Slashdot Mirror
Chip and Pin "Weakness" Exposed By Cambridge Researchers
another random user writes "A vulnerability in the widely used chip and pin payment system has been exposed by Cambridge University researchers. Cards were found to be open to a form of cloning, despite past assurances from banks that chip and pin could not be compromised. In a statement given to the BBC, a spokeswoman for the UK's Financial Fraud Action group said: 'We've never claimed that chip and pin is 100% secure and the industry has successfully adopted a multi-layered approach to detecting any newly-identified types of fraud.'"
Lots of these systems use proprietary protocols and have pushed out 3rd party verification by researchers. the random number being generated by time? Any serious security auditor would have caught that if the banks allowed them in, one of the golden rules of cryptography is to have a proper random number generator. The contact-less systems in the US came under similar fire this past year, after years of assurances by card issuers that it couldn't happen. http://www.forbes.com/sites/andygreenberg/2012/01/30/hackers-demo-shows-how-easily-credit-cards-can-be-read-through-clothes-and-wallets/
The man who cannot imagine a horse galloping on a tomato is an idiot - Andre Breton
All the locks in the world won't keep crooks out of your house if you don't use the locks. Your house may LOOK invulnerable, but one day sonbody's gonna try the door, find it open, and steal you blind.
The same principle applies here - using obvious and predictable 'random' code generation, and relying on people not knowing that's what you're doing, only works for so long.
And arrogant people, (and companies, and banks), who crow about how secure their systems are, are just asking for it. Serves the fuckers right; but it's too bad that credit card holders are paying the price for their creditors' arrogance.
'The Economy' is a giant Ponzi scheme whose most pitiable suckers are the youngest among us and the yet-unborn.
In the US, a simple magnetic stripe is used to encode the data, which can be duplicated with little effort. Even if your credit card is swiped at a brick and mortar retailer, this well-known vulnerability gives consumers some credibility against the credit card issuer when they claim to have not made the purchase. The scary part of this chip and pin vulnerability is that banks have a history of blaming the consumer and not issuing refunds since chip and pin was presumed to be secure. From the article, "Others [banks] reported already being suspicious of the strength of unpredictable numbers... If those assertions are true, it is further evidence that banks systematically suppress information about known vulnerabilities, with the result that fraud victims continue to be denied refunds."
Canadian banks just snuck in an update to the banking agreements--customer is now 100%responsible for losses with chip and pin cards, no doubt due to the ironclad security.
The problem with the claim Chip & Pin is more secure, is that the card processors (Visa, Mastercard) used it as a justification to shift liability from the Bank over to the Merchant.
With swiped transactions, when a customer disputes the transaction, the Merchant isn't automatically liable for the transation -- they only need to prove the customer actually made the purchase (e.g. producing the signed receipt). With Chip & Pin, the merchant is automatically assumed to be liable, according to the merchant agreement. There's very little a merchant can do to dispute the chargeback.
European Credit and Debit Card Security Broken
http://news.slashdot.org/story/10/02/11/2129212/european-credit-and-debit-card-security-broken
I like how they highlight "weakness" in the headline, giving it the appearance of being of poor credibility. Can I try?
BBC is a "news" provider.
Fraud is overhead that needs to be paid for regardless of who is left holding the empty bag at the end, and that overhead will always end up being reflected in the retail prices.
So who better to be left holding the empty bag than the party that has direct control over retail prices, and even some control over who he does business with?
"His name was James Damore."
In my storefront if a card holder chips a card and types their pin, there is no way they can charge back.
That sounds incorrect to me, since (at least under UK law) there are various reasons why a credit card transaction may be subject to a chargeback even if it was a legitimate transaction at the time.
In an online transaction does "verified by visa" / "mastercard securcode" not effectively provide you as a merchant the same protections?
3Dsecure is, frankly, a joke and does nothing to increase security (in fact it actually decreases security). It was introduced as yet another way of pushing the liability away from the bank rather than actually being secure.
Unfortunately, my experience with banks is that, when it comes to digital security, they have no clue and are only interested in security theatre, even in situations where well thought out real security would actually be easier for everyone than the security theatre they invent instead.
http://blog.nexusuk.org
Verified by VISA? I've seen that one. Whenever I have to buy something online, I need to enter an extra code in addition to the card number, expirary date and CCV. It seems quite pointless to me, because I have to enter them all at once - which means I store them all in the same place, and anyone who has compromised my system can key-log the whole lot at once. The only time it'll add any security is in stopping someone who stole the card from using it to buy things online, and if that was their goal it would be easier to just take the CCV number off the card. Plus, using VBV is optional for the merchant, so it just ensures the frauster would shop with some company that doesn't require it.
Folks, I read the paper by Omar and Co in a fair amount of detail. Here is the gist. Some ATMs do not have a true RNG (Random Number Generator), something like FIPS 140.2 compliant. With such defective systems in a particular country, at a particular time and for a particular amount and a system which can do a transaction at mS granularity accuracy an attack is possible. And the card has to be in the system (which is recording) for a longer time than it is for a typical transaction. That is a very NARROW vulnerability (not that it is justified ...). The paper clearly says on a large set of ATMs they could NOT decipher the "algo" for the UN generation. This is a exploitation of a very very corner case.
The paper also clearly says that EMVCo HAS ALREADY published rigorous tests to test the randomness of UN generation (before this paper was published).
So the title here, in the BBC website and some of the comments are way off. (understand that BBC and /. have to have readership ...) Couple of additional comments, EMV cards are unclonable (so are the SIM cards used in phones which use similar technology), the standards are open (you can download the standards for free from the emvco website) and there are plenty of fraud detection algos running on issuer servers to detect suspicious transactions. The paper in the second page unambiguously states that AFTER the introduction of EMV cards "card-not-present" transaction fraud went up, precisely because EMV cards are secure.
There will be always studies like this which exposes flaws (this particular one was an extremely corner case) which generally strengthen the current systems. I have followed the research coming out of cambridge on related topics (have exchanged notes with some of them), they are fine researchers and if you read the paper, you will see that they are NOT saying EMV is insecure but are identifying corner cases and defective implementations.
Cheers,
-Bhaktha
Re-read your chip & PIN liability statements. Chargebacks with chip & PIN are very difficult to do and weighed heavily against the cardholder.
By default, if a transaction is conducted via chip & PIN, the consumer is liable for all charges. The use of a PIN constitutes, in the eye of the bank, de-facto shift of liability for the transaction. In the event of a dispute, it is up to THE CONSUMER to provide evidince that he / she did not perform the transaction. This is a marked shift from the old magstripe / signature liability, where it was up to the merchant to prove that it was you making the purchase in a dispute. Now, it is up to the consumer to prove it WASN'T you - good luck with that!
I am glad people are finally waking up to this because I avoided chip & PIN as long as possible due to this, but it is being rammed down our throats, along with this liability shift, and no one is noticing.
That's right, this is at least the second independent way Chip & Pin has been found to be broken. The banks claim to have multiple layers of security, but what they actually have are multiple breaches of security.