Slashdot Mirror
Researchers Expose New Credit Card Fraud Risk
An anonymous reader writes "Researchers from the University of Cambridge have discovered flaws in the card payment systems used by millions of customers worldwide. Ross Anderson, Saar Drimer, and Steven Murdoch demonstrated how a simple paper clip can be used to capture account numbers and PINs from so-called 'tamper-proof' equipment. In their paper (PDF), they warn how with a little technical skill and off-the-shelf electronics, fraudsters could empty customers' accounts. British television featured a demonstration of the attack on BBC Newsnight."
This reminds me of a quote (the source eludes me at the moment):
"If it can be engineered by one human, it can be reverse-engineered by another human."
Living With a Nerd
Which is not a problem if you use virtual account numbers (what Citibank calls it. I'm sure other banks have the same thing with different names) that are only authorized for one transaction for the amount you specify.
Can you be Even More Awesome?!
What people are missing in this is that this pertains to certain card types mainly used in Europe. The type with RFID or embedded chips used for security. On standard US debit cards, there is no information sent to the card or from the card that ties to the PIN. The PIN is only seen by the pinpad component and immediately encrypted using a rotating DKPUT key algorithm before that, the card number and a sequence number are sent to be translated by a hardware security module. The pin pads themselves used by most US retailers are secure and do not pose a risk. If you tamper with most of those devices (example, the Welch Allyns used by best buy, lowe's and others) then the injected keys are erased and PIN translation fails. They normally don't remain out too long if they are tampered with since the stores will consider them broken and unusable when they don't work anymore. This is related to the system in place and used in the UK. The US system, while old, is only being updated currently to support the new double length key requirements and have not incorporated smart card support or RFID (except a few gas station chains). The most important thing in the US is to protect the card database since the data on the mag stripe can be used as a credit card. As for PIN security, don't tell others your pin, notice hidden cameras that look out of place and point at PIN pads and you should be safe. The way PIN numbers are stored at banks within a hardware security module is safe and those devices are very sensative to outside attack. They even employ motion sensors to prevent tampering in HSMs.
That's because the banks don't eat the cost of fraud, the merchants do. If I have an online store and someon uses a stolen card to buy something from me, I'm the one that gets screwed. The credit card companies reverse the charge, AND charge the merchant a fee for it happening. Then the merchant is out the money, a fee, AND the product they shipped to a thief. The lamest part is the credit card companies don't even provide you the tools to prove that a transaction is legitimate.
The problem is not missing encryption between the merchant and bank, the problem is with missing encryption between the merchant and the card reader/pin entering pad. The same readers/pads are still unencrypted, even though the merchant may be encrypting the data for the transaction to/from the bank.
It's like entering your credit card information on a website for a purchase. The connection to the server may be encrypted, but the data sent from your keyboard to your pc is not, and this is the same as where the hack with the card readers/pads is occurring.
In the case of university tuition, whether he can get a debit card or not is irrelevant. Legal U.S. tender must be accepted by a creditor (the University) from the debtor (the student) to pay off a debt within the U.S. If the University required payment before it allowed the student to register for classes, then the University could require payment by credit card. However since the University extended credit to the student for the classes, it is required to accept legal tender as payment for those classes.
See http://en.wikipedia.org/wiki/Legal_tender.