Mako Networks Newsroom

Dynamic Credit Card - image from Ars Technica

By Simon Gamble

The annual Consumer Electronics Show (CES) in Las Vegas always features a few technologies that get people excited, and this year’s recently concluded edition proved no exception. While the vast majority of the new tech toys on display were more conventional consumer items like TVs, phones and computers, what grabbed my interest this year was a new credit card from a company called Dynamics Inc. that’s debuted some new technologies designed to thwart card fraud.

Banks and technology companies have known for some time that the technology used to encrypt credit cards is in dire need of updating. The magnetic stripe on your debit or credit cards is based on technology first developed nearly 60 years ago. There’s arguably no other technology we use today that hasn’t seen a major upgrade in such a long time.

Fraudsters have since developed techniques to quickly and easily steal cardholder data from these magnetic stripes, perpetuating an international black market for card data that fuels a cybercrime industry estimated to be as large as the international drug trade.

To combat the fraudsters, banks and card companies have been developing a number of new credit card technologies to make it more difficult to steal valid card information. To date, the most successful has been a technology known as EMV (for Europay, MasterCard and Visa, the three pioneers of the technology), where a small microchip is installed on each card containing encrypted data. These microchips are supposedly impossible to clone or replicate, so without physically possessing the cards thieves can’t use the card data.

But EMV requires changes in the way cards are accepted at merchants, and in some markets like the U.S., the cost to replace all the payment terminals would be extraordinary. It’s not economically feasible, so magnetic stripes are still used on EMV cards as a backup. If the cards are swiped through a skimmer that takes the card details off the stripe, it’s game over.

To their credit, card companies have been trying a variety of technologies to make credit cards with one-time use codes, so that each card transaction is unique. Even if a fraudster was able to somehow steal the card information, without the correct code the data would be worthless.

A few years ago Visa and others tried to create cards with these one-time use codes, but after trials the cards never made it into the mainstream.

Other technologies, including one developed by BNZ called ‘liquid encryption’ have also been tried to limit the potential window during which card data remains valid. In liquid encryption, card details are changed and re-written every time a card is used in a BNZ ATM machine. Therefore any stolen card information would only be valid for a limited time.

The new card from Dynamics features some element of all these technologies, plus a few more. Each card self-generates a one-time use code for each transaction that changes six digits in the card account number. The card details are therefore valid only for one transaction, so even if fraudsters grabbed the digits they’d be unable to use it for any future transactions.

What makes this card unique however is that it contains a self-wiping magnetic stripe on the back, so it behaves exactly like a regular credit card in retail scenarios. You swipe it just like a traditional card, and after the transaction completes, the card erases the information in the stripe.

Not only do these new cards reduce the risk of card details being stolen at the Point of Sale, they also help limit exposure if a data breach were to occur at a merchant later on where card details were exposed. Since each card number is only valid for one transaction, the usefulness of that card data to a potential criminal would have long since expired.

No doubt these card technologies will only stay current for a limited time, and fraudsters will be working on ways to defeat them. But for the time being, it’s good to see that the threats of fraud are being taken seriously and new developments are underway.

Mako Networks Co-Founder Simon Gamble was a special guest recently on a holiday edition of the NZ Tech Podcast, discussing credit card fraud and ways consumers can keep their details safe during the busy holiday shopping season.

With all the increased retail activity during this time as shoppers pull out their plastic, fraud incidents spike nearly 20 percent on average. Listen along to learn how retail fraud happens, where compromised card data goes, and for some simple tips consumers can use to protect themselves.

You can listen to the podcast directly here, or via the follwing methods:

Subscribe and listen via iTunes
Subscribe and listen via Zune
RSS feed

Recent news reports in the U.S. have highlighted a data breach at Lucky Supermarkets, where more than 1,000 people claim their card details have been stolen in a sophisticated skimming operation. To help combat card fraud, skimming is an issue Mako Networks pays attention to, and we often find that business owners and consumers are unaware of the threat it presents.

Skimming occurs in retail environments when an extra card reader is affixed to payment terminals where customers swipe their cards, stealing the information encoded to the magnetic stripes. Fraudsters can use these details combined with PIN numbers to create clones of your credit cards.

It’s a real and present threat, as skimming incidents have grown around the world. This clip from ABC News in the U.S. gives a good overview of the situation:

By Simon Gamble

Reading the Herald on Sunday this week, I was pleasantly surprised to see an article about the processing delays retailers are encountering as they begin accepting more chip-and-PIN type cards in stores. As we told the New Zealand Herald back in April, most New Zealand merchants still need to upgrade their payment terminal connections to prevent long delays in processing chip-and-PIN cards, and it seems that more are starting to experience slower transaction times.

These chip-and-PIN cards (known as EMV, for Europay, MasterCard and Visa, the three companies responsible for pushing the technology) are becoming increasingly popular around the world to secure credit card transactions. Instead of relying on the outdated magnetic stripe, EMV cards have an embedded microchip that contains encrypted account information used to authorise purchases.

One significant issue that merchants encounter with these cards has to do with the length of time it takes to get an approval after a customer dips their card. The encrypted microchip data needs to be interpreted at the terminal, then transmitted to a bank for authorisation, then sent back to the terminal. It sounds simple, but there’s a lot more data to transmit compared to a typical mag stripe transaction because of the added layers of security.

Merchants here in New Zealand typically have a dial-up connection for their EFTPOS terminals. Every time a card transaction is processed, a modem in the terminal dials a phone number and sets up a connection, just like your home computer used to do to reach the Internet. The information is exchanged, and an authorisation received. But for the same reason you’ve upgraded your home Internet connection from dial-up to ADSL or broadband (speed!) these connections are also due for a round of upgrades.

You may recall that earlier this year, merchants in New Zealand were required to upgrade their payment terminals by 1 June to accept EMV cards. Most of these new terminals are broadband-capable, and have a connection port ready to be used. All merchants need to do is setup a broadband connection and plug in their terminals, two steps easily accomplished by contacting their terminal provider.

Broadband connections can carry a larger quantity of data more quickly, alleviating the delays many businesses are experiencing. I’d encourage all businesses to take the next step and activate their connections today.

Have you experienced slower transactions with chip-and-PIN cards? Let us know in the comments.

Staff grows more than 15 percent, spurred by Technology Development Grant

Mako Networks has hired five additional employees to further bolster its research and development programme and customer support. The hires follow a $4.3 million Technology Development Grant from the Ministry of Science and Innovation awarded earlier this year to accelerate Mako’s R&D programme.

The new hires include:

• Tina Bartels, User Experience Manager
• Robert James, Junior Software Developer
• Alan Yang, Junior Software Developer
• Andrew Wood, Testing Manager
• Bobby Sadaram, Customer Support Specialist

Mako Networks has hired Tina Bartels in a new position as User Experience Manager, tasked to streamline Mako’s Central Management System user interface, and further the company’s user-focused design philosophy. In addition, Bartels will be responsible for Mako Networks’ website design and maintaining consistency across the two platforms.

Tina joins Mako after a period working as an independent user experience consultant. In prior roles, she worked for Localist and the North Shore City Council, where as Digital Channel Manager she led her team to five awards in the 2010 Association of Local Government Information Management (ALGIM) Web Awards, including Best Redeveloped Website and Best New Feature Website.

Robert James joins Mako as a Junior Software Developer after graduating from the University of Auckland with a Bachelor of Engineering honours degree.

He recently completed an internship at Compac Sorting Equipment, developing a software application to mine data from system software backups. The position with Mako will be his first full-time professional role.

Joining Robert as a Junior Software Developer is Alan Yang, another recent graduate of the University of Auckland. With a Bachelor of Science degree in Computer Science and Information Systems, Yang’s other achievements include a summer research scholarship awarded by the university in 2009.

With 15 years of industry experience, Andrew Wood will take a new position with Mako Networks as Testing Manager. He most recently worked at Renaissance as an Innovation Manager, representing Palo Alto Networks and Allot Communications.

In prior roles, Andrew was a Product Program Manager with Endace, and contracted technical services to Alcatel-Lucent.

He holds two degrees from the University of Canterbury: a Bachelor of Science degree in physics, and a Bachelor of Engineering (Electrical and Electronic).

Rounding out the new hires is Bobby Sadaram, hired as a Customer Support Specialist. In New Zealand he has worked for CyberCom, while in India he was a Junior Systems Administrator for Inex Soft, which provides IT-based process control solutions for industrial applications.

Mako Networks Research and Development Director Murray Knox says:

“These new team members add significant depth to our R&D efforts, bringing a mix of deep industry experience and bright, new potential. This is a marked expansion for our company, and thanks to the Technology Development Grant, we believe it will yield a competitive advantage as we take on the global marketplace. We are actively seeking to further expand our team with additional hires in the year ahead.”

In August, Mako Networks helped events company Underbelly secure their payments system at the Edinburgh Fringe Festival, an annual month-long showcase of rising comedy talent. We traveled there to see how Underbelly used a faster and more reliable payment system over a broadband IP connection to improve the customer experience at the festival, while offering better security and relieving some of their PCI DSS compliance headaches.

While the Festival was a great time for those that attended, for those that couldn’t make it we’ve drafted a case study summarizing the work we did with Underbelly, available at the link below.

Case Study: Mako Networks Secures the Edinburgh Fringe Festival

Mako 6500 network appliance takes bronze at Best Awards

AUCKLAND, New Zealand – 11 October 2011 – Mako Networks, a cloud-based network management company specialising in solutions for small businesses and branch offices, received a bronze award for product design at The Best Design Awards on Friday night for its Mako 6500 network appliance. An initiative of The Designers Institute of New Zealand, the Best Awards are an annual showcase of excellence in graphic, spatial, product and interactive design.

The Mako 6500 was designed in conjunction with Peter and David Haythornthwaite of creativelab Limited and includes several innovative features, such as tamper-proof casing that prevents unauthorised access, internal light tubes that carry LED signals to the unit face, and a heat sink integrated into the product casing that permits operation in poorly ventilated installation locations.

Mako 6500 Network Appliance

But underpinning all design elements was a focus on security. The Mako 6500 was designed to protect small businesses from Internet threats and aid in compliance with the strict Payment Card Industry Data Security Standards (PCI DSS) for businesses that process, store or transmit credit card data. Mako Networks holds the sole Level 1 PCI DSS network management system accreditation worldwide.

“The design of the 6500, through its simple form and use of materials, deliberately communicates security. The product design had to address demanding technical criteria and to take into consideration installation, service and end user requirements. This project was the first ground-up, new product development by Mako and served to demonstrate the potential of effective design process and the capability of sound design solutions to communicate company values and product benefits,” says Peter Haythornthwaite of creativelab.

Says Murray Knox, Research & Development Director for Mako Networks: “The Mako 6500 has been a paradigm shift in the design of our products, and we will continue to incorporate its emphasis on secure simplicity into our future products. The 6500 has set the baseline for future innovation in the company.”

Adds Mako Networks CEO Bill Farmer: “The introduction of the 6500 as a fit-for-purpose yet stylish delivery platform has enhanced the company’s credibility internationally with both existing and prospective customers. The inclusion of specific tamper-proof elements in the design has further enhanced this position by reinforcing the company’s commitment to security requirements above and beyond that of our competitors.”

High-resolution photos of the Mako 6500 are available on the Mako Networks Flickr stream.

Mitch Evans at Spa-Francorchamps, Belgium. Photo credit: Ben Auld

Mako Networks is a proud sponsor of young Kiwi racecar driver Mitch Evans. Competing in the GP3 Series for MW Arden, Evans represents the classic New Zealand succes story of an exceptional young talent taking on the world. With his tremendous abilities and quick rise to international success, we feel his story closely aligns with that of the Mako Networks team.

Follow Mitch’s success at his website or on Twitter throughout the season.

Good luck Mitch!

Photo credit: Ben Auld