Feeds

Unsolicited credit card push irks security researchers

On tin snips and tin-foil hats

Top 5 reasons to deploy VMware with Tegile

A top UK security expert has criticised the practice of issuing unsolicited credit cards.

Professor Ross Anderson of Cambridge University reports how his wife recently received a pre-approved, unsolicited Gold Mastercard from UK store Debenhams with a credit limit of more than £1,000 through the post.

The security implications, as well as the ethics, of these type of inertia sales irk Anderson. Following Debenhams' advice of cutting up the card and throwing it in the bin simply doesn't pass muster, he argues. For one thing, the UK's move to Chip and PIN on plastic cards as an alternative to signature-authorised transactions complicates the problem of disposing of unwanted plastic cards.

"The average customer has no idea how to ‘cut up’ a card now that it’s got a chip in it," he writes .

"Bisecting the plastic using scissors leaves the chip functional, so someone who fishes it out of the trash might use a yescard to clone it, even if they don’t know the PIN. The PIN mailer might be in the same bin.

"Here at the Lab we do have access to the means to destroy chips (HNO3, HF) but you really don’t want that stuff at home. Putting 240V through it will stop it working - but as this melts the bonding wires, an able attacker might depackage and rebond the chip," he adds.

Anderson suggests consumers ought to destroy unwanted cards with either a hack saw or a robust pair of tin snips. "This isn’t foolproof as there exist labs that can retrieve data from chip fragments, but it’s probably good enough to keep out the hackers," Anderson adds. ®

Remote control for virtualized desktops

More from The Register

next story
UK smart meters arrive in 2020. Hackers have ALREADY found a flaw
Energy summit bods warned of free energy bonanza
DRUPAL-OPCALYPSE! Devs say best assume your CMS is owned
SQLi hole was hit hard, fast, and before most admins knew it needed patching
Knock Knock tool makes a joke of Mac AV
Yes, we know Macs 'don't get viruses', but when they do this code'll spot 'em
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
Mozilla releases geolocating WiFi sniffer for Android
As if the civilians who never change access point passwords will ever opt out of this one
Why weasel words might not work for Whisper
CEO suspends editor but privacy questions remain
prev story

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
New hybrid storage solutions
Tackling data challenges through emerging hybrid storage solutions that enable optimum database performance whilst managing costs and increasingly large data stores.
Protecting users from Firesheep and other Sidejacking attacks with SSL
Discussing the vulnerabilities inherent in Wi-Fi networks, and how using TLS/SSL for your entire site will assure security.