Credit Card Numbers Research Articles

Development of a Platform to Explore Network Intrusion Detection System (NIDS) for Cybersecurity

Cybersecurity is increasing its significance in recent years due to the overwhelming use of devices which require the use of internet. This raises the importance of having cybersecurity training for the upcoming generations as hackers continue to upgrade their methodologies and techniques to obtain important information such as personal identification, credit card numbers etcetera. This paper describes the development of a platform for students to learn how to setup and use a Network Intrusion Detection System in a virtual environment. In this environment, the administrator of a specific system can monitor and detect their network for any malicious activity. We will discuss in this paper the network configuration setup via virtualization technology followed by having a Network Intrusion Detection System installed in one of the virtual machines port mirrored to monitor the whole network. In the virtual network, a virtual machine will be assigned as an attacker to simulate cyber-attacks allowing the Network Intrusion Detection System to detect the Internet Protocol (IP) address from the source of malicious activity provider. In addition, students will have the opportunity to learn how to write basic rules for the Network Intrusion Detection System which are algorithms used to detect cyber malicious movements.

Culture’s impact on trust, distrust, and intentions in data theft environments: A cross-cultural exploratory study

ABSTRACTData breaches—security incidents—have become an everyday occurrence, with hundreds of millions of consumers having their lost personal identification information (PII), had their credit and debit card numbers stolen, and their credit compromised. Despite the risk, consumers continuously swipe their cards and share their personal information regularly. This study examines the impacts of trust and distrust on consumer intentions in data theft environments across five culturally distinct regions as defined by Hofstede’s dimensions. Five hundred and two (502) consumers involved in technology-driven transactions comprise the data sample. Trust, distrust, and intentions are investigated to determine (1) if trust and distrust are truly two distinct constructs, (2) if individuals from diverse cultures perceive trust and distrust differently, and (3) the impact on consumer intentions toward transactions. The study expands the literature treating trust and distrust as distinct yet inter-related constructs while introducing culture as a moderating variable. The findings demonstrate statistically significant differences across cultural clusters for trust, distrust, and intentions.

Behavior Based Human Authentication on Touch Screen Devices Using Gestures and Signatures

With the rich functionalities and enhanced computing capabilities available on mobile computing devices with touch screens, users not only store sensitive information (such as credit card numbers) but also use privacy sensitive applications (such as online banking) on these devices, which make them hot targets for hackers and thieves. To protect private information, such devices typically lock themselves after a few minutes of inactivity and prompt a password/PIN/pattern screen when reactivated. Passwords/PINs/patterns based schemes are inherently vulnerable to shoulder surfing attacks and smudge attacks. In this paper, we propose BEAT, an authentication scheme for touch screen devices that authenticates users based on their behavior of performing certain actions on the touch screens. An action is either a gesture, which is a brief interaction of a user's fingers with the touch screen such as swipe rightwards, or a signature, which is the conventional unique handwritten depiction of one's name. Unlike existing authentication schemes for touch screen devices, which use what user inputs as the authentication secret, BEAT authenticates users mainly based on how they input, using distinguishing features such as velocity, device acceleration, and stroke time. Even if attackers see what action a user performs, they cannot reproduce the behavior of the user doing those actions through shoulder surfing or smudge attacks. We implemented BEAT on Samsung Focus smart phones and Samsung Slate tablets running Windows, collected 15,009 gesture samples and 10,054 signature samples, and conducted real-time experiments to evaluate its performance. Experimental results show that, with only 25 training samples, for gestures, BEAT achieves an average equal error rate of 0.5 percent with three gestures and for signatures, it achieves an average equal error rate of 0.52 percent with single signature.

Deterministic Encryption with the Thorp Shuffle

We analyze the security of the Thorp shuffle, or, equivalently, a maximally unbalanced Feistel network. Roughly said, the Thorp shuffle on N cards mixes any $$N^{1-1/r}$$ of them in $$O(r\lg N)$$ steps. Correspondingly, making O(r) passes of maximally unbalanced Feistel over an n-bit string ensures CCA security to $$2^{n(1-1/r)}$$ queries. Our results, which employ Markov chain techniques, particularly couplings, help to justify a practical, although still relatively inefficient, blockcipher-based scheme for deterministically enciphering credit card numbers and the like.

How Biometric Authentication Poses New Challenges to Our Security and Privacy [In the Spotlight

Discusses the challenges that face biometric authentication in the areas of privacy and network security. The use of biometric data — an individual’s measurable physical and behavioral characteristics — isn’t new. Government and law enforcement agencies have long used it. The Federal Bureau of Investigation (FBI) has been building a biometric recognition database; the U.S. Department of Homeland Security is sharing its iris and facial recognition of foreigners with the FBI. But the use of biometric data by consumer goods manufacturers for authentication purposes has skyrocketed in recent years. For example, Apple’s iPhone allows users to scan their fingerprints to unlock the device, secure mobile bill records, and authenticate payments. Lenovo and Dell are companies that leverage fingerprints to enable users to sign onto their computers with just a swipe. Using biometric data to access our personal devices is increasing as a way to get around the limitations of the commonly used password-based mechanism: it’s easier, more convenient, and (theoretically) more secure. But biometric data can also be stolen and used in malicious ways. Capturing fingerprints at scale isn’t as easy as lifting a credit card or Social Security number, but experience and history tells us that once something is used extensively, criminals will figure out how to misuse and monetize it.

Elliptic Curve Cryptosystem in securing Communication across Unsecure Channel

In the present day, exchanging information is the essential of successful business in our society. Securing the information from unauthorized individuals as well as unauthorized access is more essential. Cases of hacking bank accounts, stealing credit card numbers and decoding secret information are common occurrence. With the rapid grow of internet technology and increasing computational power of computer, securing privilege information against unauthorized access is a source of concern to the business managers. Different organisation use different methods to secure sensitive information. Most of these methods have not provided the desired result. This paper proposes the use of Elliptic Curve Cryptography (ECC) over finite fields to send and receive information in an unsecure channel without jeopardizing the security of the information. The basisof using ECC is because there is no known technique of finding solution of discrete logarithm problem, in a reasonable time, on a properly chosen elliptic curve. ECC has advantagesof smaller key sizes, faster computations, reductions in processing power, less storage space and low bandwidth rate consumption.In this paper, group theory, elliptic curves, finite fields and ECC encoding were explained.

Vulnerable GPU Memory Management: Towards Recovering Raw Data from GPU

Abstract According to previous reports, information could be leaked from GPU memory; however, the security implications of such a threat were mostly over-looked, because only limited information could be indirectly extracted through side-channel attacks. In this paper, we propose a novel algorithm for recovering raw data directly from the GPU memory residues of many popular applications such as Google Chrome and Adobe PDF reader. Our algorithm enables harvesting highly sensitive information including credit card numbers and email contents from GPU memory residues. Evaluation results also indicate that nearly all GPU-accelerated applications are vulnerable to such attacks, and adversaries can launch attacks without requiring any special privileges both on traditional multi-user operating systems, and emerging cloud computing scenarios.

The benefits, risks and costs of privacy: patient preferences and willingness to pay

Objective: Multiple surveys show that patients want medical privacy; however, there are costs to maintaining privacy. There are also risks if information is not shared. A review of previous surveys found that most surveys asked questions about patient’s privacy concerns and willingness to share their medical information. We found only one study that asked about sharing medical information for better care and no survey that asked patients about the risk, cost or comparison between medical privacy and privacy in other areas. To fill this gap, we designed a survey to: (1) compare medical privacy preferences to privacy preferences in other areas; (2) measure willingness to pay the cost of additional privacy measures; and (3) measure willingness to accept the risks of not sharing information.Methods: A total of 834 patients attending physician offices at 14 sites completed all or part of an anonymous questionnaire.Results: Over 95% of patients were willing to share all their medical information with their treating physicians. There was no difference in willingness to share between primary care and specialty sites including psychiatry and an HIV clinic. In our survey, there was no difference in sharing preference between standard medical information and information with additional legal protections including genetic testing, drug/alcohol treatment and HIV results. Medical privacy was ranked lower than sharing social security and credit card numbers, but was deemed more private than other information including tax returns and handgun purchases. There was no statistical difference for any questions by site except for HIV/AIDS clinic patients ranking privacy of the medical record more important than reducing high medical costs and risk of medical errors (p < .05). Most patients were willing to spend a modest amount of additional time for privacy, but few were willing to pay more for additional medical privacy. Most patients were unwilling to take on additional risks to keep medical information hidden.Conclusions: Patients were very willing to share medical information with their providers. They were able to see the importance of sharing medical information to provide the best possible care. They were unwilling to hide information from providers if there was increased medical risk. Patients were willing to spend additional time for privacy, but most were unwilling to spend extra money. Sixty-eight percent of patients favored reducing medical costs over privacy.

Maxxed Out: TJX Companies and the Largest-Ever Consumer Data Breach

In November 2005 Fidelity Homestead, a savings bank in Louisiana, began noticing suspicious charges from Mexico and southern California on its customers' credit cards. More than a year later, an audit revealed peculiarities in the credit card data in the computer systems of TJX Companies, the parent company of more than 2,600 discount fashion and home accessories retail stores in the United States, Canada, and Europe.The U.S. Secret Service, the U.S. Justice Department, and the Royal Canadian Mounted Police found that hackers had penetrated TJX's systems in mid-2005, accessing information that dated as far back as 2003. TJX had violated industry security standards by failing to update its in-store wireless networks and by storing credit card numbers and expiration dates without adequate encryption. When TJX announced the intrusion in January 2007, it admitted that hackers had compromised nearly 46 million debit and credit card numbers, the largest-ever data breach in the United States.After analyzing and discussing the case, students should be able to: Understand imbedded operational risks Analyze how operational risk decisions are made in a firm Understand the challenges in the electronic payment transmission process, which relies on each participant in the process to operate best-in-class safety systems to ensure the safety of the entire process Recognize the sophistication of IT security threats

Phishing-Alarm: Robust and Efficient Phishing Detection via Page Component Similarity

Social networks have become one of the most popular platforms for users to interact with each other. Given the huge amount of sensitive data available in social network platforms, user privacy protection on social networks has become one of the most urgent research issues. As a traditional information stealing technique, phishing attacks still work in their way to cause a lot of privacy violation incidents. In a Web-based phishing attack, an attacker sets up scam Web pages (pretending to be an important Website such as a social network portal) to lure users to input their private information, such as passwords, social security numbers, credit card numbers, and so on. In fact, the appearance of Web pages is among the most important factors in deceiving users, and thus, the similarity among Web pages is a critical metric for detecting phishing Websites. In this paper, we present a new solution, called Phishing-Alarm, to detect phishing attacks using features that are hard to evade by attackers. In particular, we present an algorithm to quantify the suspiciousness ratings of Web pages based on the similarity of visual appearance between the Web pages. Since cascading style sheet (CSS) is the technique to specify page layout across browser implementations, our approach uses CSS as the basis to accurately quantify the visual similarity of each page element. As page elements do not have the same influence to pages, we base our rating method on weighted page-component similarity. We prototyped our approach in the Google Chrome browser. Our large-scale evaluation using real-world websites shows the effectiveness of our approach. The proof of concept implementation verifies the correctness and accuracy of our approach with a relatively low performance overhead.

Proposing a new clustering method to detect phishing websites

Phishing websites are fake ones that are developed by ill-intentioned people to imitate real and legal websites. Most of these types of web pages have high visual similarities to hustle the victims. The victims of phishing websites may give their bank accounts, passwords, credit card numbers, and other important information to the designers and owners of phishing websites. The increasing number of phishing websites has become a great challenge in e-business in general and in electronic banking specifically. In the present study, a novel framework based on model-based clustering is introduced to fight against phishing websites. First, a model is developed out of those websites that already have been identified as phishing websites as well as real websites that belong to the original owners. Then each new website is compared with the model and categorized into one of the model clusters by a probability. The analyses reveal that the proposed algorithm has high accuracy.

Automated Vulnerability Detection and Prediction by Security Testing for Cloud SAAS

Background: Cloud SaaS becomes a susceptible target because its shares the application access and data among various tenants. So the careful security testing is necessary to avoid the security problems .As per the recent Survey done by OWASP reveals that SQL injection and Cross Site Scripting (XSS) are two of the most serious vulnerabilities in cloud based applications today, because of most dangerous attacks gets exploited and steal the user’s credentials such as cookie, credit card number etc.In order to mitigate these security vulnerabilities cloud service providers adopt a number of vulnerability prediction and detection approaches based on static and dynamic analysis techniques. These existing security mechanisms cannot alleviate attacks targeting cloud based applications. which focused on theoretical as well as practical solutions for certain security problems. The developers are necessary to ensure the delivery of safe applications also need to identify potential security issues within the applications before the stored in cloud environment. Method: Security testing is an effective mechanism to find out how vulnerable a Cloud based SaaS may be and to determine whether SaaS offering is Susceptible to XSS and resources are protected from intruders. The proposed work provides the automated Security testing by providing vulnerability detection and prediction model. The proposed Hybrid attributes are static and dynamic, the use of dynamic attributes to complement static attributes in the prediction of vulnerabilities. Findings: This paper propose a prediction models by collecting the static and dynamic attributes that are based on classification in order to predict SQLI and XSS vulnerabilities. Improvement: In order to improve the current work we proposed a hybrid attributes such as dynamic attributes to complement static attributes in the prediction of vulnerabilities in cloud based applications. By efficiently using the developed prototype tool for data collection and its used to evaluate our models on six open source cloud based applications. Based on the experiments average results states that the best predictor is MLP which achieved a pd=72%, pf=12% for predicting SQL Injection and pd=82%, pf=19% for predicting XSS Cross Site Scripting. The results of our experiments states that our prediction model is an ease and effective technique to predict and detect the SQLI and XSS vulnerabilities in Cloud applications.

Putting a Stop to Schemes, Scams That Destroy Lives

Putting a Stop to Schemes, Scams That Destroy Lives

Restaurant revenue management: apply reservation management?

Restaurateurs obviously want to turn their tables as empty seats equates to zero revenue, so to achieve the best revenue per available seat hour (RevPASH) they can work hard by scrambling at the door trying to orchestrate people into chairs or should they work smart and let the technology sort out the crowds…or a combination. The latest fad in trendy restaurants is to not take reservations. Many restaurant operators are confident and feel that their product is so good that customer’s will walk-in and wait for a table. The wait may be at the bar, in the lobby, on the sidewalk or even at another restaurant or bar across the street, but they will wait for a table in “the place to dine”. It seems that some restaurateurs of these trendy places cannot be bothered with the services of mobile apps like Open Table who take all the work away from restaurants by allowing customers to “book a table” in three clicks. The issue with these reservation apps is the cost to the restaurateur which is around $1.25 CDN per guest plus a one-time start-up cost for hardware and access. Every reservation system relies on staff to answer telephones and emails and/or manage software to then coordinate the process to ‘reserve’ the actual physical space. Reservation systems can work effectively if the reservation staff work error-free and the customers honor the booking by showing up at the time they requested (or booked), but in reality this is never the case. Restaurant staffs make errors and customers don’t show up. Major complaints from customers arise from errors in booking (phone/email) where the table isn’t available at the time (or even booked) and restaurant management complain (lost revenue)when guests are ‘no-shows’. To curtail the ‘no-shows’, some restaurant’s demand a credit card number with a booking and threaten a cancellation fee charge to those who don’t cancel in time. With this being said a restaurant can get a bad review by customers from the way a reservation is handled before they even taste the food. So the question this research paper attempts to answer is simple; in fine dining (trendy) environments, do customers who have pre-booked reservations spend more than the customers who “walk-in”? Data was collected by observing the ‘average guest check’ spending on revenue statistics on tables of two, three and four at five fine dining restaurants over the course of a 3 week period. The findings show that the mean guest check for guests with reservations was overall higher in all five restaurants with three of the five statistically significant using an independent t test as verification. This finding perhaps demonstrates that restaurant customers who make reservations are more valuable and restaurants that don’t take reservations may need to re-think their policy as this may affect revenue. More research is needed in other major centers to verify this trend in restaurant spending along with a study of the restaurants that do not take reservations. The findings of this research will enable restaurateurs to develop a reservation system that takes advantage of their seating plan to maximize the revenue per chair based on whichever reservation policy they feel comfortable with.

Victimizing Researchers by Phishing

Dear Editor, We read the brief report by Khadem-Rezaiyan and Moghadam, “Hijacking by Email: A New Fraud Method” (1), and would like to present some details and correct some issues in their report. We applaud these authors for increasing awareness of the problem. It appears that the phenomenon is growing faster than attempts to expose it and eliminate it. In paragraph two, the authors used the word “highjack,” while the correct word is “hijack,” which according to the Oxford dictionary (2), includes three different meanings: 1. Illegally seize (an aircraft, ship, or vehicle) while in transit and force it to go to a different destination or use it for one’s own purposes. 2. Steal (goods) by seizing them in transit. 3. Takeover (something) and use it for a different purpose In the academic world, we usually use the term “hijack,” to reflect the third concept. For instance, we use it for exposing hijacked journals. These appear as websites produced under a slightly different name than the websites of the legitimate journals from which they were copied. Researchers are encouraged to submit papers that receive little or no review, have exorbitant page charges, are seldom read or cited, and disappear after the legitimate journals take legal action. This may seem like a mere quibble, but we suggest that this particular fraudulent practice involving scam emails, might better be designated by the term “phishing” instead of “Hijacking by Email.” The authors presented two examples that they believe are a type of “Hijacking by Email.” Actually, they really do not involve hijacking, as no papers are ever published. Indeed, they are clearly phishing attacks. In phishing attacks, hackers use fraudulent emails to lure responders to their fake websites (3). Any sensitive information entered at the fake websites becomes the property of the phishers, as mentioned in the example given by Khadem-Rezaiyan and Moghadam. Phishers then use such data in their subsequent attacks, which contain exact information about researchers once again directing them to a phishing website. Most of these phishing attacks have financial goals, with the gathered information being used for hacking credit cards. Nowadays, a new type of scam is appearing. Some sites and companies claim that they can share authors’ publications such as eBooks and papers between many researchers. They state that their main goal is to promote the books and papers. They list authors’ books as free ebooks, always say there have been more downloads already, and have one-word reviews that are always the same for each of them. They get the credit card numbers from authors and others who sign up, charge them monthly, but seldom have any eBooks. They do not stop the monthly charges after complaints, so applicants are forced have to close their credit card accounts. As mentioned in the report, there are many frauds affecting scholarly publication. Among these are: faked declarations, tempting impact factors, email spoofing, cheating publishers, fake editorial boards, and fake conferences (4). These frauds are proliferating, and researchers should be aware of all of them.

A phish detector using lightweight search features

Web phishing is a well-known cyber-attack which is used by attackers to obtain vital information such as username, password, credit card number, social security number, and/or other credentials from Internet users via deception. A number of web phishing detection solutions have been proposed and implemented in the recent years. These solutions include the use of phishing black list, search engine, heuristics and machine learning, visual similarity techniques, DNS, access list and proactive phishing URLs detection based techniques. However, the current solutions are quite heavy in terms of their computational and communication requirements. Most of these solutions are dependent on third parties and require dedicated servers for their operation. It has been observed that search engine based solutions are the most lightweight and viable. This paper advances search engine based antiphishing research and presents the lightest possible phishing detection system, named the Lightweight Phish Detector (LPD). The LPD can run on client browsers for phishing detection. The development of LPD was done using the Google Chrome browser. Exhaustive testing has been performed to evaluate its accuracy and effectiveness. Comparisons are performed with currently available search engine based antiphishing approaches and other approaches that are currently used by popular browsers such as Chrome, Firefox, Internet Explorer, Netcraft toolbar and Cascaded Phish Detector. For testing, phishing sites reported from the Phishtank and normal sites available from Alexa ranking are used in the experiments. A true negative rate varying from 92.4% to 100% was obtained from the Alexa dataset of normal URLs while a true positive rate of 99.5% was recorded from the Phishtank URLs. Results show that the proposed scheme is very accurate. A competitive response time and intelligent action-response mechanism makes LPD a fast and intelligent antiphishing solution.

Numerical Code-Switching in Khuzestani Arabic

This paper aims to pinpoint a case of language contact in Khuzestani Arabic- a vernacular spoken in southwest of Iran- where Iranian Khuzestani Arab bilinguals use code-switching in their conversations with numbers. There has not been much research on Khuzestani Arabic vernacular particularly from a sociolinguistics point of view. The way Khuzestani Arabs switch from Arabic to Persian (Farsi) when incorporating numbers into their conversations has triggered the main impetus for this research. After studying and analyzing some samples of their speech, it has been found that this code-switching is surprisingly systematic and rule-governed. The result of this study shows that when scale is assigned to numbers describing weight, height, distance, price, and age, they are said in Arabic; whereas non-scale numbers describing digits, codes, contact numbers, serial numbers, or credit card numbers are said in Persian.

Reducing the impact of cyberthreats with robust data governance

All organisations that store valuable information are a target for cybercrime. Credit card numbers and other personal data fetch a high price on the black market and criminals have become adept at gaining access to sensitive information by using techniques including phishing emails, man-in-the-middle attacks and malware. Other kinds of valuable information, such as intellectual property, are under threat from cyber-espionage, insider threats and inadvertent exposure. All organisations that store valuable information are a target for cybercrime. As a result, there is a regular parade of media reports on large-scale data breaches and the expensive clean-ups that follow. By adopting four commonsense rules around deleting, herding, encrypting and controlling access to data, organisations can minimise the opportunities for malicious or accidental breaches of important information, as well as close information security gaps quickly before they can be exploited again, says Stuart Clarke of Nuix.

SECSIX: security engine for CSRF, SQL injection and XSS attacks

With the increase in human-web interaction, vulnerabilities has surfaced the various networks. With the rapidly growing technology, the ease of accessibility through web applications has revolutionized the traditional view of an office or a company completely. Web application carries sensitive data and they are accessible 24 × 7. Web site hacking continue to gain popularity as hackers are exploiting vulnerabilities across all geographies and across various types of web technologies. Hackers are constantly experimenting with a wide range of attacking techniques to compromise websites and hack sensitive data such as credit card number, social security number and other personal information. The three most commonly used attacks, according to Open Web Application Security Project (2012) vulnerability list have been discussed in this paper, namely SQL injection attack (SQLIA), cross-site scripting (XSS) and Cross site request forgery (CSRF) attack. In this paper, we present a security engine to counter SQLIA, XSS attack and CSRF attack.

A multi-feature approach to detect Stegobot: a covert multimedia social network botnet

Online Multimedia Social Networks(OSNs) are popular and efficient medium for millions of users. Unfortunately, in wrong hands, they are also effective medium for spreading social malware and propagation of social botnet. A newly proposed multimedia social network threat, Stegobot masks crucial information in a digital image by using a technique known as steganography. Stegobot works by first infecting a computer and then communicates the stolen information, which could be login passwords, bank account details or credit card numbers. Also it efficiently utilizes the advantage of image steganography to hide the presence of communication within the image sharing behavior of OSNs. Since these social bots exhibit unobservable communication channels, existing botnet detection mechanisms cannot be applied to such botnets. In this paper, we present a novel host based method for detecting and differentiating Stegobot profiles. Also the proposed method shows the ability to detect Stegobot network traffic which is inherently different from legitimate multimedia social network traffic. The best performance of our detection system is demonstrated on different social networks data set with different evaluation metrics. Multiple aspects of multimedia attributes proposed in this study help to explore the hidden communication structure of botnet. Stegobot profiles mimic genuine users and compromise other vulnerable users in social network. By using single view features alone it is very difficult to detect bot profiles as well as Stegobot communications and hence in this work a multi-feature approach is considered. Also, this work attempts to help network security experts and forensic analysts to understand the Stegobot communication and the key profiles inside the malicious network.