Stories
Slash Boxes
Comments
typodupeerror delete not in

Comments: 466 +-   CC Companies Scotch Mythbusters Show On RFID Security on Saturday August 30 2008, @05:40PM

Posted by kdawson on Saturday August 30 2008, @05:40PM
from the next-comes-guns-and-money dept.
hardhack
mathfeel passes along a video in which Mythbusters co-host Adam Savage recounts how credit card companies lawyered up to make sure the Discovery channel never, ever airs a segment on the flaws in RFID security. "Texas Instruments comes on [a scheduled conference call] along with chief legal counsel for American Express, Visa, Discover, and everybody else... They [Mythbusters producers] were way, way outgunned and they [lawyers] absolutely made it really clear to Discovery that they were not going to air this episode talking about how hackable this stuff was, and Discovery backed way down being a large corporation that depends upon the revenue of the advertisers. Now it's on Discovery's radar and they won't let us go near it."
story

Related Stories

This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
 Full
 Abbreviated
 Hidden
More
Loading... please wait.
  • by Brad1138 (590148) * <brad1138@yahoo.com> on Saturday August 30 2008, @05:40PM (#24813941)
    No disrespect to the MythBusters, but if they could figure it out, plenty of others will also.
    • by MillionthMonkey (240664) on Saturday August 30 2008, @05:43PM (#24813959)

      It's only a matter of time before this gets pulled off Youtube.

      • by multisync (218450) * on Saturday August 30 2008, @07:52PM (#24814909) Journal

        It's only a matter of time before this gets pulled off Youtube.

        On what grounds would it be pulled off of YouTube? This is the very essence of what YouTube committed to deliver: a medium for user-produced video content. I don't see how Adam Savage could complain - he was speaking to a room full of people, any of whom could have a cel phone, or a video camera, recording him. Same with the venue and event producer - they let him in with a camera. Unless the clip was posted by someone other than the copyright holder, I don't see any way it could be "legitimately" removed.

        As for illegitimate methods, is Visa, or any of the other cc companies, a big enough customer for Google that they would risk the possible backlash and negative publicity to pull it? Besides, it's been seen now by lot's of people. No way to undo that.

        I loved it when the guy in the audience said "you do have about 3000 people in the room are aren't under any such legal arrangements." That's the point, right there.

        Once again, the corporate culture uses lawyers to focus attention on themselves by trying to silence people who simply speak the truth. They make it so easy. It's like catching fish in a barrel.

        • by OECD (639690) on Saturday August 30 2008, @09:08PM (#24815355) Journal

          On what grounds would it be pulled off of YouTube?

          Grounds? Youtube takes down anything whenever *anyone* sends something that vaguely (really) resembles a proper DMCA takedown notice.

          Safe legal ground, but they're starting to piss off a subset of their users who expect the creators of a community to put up a modicum of defense for said community.

      • by couchslug (175151) on Saturday August 30 2008, @09:17PM (#24815401)

        "It's only a matter of time before this gets pulled off Youtube."

        Save a copy to repost or post elsewhere.

        https://addons.mozilla.org/en-US/firefox/addon/3006 [mozilla.org]

    • by kestasjk (933987) on Saturday August 30 2008, @07:15PM (#24814633) Homepage
      As I understand it they didn't really find anything out, they were just in the preliminary R&D stages, trying to talk to people in the know.
      It's not like they're covering up something big, they just want to ban talk about it altogether.

      ... Actually that's probably even worse.
    • by hey! (33014) on Saturday August 30 2008, @09:25PM (#24815435) Homepage Journal

      Probably have done. Probably were anticipated by the companies to be going to do.

      The thing about credit cards is that they have never been very secure. They just have a business model that can absorb a fairly substantial slice of fraud. True, the companies don't like fraud, and they take steps to reduce it, but they don't spend more than a dollar to save a dollar of fraud.

      Having a fraud tolerant business model is way more important than having a fraud tolerant credit card. The only thing is that credit card marketing is based on getting consumers to rely on their cards, to trust the cards and the company behind them.

        • by zippthorne (748122) on Saturday August 30 2008, @10:29PM (#24815773) Journal

          The signature is not a security feature. Unless you want to train tens of millions of clerks in precision handwriting analysis techniques.

          It's merely a token of accession to contract terms. Having people write, "yes" would be just as effective.

      • by jythie (914043) on Saturday August 30 2008, @10:12PM (#24815689)

        Visa?

        Mastercard?

        Discover?

        These are companies that you can not avoid, and can not fight. No one who wants to function can boycott them, and without SERIOUS fallout no lawmaker can touch them.

        Not to mention the public is surprsingly accepting of 'it should be illegal to show how bad a product is!'

  • After hearing this news, I went to the Mythbusters site and entered in a bunch of old wives tales & myths passed onto me from my father and forefathers concerning lawyers. They are:
    • Lawyers possess a membrane of blood just below the skin so they appear to be human and bleed from things like paper cuts and scratches but if shot in the head or other vital organ, they will not bleed.
    • As long as they are given fresh videos of accidental injuries where a party is liable, lawyers can go weeks without food or water and still survive.
    • When dropped from 6 story (or higher) buildings, lawyers bounce.
    • Even when bound with twine and anchored, lawyers float.
    • If you cut a lawyer's head off, it will manage to sue you for days before it dies.
    • Lawyers emit an evil into the ether so powerful that when they are placed in a cage with a ravenous lion, the lion will cower and run.
    • Lawyers can smell profit and always pick the correct door in the Monty Hall situation when IEDs lay on the other side of two and $1,000 lays on the other side of one.
    • Lawyers can't feel pain.
    • Any lawyer can outrun a male grizzly bear in the middle of mating season.
    • Over the years, lawyers have built up a tolerance to lethal doses of iocane powder.

    I can't wait until they test my myths! Also, lawyers are the reason we no longer have habeas corpus, so the show should be filmed in Guantanamo Bay, Cuba.

    • by Anonymous Coward on Saturday August 30 2008, @06:03PM (#24814073)

      I think this would be a good time to point out that Barack Obama and his running mate are lawyers.

    • by prestomation (583502) on Saturday August 30 2008, @06:06PM (#24814097)

      I like how this is modded informative..

        • by maxume (22995) on Saturday August 30 2008, @06:49PM (#24814397)

          If you were alive during the days that they just burned scientists and heretics at the stake, I am impressed. Perhaps you just mean that you yearn for the days? (this is probably a pretty narrow style issue, but whatever)

          If you really care, stop doing business with them. Stop doing business with the various financial companies because they would manipulate what is presented to you. Stop doing business with Discovery because they put profit before whatever-it-is. Stop doing business with people who do business with them. I mean, you don't actually have to sit through the bullshit if you don't want to, but damn if it isn't easier.

          What it comes down to is that if you don't stand up for a principle, you don't really have much business expecting anybody else to...

          • by Original Replica (908688) on Saturday August 30 2008, @08:59PM (#24815299) Journal
            If you don't do business with the credit card companies, you will have a very low credit rating. If you don't do business with the banks that use RFID bank cards, you might not have any bank at all in many areas of the country. Without a credit card or bank account you will find your options for owning a house or a car reduced to nil. In Canada, you cannot pay your taxes in cash. [www.cbc.ca] You cannot get an iPhone with cash. [topiphonenews.com] And yes, it is legal for a business to refuse cash purchases. [chron.com]

            The credit/currency corporations are the key to being "in the system" and if you are "out of the system" you will be homeless or in government housing in short order. I'm not saying that's a good thing, but it is an unfortunate reality. Perhaps you could lead a bank and credit card free life dealing only in Ithica Hours. [ithacahours.org] But freedom from the financial corporate overlords is rare and hard won. Those overlords like RFID, so you will have RFID.
    • Lawyers can smell profit and always pick the correct door in the Monty Hall situation when IEDs lay on the other side of two and $1,000 lays on the other side of one.

      The correct door is of course one with an IED behind, they can sue for waaay more than $1000 for the trauma of getting blown up.

    • by azakem (924479) on Saturday August 30 2008, @06:30PM (#24814267)

      Also, lawyers are the reason we no longer have habeas corpus, so the show should be filmed in Guantanamo Bay, Cuba.

      Lawyers are also the only reason you ever had habeas corpus in the first place, and the only chance you have of ever getting it back.

      Lawyers are like nuclear tech, they can be used for good or evil.

        • by Antique Geekmeister (740220) on Saturday August 30 2008, @08:28PM (#24815117)

          It's not been lost? Tell it to those in Guantanamo Bay, or those held without legal consul, notification to their families, or admissions of their presence in this and similar facilities. Since their names are secret, and even admitting that you know the names can get you thrown in jail as a security risk, that's about as serious a violation of habeas corpus as you can commit. It's also a major violation of the Geneva Convention.

          So the principal is, in fact, in danger.

  • In other words: (Score:5, Informative)

    by Anonymous Coward on Saturday August 30 2008, @05:42PM (#24813955)
    Myth Confirmed.
  • by Bieeanda (961632) on Saturday August 30 2008, @05:43PM (#24813957)
    Busting Security Through Obscurity!
  • by hpa (7948) on Saturday August 30 2008, @05:46PM (#24813983) Homepage

    This isn't at all about the hackers ... this is about making the general public aware just how bad this is.

    • by TubeSteak (669689) on Saturday August 30 2008, @06:32PM (#24814273) Journal

      This isn't at all about the hackers ... this is about making the general public aware just how bad this is.

      But as the reasoning goes...
      If the general public isn't aware of the problem...
      It isn't a problem.

      • by Sycraft-fu (314770) on Saturday August 30 2008, @09:43PM (#24815531)

        Especially when it comes to things that might be used for criminal ends. Reason is, most criminals aren't all that smart. Especially small time criminals. To the extent there are smart criminals, they are usually the ones on top, the drug lords and such. The small time criminals usually aren't the sort of people who do research or think things through. You can see this in things like copper theft. This really is not a very profitable mode of operation. Even with the price having doubled, copper prices are still talked about in single digit dollars per POUND. That's also the price you'd pay on a mercantile exchange, not the price a scrap dealer gives you. Thus it is dangerous (both in terms of getting arrested and risking death if the wires happen to be live), a good bit of work, and probably doesn't pay any better than a job at McDonalds.

        The point I'm getting at is that the large amount of petty, opportunity type criminals go for things their attention has been brought to. Copper prices skyrocketing made news so their attention got brought to it. They didn't realize that while the prices did double that was from about $2/lb to $4/lb.

        Now as related to RFID, well Mythbusters certainly could lead to slightly more sophisticated petty criminals trying it. Right now, there's little information out there on it. So you'd be talking doing a good deal of research, perhaps some of it original, to build a device that could nab card numbers. This assumes that they've even had it brought to their attention that such a ting can be done. If they don't read a site like Slashdot, chances are they don't know it has security issues, and perhaps aren't even aware it exists at all.

        However if Mythbusters calls attention to it, and shows a basic guide of how to exploit it, well then they might start trying.

        Now I'm not saying that this means the problem shouldn't get fixed, or that it is Mythbusters job to keep it under wraps. I am saying that there really is some merit to the idea that if the public isn't aware of the problem it's not a problem. Sure there are people out there who are both aware it is a problem and know enough to exploit it. Perhaps you are one of them. However, are you going to actually do it? No? Then no problem.

        I'm not saying this is the right way to approach the security of this issue, I am just saying that there is real merit to the idea that if the public doesn't know then it's not a problem. You probably meant that it would be happening but they'd be kept in the dark about it. No, not at all. What I mean is that if the public doesn't know about it, people won't try to exploit it.

  • by Hawthorne01 (575586) on Saturday August 30 2008, @05:47PM (#24813991)

    "So, if I Understand this correctly, you knew of these security holes back in 2008, and rather than fix them, you prevented the Mythbusters from talking about them."

    "Well, yes, Your Honor."

    "Give me another reason why I should listen to one word of your defense against this class action suit?"

    This will come back and bite them in the @$$. Hard.

  • Pass the buck (Score:5, Insightful)

    by magus_melchior (262681) on Saturday August 30 2008, @05:49PM (#24813999) Journal

    So, rather than face lawsuits over contractual obligations to build and maintain a secure system (hah), they litigate the party who exposes them for attempting fraud.

    Should it be surprising that in a culture that prizes profits and pride over progress, that litigation threats are used to squelch otherwise good feedback and information?

  • by Stanislav_J (947290) on Saturday August 30 2008, @05:50PM (#24814001)

    Of course, now that the story is propagating all over the Net, pretty soon everyone will know about the alleged security flaws (if not the details), and the CC companies and their legal eagles will look quite villainous. When will they ever learn?

  • by Anonymous Coward on Saturday August 30 2008, @05:50PM (#24814005)

    freedom of speech.

  • Yeah, well... (Score:5, Informative)

    by VValdo (10446) on Saturday August 30 2008, @05:50PM (#24814009)

    They weren't able to stop this one [pbs.org], which, if you haven't seen yet, is pretty amazing.

    • Re:Yeah, well... (Score:5, Insightful)

      by MBCook (132727) <foobarsoft@foobarsoft.com> on Saturday August 30 2008, @05:59PM (#24814049) Homepage

      Because PBS isn't advertiser funded, it gets its support from private individuals and (to a rather minor extent) the government. While corporations can (and do) donate, it isn't their lifeblood.

      I agree with you though. I've seen that episode and it's a fantastic rebuke of the credit card industry.

    • Re:Yeah, well... (Score:5, Insightful)

      by cortesoft (1150075) on Saturday August 30 2008, @05:59PM (#24814051)
      I think you have just shown a perfect example of why we need television that isn't funded by advertisers. PBS can air the show because they aren't driven by profit and aren't beholden to those corporations (although even that is starting to change with corporate sponsorship of PBS). While you can argue that public television is beholden to the government, at least it is beholden to a (slightly) different power.
      • Not only that but (Score:5, Insightful)

        by beakerMeep (716990) on Saturday August 30 2008, @06:10PM (#24814131)
        I truly see Frontline as one of the last and only truly investigative journalism programs on TV. It's the only show where I have found myself thinking "wow what they are reporting is interesting but it raises question A" and then as if by magic, the show continues: "we decided to further investigate and here's what we found about question A and this lead us to questions B, C and D"
      • Re:Yeah, well... (Score:5, Insightful)

        by Blue Stone (582566) on Saturday August 30 2008, @07:01PM (#24814523) Homepage Journal

        That's why you get programmes like Top Gear from the BBC. No commercial channel would dare upset the card manufacturers like it does.

      • Re:Yeah, well... (Score:5, Interesting)

        by kestasjk (933987) on Saturday August 30 2008, @07:24PM (#24814719) Homepage
        The BBC is excellent in this regard, by the way. If you read the news there it's crystal clear the government (nor the BBC higher ups) have any power over them. Even internal BBC scandals like Blue-Peter faking phone-in competitions are dutifully reported on.

        You'll feel sick reading/watching Fox, or even CNN etc, after reading/watching BBC.
  • corporate games (Score:5, Interesting)

    by sr8outtalotech (1167835) on Saturday August 30 2008, @06:03PM (#24814079)
    It's a all about risk management for the companies involved. On one hand you have the Discovery Channel which depends on advertising revenues. On the other hand you have several large corporations that are using a flawed system. The question for the credit card companies is whether or not it's cheaper to use the system in place and pressure others not to disclose flaws or come up with something that works better. Sort of reminds me of Mitsubishi and the wheels flying off their heavy vehicles a few years ago. It was cheaper to payout settlements than recall and fix the vehicles. http://en.wikipedia.org/wiki/Mitsubishi_Motors#Vehicle_defect_cover-up [wikipedia.org]

    I know the management of these companies have obligations to the shareholders but isn't about time they started to exhibit an obligation to not make fraud so easy with the current system?
  • by Rod Beauvex (832040) on Saturday August 30 2008, @06:32PM (#24814285)
    Make a note of this on their Wikipedia entry.
  • RFID info (Score:5, Informative)

    by sfm (195458) on Saturday August 30 2008, @07:33PM (#24814787)
    For a good reference describing some of the problems with RFID technology, check out the book "Spy Chips" by Katherine Albrecht and Liz McIntyre http://www.amazon.com/Spychips-Major-Corporations-Government-Track/dp/1595550208/ref=sr_1_1?ie=UTF8&s=books&qid=1220142206&sr=8-1 [amazon.com] This has been our for over 2 years now, but the general public has no idea on the capabilities or consequences of RFID systems. Give it a look.
  • Ancient secrets. (Score:5, Informative)

    by Ostracus (1354233) on Saturday August 30 2008, @09:18PM (#24815405) Journal

    "Texas Instruments comes on [a scheduled conference call] along with chief legal counsel for American Express, Visa, Discover, and everybody else... "

    After discovering a flaw in one of Texas Instruments' RFID tags, researchers from RSA Labs and Johns Hopkins University say they plan to continue their testing with exploits against other RFID equipment. [cioinsight.com]

    Doesn't look like the secret everyone thinks it is. Note the date. And this just from a few seconds with Google.

    • by symbolset (646467) on Saturday August 30 2008, @05:50PM (#24814007) Journal

      Wildly popular Mythbusters television star Adam Savage resigned suddenly from his position as cohost of Discovery TV's Mythbusters. Said Mr. Savage: "I just want to take a little personal time with my family. I'll be taking some time out for a year or four in Belize."

      Mr. Savage has not been seen since, and our repeated calls to his agent go unanswered.

      The Discovery Channel has announced through media representative Linsay Patter "We'll miss him and wish him the best. His loss means we won't be able to continue with the show." Discovery will be filling the space with Annie Parkinson's "Crafts for Children".

    • by Anonymous Coward on Saturday August 30 2008, @06:12PM (#24814159)

      Bad analogy time:

      It's like a ship with holes in it. If the ship is already at sea, you shut up and man the pumps. But if the ship is in the dock, you yell "Look, hole!" and hopefully you wont have to pump quite as much later on.

    • by RelaxedTension (914174) on Saturday August 30 2008, @06:19PM (#24814201)
      "...and I have decided to keep those revelations to myself so that it is not exploited by every script kiddie and wannabe hackers to try."

      And you are the only person that will figure that method out, I guess. Hopefully, you are the smartest person alive, and the problem so difficult no one else can possibly figure it out too, and abuse it.

      The way we move forward as a race is that we share information, both about what works and helps, and more importantly about what doesn't work or causes harm. If the people affected the most by the flaw that has been discovered do nothing about it, then disclosure is the way. That way everyone else is informed and warned, as they should be.
    • Re:Ignore Them (Score:5, Insightful)

      by Anon E. Muss (808473) on Saturday August 30 2008, @06:27PM (#24814249)

      ... there is no law to prevent Discovery from airing facts ...

      There is also no law that requires the credit card companies to spend their advertising dollars on the Discovery Channel, or any other media outlet owned by the same company. That's what this is all about.

    • by Anonymous Coward on Saturday August 30 2008, @06:46PM (#24814371)

      That this clip is leaked to the Internet where it explodes in popularity.

      The Discovery Channel should make sure that the media the episode is stored on is secured by means of RFID security devices to ensure that it is not stolen and leaked.

Always leave room to add an explanation if it doesn't work out.