Chip & PIN terminal playing Tetris

Fearful Bank Customer writes "When British banks introduced the Chip-and-Pin smartcard-based debit and credit card system three years ago, they assured the public it was impervious to fraud. However, the EMV protocol it's based on requires customers to type their bank account pin number into store terminals in order to make any purchase. Security researchers at the University of Cambridge Computer Laboratory derided the system as insecure at the time, as it gave access to customer's bank account pin numbers to every store they bought from. Despite these objections, the system was deployed, so researchers Steven Murdoch and Saar Drimer recently modified a straight-off-e-bay chip-and-pin terminal to play Tetris, with a video on YouTube, demonstrating that devices are neither tamper-resistant nor tamper-evident, and that even students with a spare weekend can take control of them. The banks are claiming that this can be reproduced only "in the laboratory" but seem to have missed the point: if customers have to type their bank account pin into every device they see, then the bad guys can capture both critical card information *and* the pin number for the bank account, leaving customers even more vulnerable than they were under the old system."

Comments

Card and PIN security

[swillden]

The potential security problem here is caused by the use of the same PIN for two purposes. You know how you should never use the same password for multiple security-critical systems? Well, that's exactly what some of the UK banks did.

See, EMV security is designed around the assumption that only the card and cardholder know the card PIN. The bank doesn't know it. The merchant terminals see it, but it has no value without the card. In particular, it should be of no use with the bank machine/ATM network.

How then, do you use a bank machine? Well, ideally, you insert your card, enter your PIN to unlock the card, and then the card performs a cryptographic authentication with the bank over the ATM network to identify and authenticate you so you can proceed to perform your transaction. But that requires the ATMs and network to be updated to support the chip card and to use the new authentication protocol.

The other method, of course, is just to use an account number and a PIN, just as you always have, but that PIN *must* be known by the bank's systems, which leads to the banks' dilemma when deploying the system. Their options were:

1. Make customers remember two PINs for the same account, a card PIN and a "bank machine PIN". This is good for security, but bad for customer acceptance.
2. Upgrade the ATMs and network to do the card-based cryptograhic authentication. Good for security, but, in the short term very bad for customer acceptance, because it means that the cards can't be used with non-UK ATMs that don't implement the new technology.
3. Use a "shared" PIN, ensuring that every time a cardholder changes either the card PIN or the bank PIN, the other gets updated to match. This is called "PIN synchronization" and is actually not all that cheap to do either, but it's the only option that means customers only have to remember one PIN and can use their card in ATMs around the world. It's bad for security, though.

So, the banks mostly took option 3. I think some of them allow customers to request that their card and ATM PINs be "decoupled".

In theory, this means a malicious merchant can modify their PIN pad to capture the PINs and account numbers, and can then use the information to drain the accounts through the ATM network. In practice, this form of fraud hasn't happened, and it would be fairly easy to track unless the fraudster didn't steal very much -- a pattern of fraud on accounts whose cards have all been used at a particular merchant would be pretty easy to detect.

It could happen, of course, and probably will someday. If it becomes sufficiently serious, then maybe banks will have to abandon PIN synchronization. Hopefully, by then the rest of the world will have caught up and the ATM PIN can be discarded entirely.

Re:Card and PIN security

[rapiddescent]

actually, with regard to point 3 above:

EMV cards have two data items for the PIN usually called online PIN and offline PIN but pretty much all banks have the same value for each.

The key worry about this 'attack' is that the electronics could be changed easily:

• get the mag strip by asking the customer to swipe

• gets the PIN value

• completes the transaction using the EMV chip

• stores the mag stripe and PIN value

• reuse the card in an ATM/Store that does not require chip

This fraud has already been perpetrated at a Shell garage in the UK when a bloke in overalls came into the Shell store to say he was the engineer to check the Chip n PIN device. The Trintech unit had a fault so that it would not self destruct when opened and a simple memory chip was added to the device. The bloke in overalls went back a few weeks later to 'check everything was OK' and took back the memory chip and had the card details and PINs - resultant fraud loss was GBP 1m; although not sure how much was recovered.

I'm very wary of Tesco stores (UK) that swipe the mag stripe before inserting the card into a chip reader then ask the customer for the PIN - they effectively have the strip and the PIN which is enough to make a new card. The problem is that the chip cards have the legacy mag stripe to work in foreign ATMs and non-chip compliant stores.

The way things are going with APACS CAP - punters will be inserting their PIN into any old keypad, so it'll be getting worse before it gets better.

rd

Debit Cards

[Lodragandraoidh]

In the US we have debit cards that operate as both an ATM card, and equivalent to a credit card - only drawing the cash from the bank account instead of a line of credit.

So - the only time I have to enter my pin number is at the ATM. For all other purchases I use it like a credit card (and save the ATM surcharge as well).

I wrote Tesco's system you should all listen to me

[Nursie]

Sorry for the pompous post heading, but the first part is true, I wrote a large part of Tesco's system including about half of the EMV processing component. It's a customised version of what was the world's first integrated EMV system (ie card reader + PC + store level auth servers + central connection to VISAnet, LINK etc).

Whether you should listen to me or not is another matter.

The chip controls the transaction. That's how it goes. The chip decides if it can trust the terminal or the bank based on cryptographic signing operations. The terminal is verified by a process in which it concatenates various pieces of data, performs a crypto op on them and presents the result to the card. The card compares this to its own result (depending on the card it either has one precalculated and uses the same one each time (low security) or does the same calculation itself on a set of data including some session data (better security)).
PIN is encrypted as soon as it is entered and should never leave the device it's entered on in plaintext form, it is presented to the card as a cryptogram for validation.
When a transactioon is presented to the bank for authorisation it is presented with yet another cryptogram so that the bank can validate the card. The response also comes in the form of a cryptogram so that the card can validate the bank.

However, I'll agree, all this is pretty useless if someone can get inside the terminal and intercept the PIN at hardware level. Other than that and the looking-over-shoulder social security hole problem, EMV's pretty bullet proof. Your PIN doesn't ever even get to the PC that's running the transaction.

If you want to know more then the actual standards are available at EMVco, but they're the nearest thing to legalese I've ever encountered as a software Dev. I'm out of the payments game now, but my knowledge should still be pretty relevant, I hope.