E commerce Security and Payment System

Ecommerce security environment:

E-commerce security is multi-layered, and must take into account new technology, policies and
procedures, and laws and industry standards. The diagram has Data in center. There are four concentric
ovals. From the inner-most oval to the outer-most one, the ovals are labeled as follows, Technology
Solutions, Organizational Policies and Procedures, and Laws and Industry Standards.

There are also other factors of security environment.

– Time value of money

– Cost of security vs potential loss

– Security often breaks at weakest link

Different Dimensions of ecommerce security (Customers and Merchant Perspective)

Example of nonrepudiation:

For merchant’s perspective, customer may deny that he has ordered product. Customer may also deny
that he has received the product.

For customer’s perspective the company may not fulfil the promised quality requirement. Or the
organization may claim that they did not receive money.

Vulnerability of an ecommerce environment:

Three key points of vulnerability in e-commerce environment:

– Client (Customers)

– Server (Merchant or retailer maintain the server)

 – Communications pipeline (Internet communications channels)

Hackers can hack from these 3 parts.

A Typical Ecommerce Transaction system:

In a typical e-commerce transaction, the customer uses a credit card and the existing credit payment
system.

The flow diagram depicts a typical e-commerce transaction. The steps involved in the transaction are as
follows. An Online consumer contacts an Online store through an Internet service provider. The online
store uses a Merchant website and Merchant web server which connects with a Database server which
connects with a Warehouse. The Customer credit card bank transacts with the Merchant bank through
the Merchant website and Merchant Web servers. All of the above transactions and connections are
two-way. Last, the Warehouse uses a Shipping service to ship the product to the Online consumer.

Vulnerable Points of an ecommerce Transaction:

There are three major vulnerable points in e-commerce transactions: Internet communications, servers,
and clients.

Vulnerable points in the process include web beacons (By using web beacon, third party can monitor the
activity of the users) in the Online consumer’s system, Wi-Fi listening wiretaps in the connection
between the consumer and Internet service provider, Customer list hacks in the online store’s system,
SQL injection attacks on the database server, DOS attacks, card theft, or hacking at the customer credit
card bank’s end, and security breaches at the point where the Customer credit card bank, Merchant
bank, and the Merchant web servers and Merchant website connect, and when the order is shipped to
the Online consumer.

SQL Injection:

SQL injection is a code injection technique that might destroy your database. SQL injection is one of the
most common web hacking techniques. SQL injection usually occurs when you ask a user for input, like
their username/user id, and instead of a name/id, the user gives you an SQL statement that you will
unknowingly run on your database.

Malicious Code:

Exploits and exploit kits

An exploit is an object - such as a piece of code or string of commands- that takes advantage of a
vulnerability in a program to force it to behave unexpectedly.

An exploit kit is a tool used for automatically managing and deploying exploits against a target
computer. Exploit kits allow attackers to deliver malware without having advanced knowledge of the
exploits being used.
Malvertising:

Malvertising — or malicious advertising — is a relatively new cyberattack technique that injects
malicious code within digital ads. Difficult to detect by both internet users and publishers, these infected
ads are usually served to consumers through legitimate advertising networks.

Drive by downloads:

A drive-by download refers to the unintentional download of a virus or malicious software (malware)
onto your computer or mobile device. A drive-by download will usually take advantage of (or “exploit”)
a browser, app, or operating system that is out of date and has a security flaw.

Viruses:

Attach itself to a host (often a program) and replicate itself

Worms:

Self-replicating malware that does not require a host program

Ransomware

Holds a computer system, or the data it contains, hostage against its user by demanding a ransom.

 Disable an essential system service or lock the display at system startup

 Encrypt some of the user's personal files, originally referred to as cryptoviruses,

cryptotrojans or cryptoworms

Trozan Horse:

Software that appears to perform a desirable function for the user prior to run or install, but (perhaps in
addition to the expected function) steals information or harms the system

Backdoors:

Secret entry point into a system

Bots, botnets

The term botnet is actually short for “robot network”, which refers to a group of robot devices
(computers, mobile phones, IoT devices) that are now under the control of an attacking party. Typically
the devices in a botnet have been infected by malware, and the attacker controlling the botnet is called
a “bot herder”.

The devices under the control of a bot herder are called “zombie” devices, although sometimes they are
also called “bot devices” or just “bots

Botnet attack may contribute to various attacks like DDos attack, Spam attack, Data Breach, Monitoring,
Spreading the Botnet
Phishing:

• Any deceptive, online attempt by a third party to obtain confidential information for financial
gain

• Tactics

– Social engineering

– E-mail scams and B E C phishing

– Spear phishing

• Used for identity fraud and theft

Phishing attack is a social engineering attack involving trickery. It is mainly designed to gain access to
systems or steal data.

For example developing a webpage which looks like a home page of facebook and then share the link
through email or sms and ask the recipient to click on the link. When the recipients click on the link and
share his user name or password then his security information can be obtained by them.

Clicking on link in phishing email also downloads malware which makes the computer slower. Collecting
Bkash pin through phn call or sms is also a part of phishing.

Hackers:

Hacking refers to activities that seek to compromise digital devices, such as computers, smartphones,
tablets, and even entire networks. Hackers are motivated by personal gain, to make a statement, or just
because they can.
Hackers vs Crackers:
The black hat hacker is mainly a cracker who have no legal access to system and steal information for
their personal gain using illegal tools.

Different Types of Hackers:

White Hat Hackers

White hat hackers are types of hackers who’re professionals with expertise in cybersecurity. They are
authorized or certified to hack the systems. These White Hat Hackers work for governments or
organizations by getting into the system. They hack the system from the loopholes in the cybersecurity
of the organization. This hacking is done to test the level of cybersecurity in their organization. By doing
so, they identify the weak points and fix them to avoid attacks from external sources. White hat hackers
work per the rules and regulations the government sets. White hat hackers are also known as ethical
hackers.

Black Hat Hackers

Black hat hackers are also knowledgeable computer experts but with the wrong intention. They attack
other systems to get access to systems where they do not have authorized entry. On gaining entry they
might steal the data or destroy the system. The hacking practices these types of hackers use depend on
the individual’s hacking capacity and knowledge. As the intentions of the hacker make the hacker a
criminal. The malicious action intent of the individual cannot be gauged either can the extent of the
breach while hacking.

Grey Hat Hacker

The intention behind the hacking is considered while categorizing the hacker. The Gray hat hacker falls
between the black and white hat hackers. They are not certified, hackers. These types of hackers work
with either good or bad intentions. The hacking might be for their gain. The intention behind hacking
decides the type of hacker. If the intention is for personal gain, the hacker is considered a gray hat
hacker.

The difference is, they don’t want to rob people nor want to help people in particular. Rather, they enjoy
experimenting with systems to find loopholes, crack defenses, and generally find a fun hacking
experience.

Tiger Teams:
In security work, a tiger team is a group that tests an organization's ability to protect its assets by
attempting to defeat its physical or information security. In this context, the tiger team is often a
permanent team as security is typically an ongoing priority

Cybervandalism:
Destructive cyberattacks without any obvious profit or ideological motive. Cyber vandals can deface
websites, disrupt a company's services, or delete databases.

Hacktivism:
Hacktivism occurs when political or social activists use computer technology to make a statement
supporting one of their causes.
Hacktivists' methods may include data theft, distributed denial of service (DDoS) attacks, website
defacement, or the use of social media to spread awareness about a cause.
DOS and DDOS attack:

A denial-of-service (DoS) attack is a tactic for overloading a machine or network to make it unavailable.
Attackers achieve this by sending more traffic than the target can handle, causing it to fail—making it
unable to provide service to its normal users.

Examples of targets might include email, online banking, websites, or any other service relying on a
targeted network or computer.

– Flooding website with pings and page request

– Overwhelm and can shut down site’s web servers

– Often accompanied by blackmail attempts

DDOS attack:

A distributed denial-of-service (DDoS) is a type of DoS attack where the traffic used to overwhelm the
target is coming from many distributed sources. This method means the attack can't be stopped just by
blocking the source of traffic.

Botnets are often employed for DDoS attacks.

– Uses hundreds or thousands of computers to attack target network

– Can use devices from Internet of Things, mobile devices

DDoS smokescreening

DDoS attacks are the worst nightmare for an IT team. The sudden flood of internet traffic that they bring
can bring a system tumbling down. Even more so if your business primarily deals online – it could
absolutely cripple a business, potentially even putting you out of business.

But DDoS attacks could also be used to disguise data theft, as happened with Carephone Warehouse
two years ago. Hackers conducted an attack on Carphone Warehouse’s websites (including
onephoneshop.com and mobiles.co.uk) with junk traffic as a smokescreen, before breaking into systems
and stealing the personal details of 2.4m customers. In addition, up to 90,000 subscribers may have had
their card details stolen.
SQL Injection attack:

SQL injection (SQLi) is a cyberattack that injects malicious SQL code into an application,
allowing the attacker to view or modify a database. 
SQL injection usually occurs when you ask a user for input, like their username/userid, and
instead of a name/id, the user gives you an SQL statement that you will unknowingly run on
your database.

Zero Day vulnerability:

A zero-day vulnerability is an undiscovered flaw in an application or operating system, a gap in

security for which there is no defense or patch because the software maker does not know it
exists
Examples of some vulnerabilities are Heartbleed bug; Shellshock (BashBug); FREAK

Mobile Platform Security Issues

• Little public awareness of mobile device vulnerabilities

• 2017: Over 26,500 different mobile malware variants identified by Symantec

Vishing:

Vishing, also known as voice phishing, is a cybercrime whereby attackers use the phone to steal personal
information from their targets. In a vishing attack, cybercriminals use social engineering tactics to
persuade victims to provide personal information, typically with the goal of accessing financial accounts.

For example, in Bangladesh, some criminals try to steal pin code of Bkash account by pretending to be
an authorized employee of Bkash.
Smishing:

Smishing -- or SMS (Short Message Service) phishing -- is a social engineering tactic cybercriminals use to
trick people into divulging sensitive information over text messages.

It uses short message or common messaging apps, like Slack.

SMS Spoofing:

SMS spoofing occurs when a hacker sends an SMS message from an unrecognizable number. The
message may appear to be from someone you know, or it could come from a company or organization
you trust. These attacks aim to trick you into replying or clicking on a link that will download malware
onto your phone or computer.

It is a technology which uses the SMS, available on most mobile phones and PDA, to set who the
message appears to come from by replacing the originating mobile number (Sender ID) with
alphanumeric text. Spoofing has both legitimate uses (setting the company name from which the
message is being sent, setting your own mobile number, or a product name) and illegitimate uses (such
as impersonating another person, company and product).

Madware:

Madware is aggressive advertising on mobile devices, particularly tablets and smartphones.

It is a combination of the words mobile and adware. Adware is unwelcome software that infiltrates a
computer and serves up annoying advertising materials. By extension, mobile adware is intrusive
advertising on a smartphone or tablet.
Solutions:

Tools available to achieve ecommerce security:

There are a number of tools available to achieve e-commerce security.

The diagram depicts the different tools available to achieve e-commerce security. The diagram shows
Security Management in the center and the following points surrounding it. Firewalls, Encryption,
Network Security Protocols, Virtual Private Networks, Authentication Procedures, Proxy Servers, Anti-
Virus Software, Automated Software Updates, Intrusion Detection and Prevention.

Encryption:

Symmetric Key Cryptography:

Encryption is a process to change the form of any message in order to protect it from reading by anyone.
In Symmetric-key encryption the message is encrypted by using a key and the same key is used to
decrypt the message which makes it easy to use but less secure. It also requires a safe method to
transfer the key from one party to another

• Requires different set of keys for each transaction

• Strength of encryption: Length of binary key

• Data Encryption Standard (DES)

• Advanced Encryption Standard (AES)

• Other standards use keys with up to 2,048 bits

Public Key/Asymmetric Key Cryptography:

Asymmetric Key Encryption is based on public and private key encryption
techniques. It uses two different key to encrypt and decrypt the message. It is
more secure than the symmetric key encryption technique but is much slower.

Uses two mathematically related digital keys

– Public key (widely disseminated)

– Private key (kept secret by owner)

• Both keys used to encrypt and decrypt message

• Once key used to encrypt message, same key cannot be used to decrypt message

• Sender uses recipient’s public key to encrypt message; recipient uses private key to decrypt it

In the simplest use of public key cryptography, the sender encrypts a message using the recipient’s
public key, and then sends it over the Internet. The only person who can decrypt this message is the
recipient, using his or her private key. However, this simple case does not ensure integrity or an
authentic message.

The image illustrates a simple use of public key cryptography and the important steps in using public and
private keys. The steps are as follows. First, the sender creates an original digital message, to buy X Y Z
at the rate of 100 dollars. Second, the sender obtains the recipient’s public key and applies it to the
message. Third, this message gets encrypted in cipher text, depicted as 1 0 1 0 1 1 0 1 1 1 0 0 0 1. Fourth,
the message is sent over the Internet. And fifth, the message is received by the recipient, who uses his
or her private key to decrypt the message..
Public Key Cryptography Using Digital Signatures and Hash Digests

• Sender applies a mathematical algorithm (hash function) to a message and then encrypts the
message and hash result with recipient’s public key

• Sender then encrypts the message and hash result with sender’s private key-creating digital
signature-for authenticity, nonrepudiation

• Recipient first uses sender’s public key to authenticate message and then the recipient’s private
key to decrypt the hash result and message

A more realistic use of public key cryptography uses hash functions and digital signatures to both ensure
the confidentiality of the message and authenticate the sender. The only person who could have sent
the above message is the owner or the sender using his/her private key. This authenticates the message.
The hash function ensures the message was not altered in transit. As before, the only person who can
decipher the message is the recipient, using his/her private key.

The image illustrates the steps of public key cryptography with digital signatures. The steps are as
follows. First, the sender creates an original digital message, to buy X Y Z at the rate of 52 dollars.
Second, the sender applies a hash function, which produces a hash digest. Third, the sender encrypts the
message and has digest using the recipient's public key. Fourth, the sender encrypts the result, using the
sender's private key, or digital signature. Fifth, the message, now in the form of double-encrypted
signed cipher text is sent via the Internet. Sixth, the message then reaches the receiver, who uses the
sender's public key to get authenticated cipher text. Seventh, the receiver then uses his or her private
key to decrypt the hash function and original message.

Digital Envelope:

• A digital envelope is a secure electronic data container that is used to protect a message
through encryption and data authentication.
 • Address weaknesses of:

– Public key cryptography

▪ Computationally slow, decreased transmission speed, increased processing time

– Symmetric key cryptography

▪ Insecure transmission lines

• Uses symmetric key cryptography to encrypt document

• Uses public key cryptography to encrypt and send symmetric key

A digital envelope can be created to transmit a symmetric key that will permit the recipient to decrypt
the message and be assured the message was not intercepted in transit.

THe flow diagram depicts the steps involved in creating a digital envelope in case of public key
cryptography. The flow diagram depicts the following steps. 1. The sender creates the original message,
Diplomatic Report. 2. It is encrypted using a symmetric session key. 3. The symmetric session key is
encrypted using the recipient’s public key. 4. These form a digital envelope, which is sent over the
Internet as a message encrypted in cipher text. 5. The message is then decrypted using the recipient’s
private key and the symmetric session key. And 6. The message, Diplomatic Report, reaches the
receiver.

Digital certificate:

It includes:

– Name of subject/company

– Subject’s public key

– Digital certificate serial number

 – Expiration date, issuance date

– Digital signature of CA

Public Key Infrastructure (PKI)

It includes

– CAs and digital certificate procedures

– PGP

CA and digital certificate procedures:

A certificate authority (CA) is a trusted entity that issues Secure Sockets Layer (SSL) certificates. These
digital certificates are data files used to cryptographically link an entity with a public key. Web browsers
use them to authenticate content sent from web servers, ensuring trust in content delivered online.

PGP:

PGP is short for Pretty Good Privacy, a security program that enables users to communicate securely by
decrypting and encrypting messages, authenticating messages through digital signatures, and encrypting
files. It was one of the first freely available forms of public-key cryptography software.

The PKI includes certification authorities that issue, verify, and guarantee digital certificates that are
used in e-commerce to assure the identity of transaction partners.
The process diagram illustrates digital certificates and certification authorities. The following steps are
shown in the diagram. 1. An Institution or Individual subject requests a certificate over the Internet from
a Certification Authority or C A. 2. The C A provides a certificate to the institution or individual subject. 3.
The institution or individual then shares the certificate with a Transaction partner, such as an online
merchant or customer. The certificate has the following data. Digital certificate serial number. Version.
Issuer name. Issuance slash expiration date. Subject name. Subject public key. C A signature. Other
information.
Certificates play a key role in using SSL/TLS to establish a secure communications channel.

The process diagram illustrates secure negotiated sessions using S S L and T L S. The following steps are
involved in the process. 1. Client browser requests a secure session with a merchant server via the
internet. 2. Merchant server grants the secure session. 3. Session I D and methods of encryption are
negotiated. 4. Client certificate and merchant certificate are exchanged. Identity of both parties is
established. 5. Client generates session key and uses server public key to create digital envelope. 6.
Digital envelope is sent to the server, which then decrypts it using a private key. 7. Encrypted
transmission using client-generated session key begins.

Firewall and Proxy Servers:

• Firewall

– Hardware or software that uses security policy to filter packets

▪ Packet filters

▪ Application gateways

– Next-generation firewalls

• Proxy servers (proxies)

– Software servers that handle all communications from or sent to the Internet

The primary function of a firewall is to deny access by remote client computers to local computers. The
primary purpose of a proxy server is to provide controlled access from local computers to remote
computers.

The set of flow diagrams illustrates how firewalls and proxy servers provide protection for networks. A
linear flow diagram for a firewall shows, from left to right, a laptop, desktop, and a mobile phone
connected to a firewall with two-way arrows. The firewall connects with a remote client on the Internet
through a web server. A remote server is present on the side of the remote client.
A linear flow diagram for proxy server shows, from left to right, a laptop, desktop, and a mobile phone
connected two-way with an internal network. The internal network is connected two-way with a proxy
server. The proxy server connects to a remote client on the Internet through an external network. A
remote server is present on the side of the remote client.

Intrusion Detection System

An Intrusion Detection System (IDS) is a system that monitors network traffic for suspicious activity and
issues alerts when such activity is discovered. It is a software application that scans a network or a
system for the harmful activity or policy breaching.

IDS functions:

 It detects DDos attack

 It helps meet regulatory compliance requirement
 It detects network vulnerabilities

Intrusion Prevention System:

An intrusion prevention system (IPS) is a network security tool (which can be a hardware device or
software) that continuously monitors a network for malicious activity and takes action to prevent it,
including reporting, blocking, or dropping it, when it does occur.
A Security Plan: Management Policies:

• Risk assessment

• Security policy

• Implementation plan

– Security organization

– Access controls

– Authentication procedures, including biometrics

 – Authorization policies, authorization management systems

• Security audit

There are five steps involved in building an e-commerce security plan.

The circular diagram lists the steps involved in developing an e-commerce security plan. The steps are
listed as follows. 1. Perform a risk assessment. 2. Develop a security policy. 3. Develop an
implementation plan. 4. Create a security organization. 5. Perform a security audit.

Ecommerce Payment System:

• In U.S., credit and debit cards are primary online payment methods

– Other countries have different systems

• Online credit card purchasing cycle

• Credit card e-commerce enablers

• Limitations of online credit card payment

– Security, merchant risk

– Cost

– Social equity
Online Credit Card system on the internet

The players of credit card system are

• Cardholder

• Merchant

• Card issuer

• Acquirer

• Card brand

Process of using credit card:

• Issue a credit card to a potential card holder

• The cardholder shows it to merchant whenever he or she purchases by credit card

• The merchant asks for approval from the brand company and once authorized transaction is
paid by credit and merchant keeps the sales slip

• Merchant sends the slip to acquiring bank for collection and pays a fee for the service

• The bank asks the brand to clear the credit amount

• The brand asks the issuer bank to clear the said amount

• The amount is transferred from the issuer to the brand

• The issuing bank send monthly statement to the card holder for the outstanding balance
The process diagram depicts how an online credit card transaction works. The process is as follows. 1.
Consumer makes purchase. 2. SSL or TLS provides secure connection through Internet to merchant
server. 3. Merchant software from the merchant server contacts clearinghouse through a secure line. 4.
Clearinghouse verifies account and balance with consumer’s card issuing bank. 5. The issuing bank
credits merchant account in the merchant bank. 6. All the above connections between the various
players are two-way. 7. The issuing bank issues a monthly statement with debit for purchase to the
consumer.
Blockchain:
 Blockchain is a decentralized and distributed digital ledger technology that enables
secure and transparent transactions and data storage. It is a system in which records,
called blocks, are linked together in a chronological and immutable manner.

Key characteristics of blockchain technology include:

1. Decentralization: Blockchain operates on a peer-to-peer network, where multiple

participants called nodes maintain and validate the integrity of the network. There is no
central authority controlling the entire system, making it resistant to single points of
failure and censorship.
2. Security: Transactions and data stored on a blockchain are secured using cryptographic
algorithms. Each block in the chain contains a unique cryptographic hash, linking it to
the previous block, ensuring tamper resistance and immutability.
1. Transparency: Blockchain provides transparency as all participants in the network can
view and validate the transactions stored on the blockchain. This transparency enhances
trust and accountability.
2. Consensus Mechanisms: Blockchain uses consensus mechanisms to agree on the state
of the ledger across all nodes. Popular consensus mechanisms include Proof of Work
(PoW), Proof of Stake (PoS), and Practical Byzantine Fault Tolerance (PBFT).

Applications of blockchain technology extend beyond cryptocurrencies like Bitcoin.

Some notable use cases include:

1. Supply Chain Management: Blockchain can provide transparency and traceability in

supply chains, enabling efficient tracking of products from their origin to the end
consumer.
2. Financial Services: Blockchain can revolutionize financial transactions, reducing
intermediaries, enhancing security, and enabling faster and cheaper cross-border
payments.
3. Healthcare: Blockchain can securely store and share medical records, enhance
data privacy, and enable interoperability between different healthcare systems.
4. Identity Management: Blockchain-based identity systems can provide individuals
with control over their personal data and enable secure and decentralized
identity verification.
5. Voting Systems: Blockchain can provide a transparent and tamper-resistant
platform for conducting secure and auditable elections.

How Blockchain works:

A blockchain system is a distributed database that records transactions in a P2P network of computers.

A process diagram shows six steps illustrating how blockchain works. 1. An order is submitted by a user
or customer. 2. To verify the user, the transaction is broadcast to a P2P network of computers. 3. The
transaction is validated by others in the network. 4. The block is added to the chain of transactions for
this user. 5. Production, Warehouse, Logistics add additional blocks. 6. The order is fulfilled.

Cryptocurrencies

• Use blockchain technology and cryptography to create a purely digital medium of exchange

• Bitcoin the most prominent example

– Value of Bitcoins have widely fluctuated

– Major issues with theft and fraud

– Some governments have banned Bitcoin, although it is gaining acceptance in the U.S.

• Other cryptocurrencies (altcoins) include Ethereum/Ether, Ripple, Litecoin and Monero

• Initial coin offerings (I C Os) being used by some startups to raise capital