${log.root}/lowem.log
Inflation, Investing and Everything

All | Energy | Java | Tech | Musings | Env | Biz

Main | Next page »

Monday January 16, 2012

On the DBS/POSB ATM card fraud case in Singapore

So I've been writing in to a Minister once again. Probably not the first or last person to bring up these simple facts to Tharman Shanmugaratnam, Minister for Finance of Singapore, but I thought I would contribute my two cents (ha, ha). Here it goes :

...
Delivered-To: ...
Subject: Improving security for ATM/NETS cards
From: Low Ee Mien [...]
To: tharman_s@mof.gov.sg

Dear Minister for Finance,

I am writing in my personal capacity regarding the recent DBS/POSB ATM fraud case. As we have seen, the two-factor authentication mechanism of ATM/NETS cards has been defeated. The perpetrators have managed to successfully obtain both factors of authentication : something you have (ATM card details via the card skimming device), and something you know (ATM PIN via a strategically-located pinhole camera).

It has been proven time and again that the magnetic stripe data such as those being used in the ATM and NETS cards in Singapore is quite easily copied. This magnetic stripe technology was invented over 50 years ago and is able to contain at most a few bytes of information, and has no processing capability of any sort, nor any form of cryptographic technology to resist cloning or tampering. In short, this is a completely outdated technolgy that the whole of our nation is using for our daily financial transactions, at thousands of retail establishments, ATM's, top-up kiosks, and so on.

Something needs to be done about this glaring security vulnerability.

As you can see from the link below, Malaysia's Maybank is already ahead of Singapore in this respect :
http://www.maybank2u.com.my/mbb_info/m2u/public/personalDetail04.do...

The Maybank ATM card includes an embedded smartcard chip, which as their website states, offers "Increased security, as the smart chip is tamper-resistant and the data stored is harder to extract and copy". This is the key point : smartcard technology, well established by now, mitigates many of the shortcomings of magnetic stripes. It is much harder to simply clone compared to magnetic stripes and requires sophisticated and intrusive physical attacks to get to the private key data contained in the smartcard chip. The technology currently required to carry out such attacks does not fit in a simple card skimmer that can be installed in an ATM card slot. Other security measures such as revocation of the certificates of any particular set of smartcards can be carried out on demand. In addition, manufacturers have already included a number of on-board security measures in smartcard processor chips to resist cloning and tampering.

Hence, in the interest of increased security for banking customers, I would like to suggest that MAS work towards regulations requiring all banks issuing ATM and NETS cards to include embedded smartcard technology such as the EMV technology being used by VISA and other credit card issuers.

As an additional security measure, I would also like to suggest industry-wide regulation to eventually disallow transaction fallback to magnetic strip reading, thus removing one of the main factors contributing to ATM card fraud. The ultimate goal is for ATM/NETS cards to be issued *without* any form of magnetic stripes whatsoever, and ATM's as well as POS terminals to be updated to smartcard-acceptance only, thus finally retiring this outdated 50-year old magnetic stripe technology.

Thank you for your attention.

Low Ee Mien (Mr)

- Sure, smartcards are not impossible to defeat, but they are much harder than the increasingly laughable magnetic stripes, with card skimmers being more readily available nowadays, even apparently custom fitted to closely resemble the "anti-intrusion" devices installed over the ATM card slots. Some have said that 3D printers have now been used to create the exact shapes of these "anti-skimming" devices, or Fraudulent Device Inhibitor (FDI), in an ironic application of cutting-edge technology being used to defeat a simple physical device that was meant to guard against just such occurrences of card skimmers being installed.

The measures announced by the bank are well and fine, such as blocking foreign ATM withdrawals for folks who have not used them overseas, sending out SMS messages and so on, but all these reek of reactionary and stop-gap measures.

I don't quite agree with the DBS CEO's claim that replacing the magstripes with smartcard chips has its own set of problems, such as : "The problem with that is it's a huge inconvenience to customers. When you go to the US, they don't accept chip cards". My man, the world is moving away from this outdated magstripe technology, I am frankly surprised and amazed simply that Singapore has not gone along and our neighbour Malaysia has. Fact is, we are actually behind Maybank Malaysia in this area and there's quite a bit of catching up to do.

(2012-01-16 11:41:39 SGT) [Musings] Permalink

Saturday July 23, 2011

Inflation, Investing and Everything

Days like what we've been having recently remind me of why I started this blog in the first place. Looking back at the historical gold prices, in 2004 when I got seriously concerned and started blogging about inflation, gold prices were around the $400 level then.

And now, this week, gold prices have hit record highs above $1600 per troy ounce. That is a 4x increase from the $400 level. It equally reflects the rise in precious metals as it does the corresponding fall in the US dollar, the currency it is benchmarked against. It is a barometer that tells us that all is not right with our financial world. It tells us that, compared to a steady, unchanging store of value with a history of over 6,000 years, the so-called money we have in our wallets and in our bank accounts is decaying steadily. Plus, like most people I know, I don't think I have received a raise of 4 times my monthly salary in my day job in the past few years. If you have, good for you.

On the flip side of all this, with gold prices above $1600, silver prices above $40, and just as well oil prices again flirting with the $100 level, I am once again reminded of the central theme behind what I have been trying to communicate to you, the readers, of what has been coming down the road, and what is yet to come. Inflation. Inflation like nothing most of us have ever seen before.

Since 2004, I have been talking, and blogging, about the coming inflation, how what had seemed to be an unlikely but ultimately potent combination of the fiat money system, debt creation, resource depletion, peak oil, population growth, and climate change would combine to create an inflation monster that would bear down on us all. I tried to convey some measures of what we would need to do to combat inflation in our own manner. From investing in commodities ranging anywhere from gold and silver to oil and uranium, to food and water. From the base metals of iron and copper to the rare earth metals of lanthanum and neodymium and 15 other elements I'm not quite sure I know how to spell. On matters of asset allocation and how we should sub-divide our portfolios. On trying, or not trying to time the markets.

Yes, here we are. It would be prudent, now, I think, to prepare for the coming global hyperinflation. That is if the systems, and the structures that are currently in place continue to run as they have. And all indications point to the same conclusion. We still have not seen anything yet.

Inflation, Investing and Everything. Indeed.

(2011-07-23 01:04:28 SGT) [Musings] Permalink

Friday October 08, 2010

Pubic urged to be cautious ...

channelnewsasia.com :

- Yes, the "pubic" should try to be cautious ... I guess some people need to pay a little bit more attention to their proof-reading. This is almost as good as the "Unversity" headline on the front page of the Straits Times a few years back.

(2010-10-08 21:34:01 SGT) [Musings] Permalink Comments [1]

Sunday February 07, 2010

Singapore Airshow 2010 photos and video gallery

The Singapore Air Show is here again. Went to the Singapore Airshow 2010 twice this year, as has been the case for the past couple of rounds - once during the trade day on Wednesday where there are fewer people, and once with the family during the public day on Saturday when the crowds arrive in full force.

Here are some photos - the whole set of photos has been uploaded into my Google Picasaweb photo gallery (trade day) (public day) :

Besides the usual F-35 Lightning II mockup from Lockheed Martin (still waiting for the real one to arrive here), the Apache AH-64D Longbow attack helicopter, the F-15's and the F-16's, a new addition this year was the F-111 fighter-bomber, said to be making its last appearance ever :

Here's a video of an F-16 Falcon in the flying display :

The rest of the videos will be uploaded to my Youtube channel.

ST - Ingram Micro Vietnam Retreat 2010 Day 3

Day 3 was "Going Back Day". We started off with a wrap-up of the conference with Koh See Kiat giving a short overview of the ST Electronics Infosoft corporate structure, after which we took a group photo. Thanks to automatic face recognition technology from Google Picasaweb, you can click on the link below and check out the names. But thanks to my being not very good with names, many of the names are not yet properly tagged - any help from the audience would be appreciated :)

After the conference it was time to check out and the first group to get ready for the return flight home. Here I am at the lobby of the Duxton Hotel Saigon, bags all packed and ready.

Back to Tan Son Nhat International Airport, looking out of the terminal windows at SQ173, a Singapore Airlines Boeing 777-200. That's our ride back to Singapore from Ho Chi Minh City.

James Wong, a colleague from ST Infosoft, from the Land Information Systems department. We've got representatives from all 3 departments in the classic triumvirate of "Air, Land and Sea" on this trip.

And that's it. It was a good trip. We had a good time, and got to meet up with our partners and vendors from the various companies including Ingram Micro, IBM and Symantec, and we also got the opportunity to get to know better our colleagues from the other departments within ST Electronics Infosoft.

ST - Ingram Micro Vietnam Retreat 2010 Day 2

Day 2 was the conference proper, but before that my room-mate Chan Yue and I went about taking some photos out on the street in the block surrounding the hotel.

As could be expected, at present Vietnam is still very much motorcycle/scooter country. Like some of my peakoiler friends might say, just wait till they really start buying cars. The country is still very much in development, with contrasting styles of new ultra-modern buildings rising up right alongside the existing buildings, such as this example here :

The conference itself - there's myself and Chan Yue, with the IBM folks giving the initial round of presentations.

This was followed by a "Mini Amazing Race" team-building exercise, which also served as a good way to explore the city.

A couple of games the team played :

A couple more landmarks - the Notre Dame Cathedral and Independence Palace. In the nearby park and surrounding areas, workers were getting ready putting the finishing touches for the upcoming Vietnamese New Year 2010 celebrations.

Over at Ban Thay Market, we bought some souvenirs, and met members of other teams.

And just before dinner, Chan Yue and I went for some Vietnamese "pho", which is some kind of noodle-like strips in nice flavored soup - I tried the chicken pho.

Dinner itself was a river cruise on a restaurant-boat going up and down the Saigon River, an historic and important part of Ho Chi Minh City, serving as water supply, Saigon Port and tourist attraction all in one.

During the cruise, Vincent Lee of IBM Singapore entertained us with his keyboard renditions. And this one here is an interesting stone-based xylophone instrument thing :