680 --> 12:53.460 And it would just be a nightmare managing accounts with everyone. 12:53.460 --> 12:57.880 So what they said was, well, we'll manage our accounts with everyone, and you just connect to us. 12:57.880 --> 12:59.420 And that's the front-end processor. 12:59.540 --> 13:05.240 And then you connect to us, and then we'll hop onto what's called Merchant Link when you go into Visa or Bank of America. 13:05.320 --> 13:14.800 Or we'll hop onto the back-end processors, as they call them, which are shared networks that are just private networks that connect you directly to issuing banks. 13:14.960 --> 13:22.280 So when you use this credit card online, it goes through the front-end processor, through the back-end network, and then to the exact bank that issued it. 13:22.280 --> 13:28.660 So if you, say, generate a credit card online and it just generates it, the bank already has it in its database. 13:28.660 --> 13:35.540 So whenever you use it somewhere else, it goes directly back to the bank, and then the bank knows, oh, hey, I just created that card. 13:35.540 --> 13:40.660 Go ahead and send an authorization response back to the merchant. 13:40.660 --> 13:46.840 And that's how that's possible, is because everything touches the actual issuing bank in every transaction. 13:48.360 --> 13:49.640 Secured cards. 13:49.820 --> 13:54.600 These are kind of new technology and everything like that. 13:55.420 --> 13:56.780 There's... oh, I'm sorry. 13:56.780 --> 13:57.600 I'm on the wrong one. 13:57.600 --> 13:58.140 Easy Pay. 13:58.140 --> 14:04.900 Secured cards are those cheesy ones where it's like, hey, give us $200 and we'll give you a credit card with a $200 credit limit. 14:06.100 --> 14:06.980 Okay. 14:07.540 --> 14:10.600 I have $200 on your credit card. 14:10.600 --> 14:11.500 What does that mean? 14:11.500 --> 14:14.140 Well, we're going to charge you service fees and all this other stuff. 14:14.140 --> 14:21.880 So you get a credit card, so when you go to the bank or you go shopping or everything, you get to be like, I'm a proud credit card holder. 14:22.000 --> 14:23.080 Look at me. 14:23.140 --> 14:25.780 And you can be like 17, 18 and get these things. 14:25.800 --> 14:34.480 So I'm not promoting this, but theoretically online, over 18 authorization usually means if they have a credit card, they're over 18. 14:34.660 --> 14:41.220 And if you happen to go to Walgreens and get one of these secured credit cards for $200, you now have a credit card and you're 13. 14:43.060 --> 14:50.040 So that's just something I heard from somebody, but I do not promote you going and doing any online transactions under the age of 18. 14:50.040 --> 14:50.940 That would be bad. 14:51.380 --> 14:55.780 But these are pretty much for people who have bad credit, want to rebuild their credit, that kind of thing. 14:56.300 --> 14:59.500 You know, various different aspects of rebuilding credit. 14:59.500 --> 15:04.220 That's not really what this speech is about, but we'll touch upon it just really briefly because we're talking secured cards. 15:04.260 --> 15:07.460 It doesn't really help you out too much because people know. 15:07.460 --> 15:11.400 Before they were like, oh, he has a credit card and it has a $200 limit and he pays it on time. 15:11.400 --> 15:13.420 Well, yeah, he pays it on time because it's his money. 15:13.580 --> 15:18.100 So he gets better credit, but they got privy to who's doing this and how they're doing it. 15:18.100 --> 15:25.400 And so it really doesn't help your credit score to rebuild credit after a bankruptcy or foreclosure or things shutting down yet again. 15:27.820 --> 15:29.960 It is another second form of ID. 15:30.480 --> 15:33.900 And that does help out to get various different things. 15:33.900 --> 15:39.020 And it's easier to get it because you can just log on to our website and say, hey, I am Joe Bob. 15:39.020 --> 15:40.100 Give me this credit card. 15:40.100 --> 15:41.040 And it just gives it to you. 15:41.040 --> 15:41.920 Oh, you're Joe Bob. 15:41.920 --> 15:42.640 Sure thing. 15:42.640 --> 15:47.020 So you don't have to have actually any authorization or any proof to get that. 15:48.000 --> 15:48.800 All right. 15:49.080 --> 15:49.500 Okay. 15:49.500 --> 15:51.620 So the easy pay RFID cards. 15:51.800 --> 15:58.360 There was those guys out at the university that cracked the ones for mobile, if you guys are familiar with that. 15:59.540 --> 16:04.560 And the mobile cards were pretty much, you know, those swipe ones where you're like, I want gas really quick. 16:04.560 --> 16:06.520 So you just kind of wave your card, you know. 16:06.520 --> 16:08.400 It's just, yeah, I'm going to do that one more time. 16:08.460 --> 16:09.700 Wave your card. 16:10.020 --> 16:13.220 And boom, you get your gas and everything like that. 16:13.300 --> 16:15.380 And Chase also premiered these. 16:15.380 --> 16:22.500 And we're trying to get a hold of one of these Chase ones because we wanted to build a RFID sniper rifle. 16:23.060 --> 16:26.760 But we're working on it. 16:26.760 --> 16:28.700 So maybe by... 16:29.140 --> 16:30.780 Can I promote other events? 16:30.780 --> 16:31.860 Maybe by... 16:34.540 --> 16:37.320 Maybe by one of these other conferences we'll have it ready. 16:38.940 --> 16:40.680 So keep an eye out for that. 16:40.680 --> 16:45.880 But we're going to work on that with Chase and see if we can crack it just like the university guys did for easy pay. 16:46.000 --> 16:52.100 And these are just pretty much when you pass it over, the power is generated from the actual terminal you're waving over. 16:52.100 --> 16:54.920 And that's how it activates the card to get your information. 16:55.920 --> 16:58.980 And we'll talk about some security on that in a little bit. 16:59.200 --> 17:00.780 All right, physical fraud features. 17:00.780 --> 17:03.020 This is the interactive part of the demo. 17:03.400 --> 17:07.800 Go ahead and I'll pull out your credit cards and stare at them and mask them from everybody else. 17:07.800 --> 17:08.920 I'll do it myself. 17:13.700 --> 17:15.100 Oh, I'm dead serious. 17:15.520 --> 17:17.560 So I have my PayPal account here. 17:17.720 --> 17:18.100 So we can... 17:20.500 --> 17:21.300 It's 3348... 17:21.300 --> 17:22.180 No, I'm just kidding. 17:23.000 --> 17:24.600 33 would be JCB. 17:24.600 --> 17:28.560 I mean, I don't know what's going on right now. 17:29.980 --> 17:36.080 Okay, so if you actually want to toll it out and everything, if you're familiar with it, if you have photographic memory, you can think about your credit card for a minute. 17:36.420 --> 17:42.680 And for those of you in front who better not have photographic memories, you can kind of stare at mine. 17:42.680 --> 17:48.340 When we're looking at these, we're talking about the imposed numbers, those originally generated from the knuckle busters. 17:48.340 --> 17:52.060 But they became a fraud prevention mechanism. 17:52.280 --> 17:59.900 Because as long as the imposed one, which is a little difficult to push up, is the same as the magnetic strip, then you're okay. 17:59.900 --> 18:04.440 Some people, we've seen a lot of fraud where people actually push it down and then re-push up new numbers. 18:04.520 --> 18:05.980 And they're like really easy to spot. 18:05.980 --> 18:07.800 So that's a telltale sign. 18:08.420 --> 18:13.540 Also on them, as far as imposed is concerned, you're going to see the letter of the credit card that is on there. 18:13.540 --> 18:21.300 If you ever notice why there's a cursive M, or a cursive V, or a cursive D, or a cursive A, those are all saying, you know, I'm a MasterCard, I'm a Visa. 18:21.500 --> 18:29.840 So if you swipe it and it's a Visa card, and then you look on it and it says M, then you know there's something funny going on. 18:30.260 --> 18:34.400 Also on these things, you have the logos, which says MasterCard, that's another fraud feature. 18:35.140 --> 18:47.180 And the holograms, the hologram actually came in in the late 80s because of those guys who were watching people putting in their credit card number and phone booths to make phone calls, long distance phone calls. 18:47.540 --> 18:52.660 And they were just like memorizing, they can just like photographic memory, stare at your card and then boom, now. 18:52.660 --> 19:01.520 So the last four digits of your card goes over the hologram, so it's harder for these people to really visually see your card and take a snapshot and start doing fraud on that. 19:01.520 --> 19:04.500 Of course, you got the expiration date on there in many different forms. 19:04.500 --> 19:12.200 Some banks will have, it was issued on this day and then it was expiring on that day. 19:12.200 --> 19:14.220 And some just say it expires on this day. 19:14.680 --> 19:15.680 What else we got? 19:15.920 --> 19:17.500 The curse of letter we talked about. 19:17.820 --> 19:20.400 First four digits non-imposed. 19:21.120 --> 19:26.220 Okay, yeah, also on most cards, when you're looking at the first four digits, non-imposed is also printed on the card. 19:26.220 --> 19:30.180 The first four digits of the card, that's a little bit of a fraud thing there. 19:31.160 --> 19:34.040 Magnetic strip, of course, we're all privy to the magnetic strip. 19:34.040 --> 19:35.600 I happen to have a swiper here. 19:36.000 --> 19:39.700 There are $35 on eBay, from what I understand. 19:39.760 --> 19:41.460 They plug right into your keyboard. 19:41.940 --> 19:44.200 And you can just pretty much swipe any card you want. 19:44.200 --> 19:48.620 You want to see what's on your Blockbuster card, you want to see what's on your PayPal card, you can just swipe it. 19:48.620 --> 19:54.280 And we'll do a quick demo here, I think, if the software's going to work, that X's out my account number when I swipe. 19:54.720 --> 19:57.460 So, we'll see how that works out. 19:58.220 --> 20:00.220 The signature panel on the back. 20:00.220 --> 20:01.780 The signature panel says the card types. 20:01.780 --> 20:06.720 It'll say discover, discover, discover, and 45-degree angle, or MasterCard, MasterCard, MasterCard. 20:06.720 --> 20:11.020 And underneath that, if you scratch it with a coin, like it's a lottery ticket, it says void. 20:11.020 --> 20:14.260 So as soon as you see the void, merchants are not supposed to accept the card. 20:15.160 --> 20:17.300 CVV2 code, that's kind of relatively new. 20:17.300 --> 20:19.820 It means Card Verification Version 2. 20:20.300 --> 20:21.900 What was Version 1? 20:21.900 --> 20:24.420 Well, Version 1 was magnetic data. 20:24.420 --> 20:28.900 The unique data, discretionary data, as they call it, on the card itself. 20:29.760 --> 20:35.680 So, Card Verification Version 2 is mostly used in over-the-phone sales and online sales. 20:36.180 --> 20:38.240 Okay, credit card magnetic data. 20:38.240 --> 20:39.960 Two tracks for credit cards. 20:40.160 --> 20:44.100 I wasn't sure if I was going to talk about it last year, and people said, ah, just go ahead and do it. 20:44.260 --> 20:50.800 It's pretty much public knowledge, and since you can get one of these anywhere, and you can look up the specs, I'll give you guys the details of what's going on there. 20:50.800 --> 20:52.640 Okay, so you have three tracks. 20:52.640 --> 21:04.480 Each piece of information that gets swiped off of it on the magnetic strip card reader is a track of data, and they were originally specified throughout the years of what track 1 would be, what track 2 would be, and what track 3 would be. 21:04.740 --> 21:06.660 So let's talk about track 1. 21:06.660 --> 21:17.540 Track 1 is pretty much, if you're going to be parsing a credit card, it's going to be a caret, the shift 6 caret. 21:17.540 --> 21:21.000 That's your deliminator to parse it out. 21:21.580 --> 21:26.220 When you have a successful swipe on a credit card, it's going to be percent B, capital B. 21:26.220 --> 21:27.780 That's going to be the very first two digits. 21:27.780 --> 21:33.740 If you don't see that, it's probably not a credit card, or it's a fake, and it shouldn't go through in any credit card transaction. 21:34.440 --> 21:36.780 Next, you'll get the caret that says, hey, I'm going to start the next field. 21:36.780 --> 21:42.520 The next field is your name, and it's usually in all uppercase, and as much of your name as they can squeeze on there. 21:42.600 --> 21:44.640 Some people actually append the name. 21:44.640 --> 21:51.820 So if you have a really, really long name like mine, if you noticed on the cue cards, Imhoff Ducharme, they actually parsed mine, so it's Imhoff D. 21:52.740 --> 21:59.680 So that's how that works out, because they found that some readers can't read all the characters, and it actually drops it off. 21:59.700 --> 22:02.900 So they just said, well, and then it won't even authorize, because it breaks. 22:02.900 --> 22:04.740 It kind of crashes the box. 22:04.740 --> 22:09.820 So if you have a really long name, don't go to checkers, because your card won't work. 22:10.600 --> 22:15.040 Okay, so and then after that caret, you're going to have your credit card number. 22:15.040 --> 22:19.600 And then it's going to have the credit card number, which is anywhere between 13 and 16 digits. 22:20.100 --> 22:27.000 13 was the original American Express and Diners Club, and Visa cards were 14 and 15. 22:27.500 --> 22:30.980 And now American Express is 15 and 16. 22:31.160 --> 22:33.100 So you can have between 13 and 16. 22:33.100 --> 22:34.360 You're allowed up to 19. 22:34.360 --> 22:38.080 There's some cards that they're trying to put on the market that will be 19 digits long. 22:38.600 --> 22:39.980 So look forward to those. 22:40.380 --> 22:43.560 And then after that, you'll have equals, and then you'll have four digits. 22:43.560 --> 22:48.180 Now, these four digits are very special digits, because you have to really pay close attention. 22:48.180 --> 22:50.040 It'll be your expiration date. 22:50.040 --> 22:58.660 But if your expiration date is, I don't know, January 2008, so 01-08, it will not show up equals 01-08. 22:58.660 --> 23:01.180 It'll show up 08-01. 23:01.180 --> 23:06.100 So that's like their little security through obscurity thing, where they just kind of flip them around. 23:06.380 --> 23:09.100 And it's also susceptible to the Y2K bug. 23:09.100 --> 23:10.540 I know we all felt that. 23:12.660 --> 23:13.960 Notetakers on that joke? 23:13.960 --> 23:14.640 Okay. 23:15.000 --> 23:21.760 Okay, right after that, it's going to be your country code, your three-digit country code, because there's two-digit country codes, two-letter country codes, all that fun stuff. 23:21.760 --> 23:23.900 So your three-digit country code, which... 23:23.900 --> 23:30.860 So you'll usually see the expiration date, and you'll immediately see 101 for everybody here in the United States, because that's our international three-digit country code. 23:30.860 --> 23:32.560 And after that's the fun data. 23:32.560 --> 23:34.420 That's the stuff that everybody really wants. 23:34.420 --> 23:36.900 Because you can get the credit card number off the front. 23:36.900 --> 23:39.100 You can get the expiration date off the front. 23:39.100 --> 23:40.900 You even know which country it came from. 23:40.900 --> 23:42.360 Okay, so what's next? 23:42.360 --> 23:44.420 Well, that's the card verification version 1. 23:44.420 --> 23:45.960 That's the discretionary data. 23:46.300 --> 23:48.640 And that's immediately following all that. 23:48.700 --> 23:51.360 And after that, you get a caret, which says, I'm done. 23:51.360 --> 23:56.400 And then when track 2 starts, you get a semicolon saying, I'm now ready for track 2. 23:56.480 --> 23:58.380 Credit cards only use track 1 and track 2. 23:58.380 --> 23:59.660 They do not use track 3. 23:59.660 --> 24:07.360 That's mostly used for, like, players' club cards here in town at the casinos and the Moose Lodge, if you're into that sort of thing. 24:08.000 --> 24:10.240 You know, they have your pin there, maybe. 24:10.240 --> 24:10.980 I don't know. 24:11.300 --> 24:16.600 So track 2 now switches the format in which you're going to have discretionary data. 24:16.600 --> 24:20.200 It's going to be semicolons separating everything. 24:20.200 --> 24:23.140 So you're going to parse everything out based on semicolons instead of carets. 24:23.480 --> 24:26.320 And so you're going to get, once again, the full credit card number. 24:26.320 --> 24:29.800 Then you're going to get equals, and then you're going to get the expiration date, which is traversed. 24:29.800 --> 24:31.700 Then the country code, 101. 24:31.700 --> 24:33.380 Then your discretionary data. 24:34.240 --> 24:35.200 That's it. 24:36.340 --> 24:38.480 Okay, so you guys are like, well, that's just like track 1. 24:38.480 --> 24:39.360 What's GIVS? 24:39.380 --> 24:41.440 Well, I don't know. 24:41.740 --> 24:44.500 You get less... nobody knows the answer to that. 24:44.500 --> 24:46.720 They added track 2 as a security feature. 24:46.720 --> 24:51.780 They're like, well, that's card verification version 1, even though it's the same exact discretionary data as track 1. 24:51.780 --> 24:57.100 And by having that, pretty much what that meant is we're tired of using these old and busted. 24:57.120 --> 24:58.220 You know, so old and busted. 24:58.220 --> 25:01.180 These new hotness and genicodes. 25:01.920 --> 25:05.640 So we want you to switch over to those, which are giving us more revenue. 25:05.640 --> 25:10.220 Which means that you can accept track 2, which will give you a better rate on your transactions. 25:10.920 --> 25:11.920 So you have track 2. 25:12.100 --> 25:12.940 And that's what that's all about. 25:12.940 --> 25:15.760 And it ends with a semicolon, and that's the end of the story there. 25:15.760 --> 25:26.180 If it doesn't work, if you swipe your card and kind of half swipe, or you swipe it too quick, or it's a dirty scanner, then you're going to get a percent E semicolon percent E semicolon, which means error reading card. 25:26.180 --> 25:26.900 Try again. 25:28.440 --> 25:29.080 Okay. 25:29.380 --> 25:30.340 Transaction flow. 25:30.580 --> 25:31.120 Authorization. 25:31.120 --> 25:32.560 There's two flows, we should say. 25:32.560 --> 25:34.680 I didn't really put a slide before this. 25:35.280 --> 25:38.960 Flow 1 is authorizing the card. 25:38.960 --> 25:40.080 Flow 2 is settling the card. 25:40.080 --> 25:41.480 And we'll talk about the differences. 25:41.980 --> 25:47.040 So when you swipe the credit card and you have the dollar amount and all that fun stuff, you're going to get an initial authorization. 25:47.040 --> 25:53.460 And when that initial authorization goes through, like we said, it goes through the front-end processor, which is our local loop that connects everybody. 25:53.680 --> 26:05.820 If we had a yardstick, and we're talking about processors, by the way, and you have a big, huge, long yardstick, we'd say the entire bit of that yardstick, except for one inch, is First Data Corporation, FDC. 26:05.920 --> 26:09.240 They are the biggest front-end processor out there, hands down. 26:09.240 --> 26:16.080 And then everybody else, Nova, NDC, MAP, Citco Alliance, all those guys, they're one inch. 26:16.180 --> 26:18.700 And that's the competition you have to work with out there. 26:19.380 --> 26:23.420 So that's something I'll leave aside, a little extra nugget for you guys. 26:23.920 --> 26:26.160 So then you get to the front-end processor. 26:26.160 --> 26:27.940 Front-end processor checks the card number. 26:27.940 --> 26:32.400 First six digits are going to tell you, on the credit card number, who the issuing bank is. 26:32.640 --> 26:38.620 So when you have, I don't know, five, you automatically know that's a MasterCard. 26:38.620 --> 26:43.240 When you have six, you automatically, or 6011, you automatically know that's Discover. 26:43.360 --> 26:46.680 When you have four, you automatically know that that's Visa. 26:46.680 --> 26:50.060 When you have three, eight, it's American Express. 26:50.060 --> 26:51.640 Three, six, it's JCB. 26:51.640 --> 26:57.600 Three, five, it's old-school Visas that were 13 digits long. 26:57.720 --> 27:01.720 And I don't believe there's any cards that's now still in existence that had two. 27:01.720 --> 27:05.380 There were some people that played around with it, but that was mostly reserved. 27:05.380 --> 27:12.480 00 and 10 are reserved for private label cards and stuff like that, which we'll get into in a little bit. 27:13.000 --> 27:16.200 So the first digit, right off the bat, tells you what type of credit card it is. 27:16.280 --> 27:22.220 Then the next five digits, or the first six-digit chunk, will tell you exactly which bank it's coming from. 27:22.300 --> 27:26.180 And I believe there's somebody that's actually working on a project out there right now. 27:26.180 --> 27:27.900 It was on Slashdown about six months ago. 27:27.900 --> 27:31.480 Who is trying to get everybody's first six digits and say, which bank do you have? 27:31.480 --> 27:37.660 And trying to reverse enumerate everybody's credit card banks and everything. 27:38.960 --> 27:42.240 So far, what we know is that there's some specifications. 27:42.240 --> 27:52.000 If you ask really, really nicely and say you're an ISO bank, they will give you some customer service places that you can just call and say, I need the list, and the list will email it to you. 27:52.420 --> 27:54.700 So, yeah, it's kind of goofy. 27:54.700 --> 27:56.720 We'll get into that in a little bit, too. 27:57.900 --> 28:00.080 FEP, the front-end processor, this is the beauty. 28:00.080 --> 28:01.200 These are the awesome guys. 28:01.200 --> 28:03.880 They're like, we have a lot of money, and we want to get a lot of more money. 28:03.880 --> 28:05.820 How can we possibly do that? 28:06.280 --> 28:09.160 Well, we're going to just authorize people's credit cards. 28:09.340 --> 28:12.740 And then not even have to worry about doing anything with them. 28:12.740 --> 28:16.240 So that's why I say FEPs are hands-off, because they're bonded. 28:16.240 --> 28:21.040 They have like, you know, $1 billion insurance policies on all the cards that go through. 28:21.340 --> 28:28.000 And all they do is say, I have the money to say that I can vouch for this process going through, and nothing bad will happen. 28:28.000 --> 28:30.260 And then they just let transactions float by them. 28:30.260 --> 28:38.900 They just pretty much, you know, grab the card, take it, hand it off to the issuing bank, get the response from the issuing bank, record the result, and then send it back. 28:38.900 --> 28:47.040 And they record the result on behalf of the merchant, because they have these little trans-tradies, only got 56K of memory, don't have enough to remember everything. 28:48.480 --> 28:54.800 Which is now changing with the new virtual world and the front-end processor gateways and everything like that, which they're losing revenue on. 28:54.800 --> 29:00.260 But they pretty much just say, oh, I'll just remember that you had an authorization, and just let me know when to close it out. 29:00.260 --> 29:02.260 So they're just handing money back and forth. 29:02.340 --> 29:06.580 That's their only purpose, is we connect you to us and us to them. 29:06.580 --> 29:15.020 And they charge you to connect to them, and then front-end processors like FDC will charge them, because they have all the clients. 29:15.580 --> 29:21.380 So they get money from leasing the lines, they get money from the merchants, they get money from the transactions, and they get money from the banks. 29:21.400 --> 29:23.880 And all they do is just say, thank you, you're welcome. 29:23.880 --> 29:29.160 So it's a pretty sweet gig to get into if you want to get on the new hotness there. 29:29.160 --> 29:32.380 Just have like $1 billion laying around to bond yourself, and you'll be all set. 29:33.460 --> 29:35.660 Okay, back-end merchant link. 29:35.660 --> 29:37.480 We kind of briefly talked about that earlier. 29:37.600 --> 29:39.480 How are we doing on time, by the way? 29:40.420 --> 29:41.800 Where are my folks? 29:41.800 --> 29:43.620 Because I can just ramble for a while. 29:46.020 --> 29:46.820 Where's my... 29:46.820 --> 29:48.180 20 more minutes? 29:48.180 --> 29:49.860 We should probably speed up then. 29:50.040 --> 29:51.400 You guys ready to go into high gear? 29:51.900 --> 29:52.900 All right. 29:52.900 --> 29:54.400 So back-end processor merchant link. 29:54.400 --> 29:55.960 We already talked about it, so we're skipping it. 29:55.960 --> 29:58.220 Issuing banks, we already talked about it, so we're skipping it. 29:58.740 --> 30:00.480 Front-end processor record updates. 30:00.480 --> 30:02.120 We kind of just talked about it. 30:02.720 --> 30:06.120 They just update the records, say, hey, I know that you did a transaction. 30:06.120 --> 30:06.800 All right. 30:07.420 --> 30:11.500 And then in return, the terminal prints out a receipt having the authorization code. 30:11.500 --> 30:12.660 You see that authorization code? 30:12.660 --> 30:14.280 It's a six-digit code on all the receipts. 30:14.280 --> 30:16.000 It comes directly from the issuing bank. 30:16.000 --> 30:18.020 Your bank itself gave that authorization code. 30:18.020 --> 30:21.900 Not the back-end processor, not the front-end processor, not the merchant itself. 30:21.900 --> 30:24.040 But your actual issuing bank talked to them. 30:24.800 --> 30:25.100 All right. 30:25.100 --> 30:26.360 Transaction flow settlement. 30:26.360 --> 30:29.180 Now, at the end of the night, you want to settle everything out. 30:29.180 --> 30:30.240 Has anybody ever had this? 30:30.240 --> 30:33.140 Because I certainly haven't, because I'm really responsible with my money. 30:33.320 --> 30:41.340 Has anybody ever had this where it says available balance is $500, but it says that your account balance is $800? 30:41.620 --> 30:44.820 You're like, how in the heck can I have two separate balances in my account? 30:44.820 --> 30:45.940 How is this possible? 30:45.940 --> 30:55.660 And this is because when CheckCard switched over to Visa and MasterCard to accept that logo, they went through an authorization and settlement cycle that they now acquired from the banks. 30:55.660 --> 31:02.700 And authorization pretty much means I authorize this money on your account and I hold it on your account, but I don't actually take it out of your account. 31:02.720 --> 31:05.500 That's the important thing to remember about authorization and settlement. 31:05.500 --> 31:06.780 I'm just going to hold it. 31:06.780 --> 31:08.120 I'm not going to do anything with it yet. 31:08.120 --> 31:14.420 I'm just making sure... well, I can't say that's derogatory, but I'm C-blocking you from actually using that money. 31:15.620 --> 31:19.520 So you have that money held, but let's say they don't take it out in a timely manner. 31:19.520 --> 31:20.700 Let's say a week or two. 31:20.820 --> 31:28.940 Well, then that money just absorbs away and just disappears and it no longer is held because they can only hold it out of your account for so long before they take it out. 31:28.940 --> 31:31.480 So they say, okay, they never took it. 31:31.480 --> 31:32.800 Maybe they were just kidding. 31:32.880 --> 31:33.580 I don't know. 31:33.660 --> 31:35.480 And so then they just release the authorization. 31:35.480 --> 31:38.460 So now your money comes back available to you. 31:38.460 --> 31:42.460 So you're like, wow, they forgot to charge me. 31:42.600 --> 31:44.160 How cool is that? 31:44.160 --> 31:46.640 I'm going to go pick me up a new pair of pants. 31:46.640 --> 31:47.240 I don't know. 31:47.240 --> 31:50.360 I'm going to go get some pantalones and all that fun stuff. 31:50.480 --> 31:52.960 And so then they go, oh, we forgot to charge them. 31:52.960 --> 31:53.580 Oh, my goodness. 31:53.580 --> 31:54.660 Close that terminal. 31:54.680 --> 31:55.540 And then they charge you. 31:55.540 --> 31:56.320 And then what happens? 31:56.320 --> 31:57.180 You overdraw. 31:57.180 --> 31:59.820 You incur bank fees and all that stuff. 31:59.820 --> 32:01.000 Why are you irresponsible? 32:01.300 --> 32:02.340 Although they were. 32:02.420 --> 32:03.840 Well, we're still going to charge you. 32:03.900 --> 32:08.320 So that's how that comes into play because of this authorization and settlement thing. 32:08.320 --> 32:11.000 And this has happened since the beginning of credit cards. 32:11.000 --> 32:12.920 And it's like a very bad process. 32:12.920 --> 32:16.000 And it's impossible to get rid of because it's just so thick. 32:17.720 --> 32:20.340 So we just kind of went through that whole thing right here. 32:20.340 --> 32:21.840 So we're going to go on to the next slide. 32:21.840 --> 32:22.860 Data storage. 32:25.960 --> 32:29.220 So there's a lot of grab ass going on with your personal data. 32:29.820 --> 32:31.340 Especially by MasterCard. 32:31.380 --> 32:33.880 What they like to do is do a lot of data mining. 32:33.880 --> 32:44.860 If you guys ever subscribe to a network security magazine or networking magazine, one of those CMP press ones, it's just like there's a whole bunch of ads and fluff and one good article every month. 32:45.260 --> 32:47.100 Sorry to CMP if you're out there. 32:48.080 --> 32:53.120 So they actually had a really great article about MasterCard and everything. 32:53.120 --> 32:56.940 And after reading it, I had to like go dive in and call them and see if this was true. 32:56.940 --> 33:03.760 And they have like terabytes upon terabytes upon terabytes of every single transaction that you ever did stored at MasterCard International. 33:03.900 --> 33:08.580 Even though it's going to the issuing bank, we kind of talked briefly about that back-end processors. 33:08.580 --> 33:10.180 Who are those back-end processors? 33:10.180 --> 33:12.480 Well, MasterCard is just this entity. 33:12.740 --> 33:14.320 They're just on paper. 33:14.320 --> 33:15.380 They don't really exist. 33:15.380 --> 33:16.240 They don't do anything. 33:16.240 --> 33:18.120 They just sell their MasterCard name. 33:18.120 --> 33:20.680 Visa just sells its Visa name. 33:20.680 --> 33:22.460 It doesn't really do anything. 33:22.560 --> 33:24.460 Well, they're like, well, we can still do stuff with it. 33:24.460 --> 33:27.440 So MasterCard decided it's going through us anyways. 33:27.900 --> 33:31.340 And it just goes through us because it has to because we're MasterCard. 33:31.340 --> 33:34.620 We might as well store that data and do some data mining. 33:34.620 --> 33:41.460 So every single transaction you've ever done in your whole life on a MasterCard starting from 2004 is recorded in their database. 33:41.460 --> 33:43.540 And it's there for the highest bidder. 33:43.660 --> 33:45.580 They can say, hey, what's going on? 33:45.580 --> 33:49.380 I want to know more about people who like cheesecake. 33:49.820 --> 33:50.800 What else do they like? 33:50.800 --> 33:51.820 And they can make correlations. 33:51.820 --> 33:56.620 Well, guys who like cheesecake also like to buy lipsticks that vibrate for their wives. 33:56.620 --> 33:57.600 How about that? 33:57.940 --> 34:00.180 So let's have a special. 34:00.180 --> 34:03.380 Let's go down to Deja Vu and have Cheesecake and Lipstick Vibrator Day. 34:03.380 --> 34:05.000 Oh, wow, how did they know? 34:05.000 --> 34:06.380 That's just amazing. 34:08.180 --> 34:13.180 So if you ever wondered like, wow, how do they really know that I like this and that? 34:13.180 --> 34:17.600 It's because they data mine all of your credit cards and they see the trends in everything you do. 34:17.600 --> 34:20.020 And this has two good benefits, believe it or not. 34:20.020 --> 34:27.660 One of the good benefits is if you're just a guy who just goes to Starbucks every single day and gets a latte every single day. 34:27.660 --> 34:31.540 And then afterward you pick up the newspaper and a carton of milk from the store. 34:31.540 --> 34:33.660 And it's just repetitive over and over. 34:33.660 --> 34:40.400 And then one day you're like, I want 18 Starbucks coffees and I bought a big screen TV. 34:40.400 --> 34:42.820 They're going to be like, well, wait a minute, that's kind of funny. 34:42.820 --> 34:44.500 So it does have a benefit there. 34:44.700 --> 34:54.920 And those of you with MasterCards actually do get better call responses than some of the other issuing banks or card associations that license their name out. 34:55.020 --> 34:56.460 So you do get that benefit. 34:56.460 --> 35:00.920 But mostly it's just for, hey, we want to sell telemarketers your information. 35:00.920 --> 35:04.840 We want to sell marketing firms your stuff because they've got to do a new commercial this month. 35:05.200 --> 35:06.740 So who else holds it? 35:06.740 --> 35:08.700 The front-end processor we talked about, right? 35:08.840 --> 35:15.100 They temporarily hold it, but they have to actually hold it for five years for auditing and accounting purposes and accountability. 35:15.220 --> 35:17.380 So the front-end processor has your information. 35:17.380 --> 35:27.300 And of course, you know, if you guys were ever like driving across country, because that's always fun, just kind of cruise from Florida to Texas, you know, pick two obscure states. 35:27.300 --> 35:30.180 And somewhere in between there, there's this place called Louisiana. 35:31.040 --> 35:34.440 And, you know, you go into the gas station and they don't have a cooler. 35:34.440 --> 35:38.480 They have like an igloo cooler for their sodas and everything like that. 35:38.480 --> 35:40.820 And, you know, they just got stuff all over the place. 35:40.820 --> 35:46.300 And you're swiping your card and it's an old terminal and your credit card data is just showing up on all the receipts. 35:46.300 --> 35:52.480 And they're just stuffing it in a shoebox because they were told to do that, but they didn't know that they only had to stuff it in a shoebox for two years. 35:52.480 --> 36:01.760 So they got ten years of like, you know, every guy that traveled from Florida to wherever else through Louisiana who just wanted a cola out of their igloo cooler. 36:02.280 --> 36:04.940 They got all their credit card information is sitting there. 36:05.280 --> 36:06.840 So they're holding your data. 36:08.300 --> 36:11.520 Hotels, auto rental, the worst of the worst. 36:11.520 --> 36:14.980 Because hotels, very high rate for fraud. 36:14.980 --> 36:18.280 Auto rentals, it's a car, you're going to break it, that kind of stuff. 36:18.280 --> 36:19.580 It's probably no good. 36:20.240 --> 36:25.060 So you're running into these two things where they take a bunch of information from you. 36:25.060 --> 36:26.180 I need your address. 36:26.180 --> 36:27.640 I need your zip code. 36:27.640 --> 36:29.460 I need your first born. 36:29.580 --> 36:31.620 I need, you know, all this other stuff. 36:31.740 --> 36:39.600 And you're just like, oh my god, they have my address, my full name, social security number, I don't know, all this other goofy stuff just for me to check in. 36:39.600 --> 36:42.200 And that's bundled right there with your credit card. 36:42.660 --> 36:49.740 So if I were some guy who's a carter, as they're called in this scene, the test scene, right? 36:50.840 --> 36:56.160 If I was one of those guys, I would go out and I would probably be going after a hotel or an auto rental. 36:56.260 --> 37:03.440 Especially one of those podunk ones way out in the middle of Louisiana that has all their stuff sitting in a shoe box along with your full address and everything like that. 37:03.440 --> 37:05.880 And they can just mine all your stuff and you'll never know. 37:06.560 --> 37:08.940 So there you got some information there. 37:08.940 --> 37:12.000 And of course your issuing bank also keeps a record of everything. 37:12.000 --> 37:17.100 So you got issuing bank, you got the card association, you got the front end processor, and you got the merchant. 37:17.100 --> 37:19.000 All these people have your information. 37:19.880 --> 37:21.280 Is that a good thing? 37:21.340 --> 37:22.440 Probably not. 37:22.460 --> 37:23.640 Are they changing it? 37:23.640 --> 37:25.120 Not in the least bit. 37:25.480 --> 37:27.400 But that's just the way things are. 37:27.520 --> 37:28.160 Time? 37:29.040 --> 37:31.000 Where's my speaker goon guy at? 37:34.340 --> 37:35.540 He's supposed to tell me. 37:35.540 --> 37:36.380 How much? 37:37.700 --> 37:39.340 Twelve minutes, okay. 37:39.920 --> 37:41.380 Oh, hey, there you go. 37:41.380 --> 37:43.660 We actually are at the questions and answers section. 37:43.660 --> 37:45.580 So we actually made it in time. 37:46.620 --> 37:49.480 We are at the questions and answers section. 37:50.860 --> 37:52.480 Hint, hint, nudge, nudge. 37:58.840 --> 37:59.640 RFID. 38:00.020 --> 38:02.760 RFID, what exactly do you want to know about RFID? 38:09.020 --> 38:10.400 They want to make money. 38:11.120 --> 38:12.240 They really want to make money. 38:12.240 --> 38:13.740 It's all about marketing and money. 38:13.740 --> 38:22.540 They want RFID because you have to pay for, you know, you have to have new vendors come in to get the RFID enabled. 38:22.720 --> 38:24.500 And it's going to speed up the process. 38:24.540 --> 38:26.560 McDonald's wants RFID really, really badly. 38:26.560 --> 38:27.100 Why? 38:27.100 --> 38:31.100 Because I can sling you a microwaved hamburger and get you the hell out of there. 38:31.100 --> 38:34.560 So I can get somebody else to sling him a microwaved hamburger and get him the hell out of there. 38:34.560 --> 38:35.600 So it just swipes. 38:36.060 --> 38:36.760 So does Walmart. 38:36.760 --> 38:37.360 They're working on it. 38:37.360 --> 38:38.320 Yes, right there. 38:38.960 --> 38:39.560 Bees! 38:39.620 --> 38:40.840 Bees everywhere! 38:43.460 --> 38:46.160 I believe that man has bees on him. 38:47.000 --> 38:49.020 Damn scavenger hunt kids. 38:50.480 --> 38:51.520 Okay, I'm sorry. 38:51.520 --> 38:52.480 You were saying? 39:03.130 --> 39:09.350 Well, I can't repeat what you said to everybody else because that's not supposed to be disseminated. 39:10.110 --> 39:15.750 But yes, he was talking about encryption and stuff like that. 39:15.750 --> 39:17.450 We didn't really get into debit cards. 39:17.450 --> 39:18.650 I really wish we could. 39:18.650 --> 39:22.790 They didn't have enough room for a two-hour because we can talk about Duck Put. 39:22.790 --> 39:26.730 By the way, Duck Put and all that fun stuff is the encryption used for debit pin cards. 39:26.730 --> 39:29.890 So if you know how to crack that one, which is super easy, it's like a one-way. 39:29.910 --> 39:33.270 You can get people's pin numbers flying across the line. 39:33.270 --> 39:33.990 Yes, sir? 39:39.260 --> 39:43.140 I cannot give you a concrete answer personally, but I would assume so. 39:43.500 --> 39:44.460 Oh, for sure. 39:44.460 --> 39:50.520 Personally, that would be a much easier way to data mine because it takes time for... 39:50.520 --> 39:53.540 The question was, do they data mine pin cards and debit cards? 39:53.540 --> 39:54.800 And I'd probably say yes. 39:54.800 --> 39:56.740 I'm not going to say yes, but probably yes. 39:56.760 --> 40:02.780 Because as soon as you swipe, it doesn't say this was at some place somewhere and we'll tell you later where it was. 40:02.780 --> 40:05.820 It says right away, he bought cookies at an a.m. 40:05.820 --> 40:06.340 p.m. 40:06.340 --> 40:07.340 Like right away. 40:07.400 --> 40:09.420 So it's actually more data in that. 40:09.420 --> 40:11.740 Because it's a newer technology, they can add more data. 40:11.740 --> 40:16.240 So I would believe that that would be the juicy nugget, so-called, that they would really want. 40:17.540 --> 40:19.760 Anybody else that doesn't have B problems? 40:19.760 --> 40:21.720 That gentleman right back there. 40:32.630 --> 40:34.790 It's similar and easier. 40:35.150 --> 40:44.130 The question was, the EasyPay, is the new ones that are coming out from RFID in general, and Chase has been promoting theirs. 40:44.130 --> 40:47.790 Is it anything like the EasyPay that's promoted by mobile? 40:47.790 --> 40:50.290 It's not exactly like it. 40:50.290 --> 40:56.250 But it's actually easier because the mobile one actually has strong encryption that was Texas Instruments proprietary. 40:56.250 --> 40:58.730 Until those cats over at the university broke it. 40:59.110 --> 41:01.550 But this one is not even proprietary. 41:01.630 --> 41:05.690 I don't remember it off the top of my head because you put me on the spot there. 41:05.690 --> 41:08.570 But it would be the equivalent of like ROT13. 41:08.570 --> 41:09.870 It's almost embarrassing. 41:13.010 --> 41:31.590 Actually, if you want to do some war driving fun with gas stations and stuff like that, which I would not promote, but if on the off chance you wanted to do something like that, all the terrible herps here in town use radio frequencies to throw all those LCD video onto those screens. 41:31.590 --> 41:33.490 And it's push, not pull. 41:33.490 --> 41:39.330 So if you just push data to it, you can push, you know, Goatsy onto all the screens. 41:39.330 --> 41:41.150 And we'd get a crack out of that. 41:41.530 --> 41:43.990 I've got to give my friend Ripsy here shouts out. 41:43.990 --> 41:46.630 He's the one that actually war drived that one and found out all that. 41:47.370 --> 41:48.310 Yes, sir. 41:50.190 --> 41:51.870 Actually, no. 41:52.390 --> 42:02.350 We actually had a hard enough time to actually get to the laptop because we screwed up with a lot of stuff organizing, getting here, like dropping off cars and picking new ones up, and it was in it. 42:02.390 --> 42:04.470 And we didn't get the program on here. 42:04.470 --> 42:08.110 I can swipe it and you can see it, but then you'd all see my credit card that's still active. 42:08.590 --> 42:09.870 And that wouldn't be fun. 42:10.390 --> 42:12.990 If you have a canceled credit card, I would be more than happy. 42:12.990 --> 42:13.370 Thank you. 42:13.370 --> 42:14.910 This is a team player right here. 42:20.960 --> 42:21.760 And now... 42:27.260 --> 42:29.200 A dingo ate her baby. 42:30.760 --> 42:31.680 All right. 42:31.780 --> 42:34.540 Dance scavenger hunt kids, I tell you what. 42:35.880 --> 42:36.680 Awesome. 42:37.100 --> 42:40.280 So, okay, if you guys just noticed up on the screen, I just opened up... 42:40.280 --> 42:41.920 Hey, how are we doing on time? 42:42.760 --> 42:43.700 He doesn't know. 42:44.540 --> 42:45.900 Six minutes, all right. 42:45.900 --> 42:48.900 If you noticed, I just opened up a notepad. 42:48.940 --> 42:50.400 Notepad, nothing special. 42:50.440 --> 42:53.800 Hell, I can make a new file and just, like, rename it and then swipe my card. 42:53.800 --> 42:56.100 So we're just going to swipe this really quick and see what happens. 43:05.300 --> 43:07.200 And somehow his name is not there. 43:07.200 --> 43:09.320 Is this a, like, ghost card or something killer? 43:09.780 --> 43:12.340 I don't know if your corporate would like that too much. 43:12.880 --> 43:16.100 Okay, so your name didn't pop up at the very beginning there. 43:16.700 --> 43:19.620 For whatever reason, is it just font issues? 43:22.820 --> 43:25.580 Well, we'll try this Vons card as well and show you the differences. 43:30.820 --> 43:32.460 All right, there's that Vons card. 43:32.460 --> 43:34.580 Well, at the very beginning, the first one you see there... 43:34.580 --> 43:39.100 And we probably should do this for you people with the Coke bottle glasses. 43:47.060 --> 43:49.180 Okay, I'm just kidding. 43:50.680 --> 43:52.880 All right, let's do 36. 43:54.820 --> 43:56.080 That's good enough. 43:56.900 --> 43:58.840 So we can kind of see this discretionary data. 43:58.840 --> 44:00.120 And I'll go through this. 44:00.120 --> 44:04.340 If we notice right here, right, this is not an expired card. 44:05.180 --> 44:08.260 Oh, it's canceled, okay. 44:08.260 --> 44:11.100 If we notice, we talked before about how they reverse them. 44:11.100 --> 44:13.760 So can everybody shout out what the expiration date is? 44:15.740 --> 44:18.320 Oh, that's right, February 2007. 44:18.520 --> 44:20.740 And then what did we say was the next three digits? 44:22.160 --> 44:23.440 March, I know my... 44:24.460 --> 44:26.280 Valentine's Day, I get suckered every time. 44:26.280 --> 44:27.660 I thought it was the third month. 44:27.660 --> 44:28.980 Come on, give me some slack. 44:30.040 --> 44:32.140 March, March 2007. 44:32.140 --> 44:34.820 Okay, so then what did we say was the next three digits? 44:35.840 --> 44:37.860 Country code, and 101 is? 44:38.540 --> 44:41.120 U.S., don't ask me to call anything else. 44:41.120 --> 44:42.960 And then here's all this discretionary data. 44:42.960 --> 44:46.940 It's just a bunch of zeros, and then there's that 5, 6, 4, 0, whatever. 44:47.500 --> 44:48.900 And then you see there's the question mark. 44:48.900 --> 44:50.620 That's actually, good thing we swiped it. 44:50.620 --> 44:53.000 Good thing we swiped this, because I left out that delimiter. 44:53.000 --> 44:55.200 Question mark means end of track one. 44:55.400 --> 44:56.660 Then you have the semicolon. 44:56.680 --> 44:58.940 Then once again, you have the credit card number in full. 45:00.460 --> 45:03.320 Equals 0703, which is backwards, just as we said. 45:03.320 --> 45:04.760 101, international code. 45:04.760 --> 45:07.740 And look, the discretionary data is exactly the same. 45:07.820 --> 45:09.720 And then question mark to say it's done. 45:09.840 --> 45:11.320 And then the next one is a bonds card. 45:11.320 --> 45:17.980 As you can see, you know, private label cards and stuff, and fun stuff to get discounts on stuff that should already be that cheap. 45:20.020 --> 45:22.320 It has its own format and everything. 45:22.760 --> 45:24.640 So that's your swipe code. 45:24.640 --> 45:26.500 And once again, let me remind you. 45:26.500 --> 45:29.640 If you go to the Hackajar eBay sale for $35... 45:29.640 --> 45:30.220 No, I'm just kidding. 45:30.220 --> 45:31.060 I don't have one. 45:31.580 --> 45:34.300 For like $35 to $40, you can get these online. 45:34.360 --> 45:40.220 Believe it or not, the PS2 ones are more expensive than the USBs. 45:40.220 --> 45:40.660 I used the... 45:42.920 --> 45:43.640 Excuse me. 45:43.640 --> 45:46.440 I used PS2 ones because they're universal across everything. 45:46.440 --> 45:51.240 You don't have to deal with USB drivers or stuff that thinks it needs drivers but doesn't really need drivers and all that. 45:51.240 --> 45:52.600 So that's why they're a little bit more expensive. 45:52.600 --> 45:53.940 And they're also harder to find. 45:54.340 --> 45:55.560 So, are we done? 45:55.560 --> 45:56.300 Are we got more time? 45:56.300 --> 45:58.000 We got a couple more questions maybe? 45:58.680 --> 45:59.400 Time check? 46:00.880 --> 46:01.920 Four minutes. 46:01.920 --> 46:02.720 Yes, sir. 46:06.100 --> 46:08.560 The one-time virtual cards, do they recycle their numbers? 46:08.780 --> 46:10.440 The numbers, one thing we didn't get into. 46:10.440 --> 46:13.940 We should probably cover that real fast for all you guys that are team players that stuck around. 46:14.900 --> 46:15.960 LUNMOD10 check. 46:16.820 --> 46:21.000 It's pretty much just barcodes, UPC codes. 46:21.020 --> 46:22.760 You put the number through an algorithm. 46:22.760 --> 46:25.120 And if it returns one, then that means that it's valid. 46:25.120 --> 46:26.040 If it doesn't, it's not. 46:26.040 --> 46:28.980 LUNMOD10 is the algorithm they use to verify the cards. 46:29.200 --> 46:31.160 So, it's very possible. 46:31.160 --> 46:32.220 It's just like MD5. 46:32.220 --> 46:33.500 You know, you're going to have some collisions. 46:33.500 --> 46:39.640 It's very possible that, you know, you go through so many cards and that have to conform to this LUNMOD10 that you're going to run into it again. 46:39.640 --> 46:42.760 It's not too much of an issue right now because there's so many combinations. 46:42.960 --> 46:51.380 But when those things get really popular, it might be an issue for those individual banks for credit cards colliding when you have virtual cards. 46:51.460 --> 46:54.360 And I think we can do one more question and then that way we can get everybody out. 46:54.360 --> 46:57.660 So, there's some guy waving like a banshee back there. 46:57.660 --> 46:59.220 I think it's a girl, actually. 47:01.560 --> 47:07.240 The CISSP, C-I-S-S, or C-I-S-P, the Cardholder Information Security Program. 47:07.280 --> 47:11.480 That's nothing like the Cubix information security stuff. 47:12.100 --> 47:14.960 CISSP, it was created by Visa. 47:14.960 --> 47:16.300 And it sucks. 47:16.700 --> 47:17.680 Hands down. 47:17.680 --> 47:20.700 They have what's called the Dirty Digital Dozen. 47:20.700 --> 47:29.640 And it's stuff like, you have to conform to this in order to authorize credit cards in an internet world or in a brick-and-mortar to internet authorization world. 47:30.440 --> 47:33.620 And they're like stuff like, do you have a firewall? 47:34.280 --> 47:36.300 Does everybody log in with their own account? 47:36.300 --> 47:38.180 It's like, well, thank you, Captain Obvious. 47:39.480 --> 47:42.580 But they certify these independent auditors. 47:42.580 --> 47:45.300 No offense to you guys because it's good money for you, I know. 47:46.200 --> 47:55.220 They certify these independent auditors to go out and be CISSP certified auditors that charge $25,000 to $40,000 per site just to say, yep, you have a firewall. 47:55.220 --> 47:56.720 Yep, you have limited access. 47:56.720 --> 47:58.940 Yep, you have individual account names. 47:59.040 --> 48:00.820 Great, you're certified. 48:00.860 --> 48:02.260 Give us $25,000. 48:02.820 --> 48:06.300 And you've got to do this every year in some cases. 48:06.520 --> 48:08.020 So I think it sucks. 48:08.020 --> 48:14.020 I think they're just using it as another way to grab money and not using what it's supposed to be used for, to secure credit cards. 48:14.020 --> 48:15.880 Make sure our transactions are safe. 48:16.460 --> 48:17.720 All that fun stuff. 48:17.840 --> 48:21.920 And I believe that's the last question we're going to have unless you're like, no, no, what about that last thing? 48:21.920 --> 48:22.440 Anybody? 48:24.520 --> 48:25.320 The who's? 48:25.320 --> 48:26.040 The bees? 48:26.080 --> 48:28.600 These scavenger hunt guys, man, I tell you what. 48:28.740 --> 48:30.200 You know, they just go nuts. 48:30.300 --> 48:32.900 All right, well, thank you so much, guys, for your patience and everything. 48:32.900 --> 48:35.760 And I appreciate everything you've done.