Slashdot Mirror

← Back to Stories (view on slashdot.org)

Criminals Hacked Chip-and-PIN System By Perfecting Point-of-Sale Attack (net-security.org)

Posted by timothy on from the tab-a-slot-b-oops dept.

An anonymous reader writes: When in 2010 a team of computer scientists at Cambridge University demonstrated how the chip and PIN system used on many modern payment cards can be bypassed by making the POS system accept any PIN as valid, the reaction of the EMVCo and the UK Cards Association was to brand the attack as "improbable." After all, the researchers used a bulky tech setup that had to be carried around in a backpack but, as it ultimately turned out, a year later an engineer based in France found a less obvious way to perform the attack.

113 of 145 comments (clear)

  1. I didn't think of it means... by bobbied · · Score: 3, Insightful

    Improbable anybody would do it..

    --
    "File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
    1. Re:I didn't think of it means... by Capt.Albatross · · Score: 4, Insightful

      It is worse than that, because after they were shown that it could be done, they did nothing about it until this latest exploit threatened to make their failure general knowledge.

      Why is it that the stupidest people always seem to be the ones making the decisions in matters of security?

    2. Re:I didn't think of it means... by AES84 · · Score: 1

      Exactly.

    3. Re:I didn't think of it means... by AmiMoJo · · Score: 4, Interesting

      I'm wondering if they really fixed this kind of vulnerability too. If you read the paper it seems that that device they added to the card was not fully compliant with the spec, not by a long way. So the most obvious and quick mitigation is to test for something that it is not compliant in. Such a test could be quickly bypassed once discovered, and turn the whole thing in to a game of cat-and-mouse like the fake cable TV cards became.

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
    4. Re:I didn't think of it means... by fustakrakich · · Score: 4, Insightful

      Why is it that the stupidest people always seem to be the ones making the decisions in matters of security?

      Maybe you should ask their boss that question...

      --
      “He’s not deformed, he’s just drunk!”
    5. Re:I didn't think of it means... by TemporalBeing · · Score: 3, Insightful

      It is worse than that, because after they were shown that it could be done, they did nothing about it until this latest exploit threatened to make their failure general knowledge.

      Why is it that the stupidest people always seem to be the ones making the decisions in matters of security?

      Because everyone is stupid when it comes to security until something security related happens to them.

      --
      Truth is like the sun. You can shut it out for a time, but it ain't goin' away. - Elvis Presley (source: imdb.com)
    6. Re:I didn't think of it means... by Baron_Yam · · Score: 4, Insightful

      Because the frauds committed aren't even big enough to be a line item in their budget. Why invest in security now when you might not need to fix the problem for a budget year or two?

      It's a coldly calculated financial decision.

    7. Re:I didn't think of it means... by cayenne8 · · Score: 1

      I think I'll stick primarily with good old fashioned cash. It isn't as readily hacked, and is virtually untraceable to any company or govt wanting to know what I"m spending my $$ on.

      --
      Light travels faster than sound. This is why some people appear bright until you hear them speak.........
    8. Re:I didn't think of it means... by IamTheRealMike · · Score: 3, Informative

      Yes, it's fixed properly. From the paper:

      It is important to underline that, as we write these lines, the attack described in this paper is not applicable anymore, thanks
      to the activation of a new authentication mode (CDA, Combined Data Authentication) and network level protections acting as a second line of defense. Until the deployment of CDA, this fraud was stopped using network-level counter-measures and PoS software updates.

    9. Re: I didn't think of it means... by Anonymous Coward · · Score: 1

      You not wanting us to know is precisely why we need to know it. Just think of how many guns are bought untraceably with untraceable cash. Republicans want to keep cash around for that. Also it supports human trafficking.

    10. Re:I didn't think of it means... by Anonymous Coward · · Score: 2

      Not easily hacked: As long as your home is adequately protected from break-ins.

      Not easily tracked: Unless you spend more than $10k, in which case the purchase will be reported to the IRS.

      The worst part is that since a PIN hack puts liability for fraud on the cardholder (bank logic: PIN is unbreakable, so its the cardholders fault if it gets stolen) this ends up being bad for the consumer. That's why I'm OK with PIN/swipe & signature (bank logic: signatures are unreliable, so the bank writes off the odd case of fraud here and there).

    11. Re: I didn't think of it means... by Cyberax · · Score: 3, Funny

      Why would the govt need to know what guns I have or how many I have?

      To easily trace you once you turn into a mass-murderer.

    12. Re:I didn't think of it means... by swb · · Score: 1

      I think I'll stick primarily with good old fashioned cash. It isn't as readily hacked, and is virtually untraceable to any company or govt wanting to know what I"m spending my $$ on.

      It isn't readily hacked as long as your definition of "hacked" doesn't include counterfeiting or theft.

      It isn't traceable unless you start engaging in transaction in excess of the reporting limits or they decide to investigate you because you're avoiding the transaction limits.

    13. Re: I didn't think of it means... by cayenne8 · · Score: 1

      To easily trace you once you turn into a mass-murderer.

      Hmm....but doesn't do anything to prevent them.

      --
      Light travels faster than sound. This is why some people appear bright until you hear them speak.........
    14. Re: I didn't think of it means... by Cyberax · · Score: 1

      Countries with actual gun regulations have this little-known feature - ballistic fingerprinting. Every registered gun is required to get analyzed periodically, so its bullets are traceable. It's not foolproof, but it's fairly reliable if done correctly. Also, microstamping should be mandated for all guns.

    15. Re: I didn't think of it means... by Gr8Apes · · Score: 1

      I used to think so too, until I leaned this is very very easy to get around. Ballistic fingerprinting is only good for lightly used guns using the same untouched barrel.

      --
      The cesspool just got a check and balance.
    16. Re:I didn't think of it means... by TsuruchiBrian · · Score: 1

      This hack requires the criminal to physically steal your card. Once stolen, this hack allows the criminal to use your card even if he does not know the pin. Does your stolen cash require a pin number to use it? Unless you have some kind of magical money that can't be physically stolen, cash is actually easier to "hack" than these cards.

    17. Re:I didn't think of it means... by ewibble · · Score: 1

      While true, the you don't generally carry the same amount of cash as you do in your bank account or your available credit, that being said you can already use a credit card without a pin, order something online, or contactless payment.

      I think it is strange that the pin is simply not put in as part of the response, to the challenge response, I think it is strange the actual card says pin ok, as opposed to sending that information off to the bank to validate.

    18. Re:I didn't think of it means... by Capt.Albatross · · Score: 5, Informative

      because after they were shown that it could be done, they did nothing about it until this latest exploit threatened to make their failure general knowledge.

      Wrong. It was already fixed.

      If you want a good, detailed look at the story, read it on Ars:
      http://arstechnica.com/tech-po...

      The Ars article contains nothing to support your assertion. On the other hand, the Cambridge group that originally discovered the flaw behind the exploit report that the industry did nothing between being alerted to the problem and the publication of their paper. Instead, it attempted to dismiss the problem as impractical to exploit, even though the Cambridge group demonstrated a practical attack, presented good empirical evidence that it was being exploited in the wild, and proposed mitigating measures.

      One of the team members recently wrote "What we do know with confidence is that had the banks acted to close the vulnerability immediately after we notified them, these criminals would not have been able to commit this fraud."

      We have to take the industry's word for it that they have now fixed the problem, and our confidence in that claim should be weighted by its previous proclivity to dissemble. Perhaps they have just fixed the liability shift part of the problem.

      https://www.cl.cam.ac.uk/resea...
      https://www.benthamsgaze.org/2...

    19. Re:I didn't think of it means... by TsuruchiBrian · · Score: 1

      I think it is the laptop that says "pin ok" to the vendor, and the laptop says "vendor didn't ask for a pin" to the chip in the card. It's like a man in the middle attack.

    20. Re:I didn't think of it means... by idontgno · · Score: 2

      Yes. This is very precisely a MITM attack.

      Why is the card response so pitifully simple? It should have been cryptographically signed with a private key embedded in the card, so that the "yes" answer can't be synthesized by the interception chip.

      Sigh.

      --
      Welcome to the Panopticon. Used to be a prison, now it's your home.
    21. Re:I didn't think of it means... by TsuruchiBrian · · Score: 1

      Agreed. But even with this particular threat, these cards are still way more secure than what we had before. And this particular flaw should hopefully be fixed. Ideally I'd like to see number+expiration date (i.e. only things you know) methods of authentication be completely deprecated, and have even online shopping authenticated with a reader attached to the shoppers home computer.

    22. Re: I didn't think of it means... by Kichigai+Mentat · · Score: 1

      Why would the govt need to know what guns I have or how many I have? They have no need to know what arms I own unless I were to use them to break the law, which I have not done and do not intend to do....

      or if they are stolen. Any of the registered serial numbers could be used to create a watchlist for pawn/gun shops to check against and to alert authorities if the perp tries to sell them.

      --
      Rawr
    23. Re:I didn't think of it means... by mjwx · · Score: 1

      It is worse than that, because after they were shown that it could be done, they did nothing about it until this latest exploit threatened to make their failure general knowledge.

      Why is it that the stupidest people always seem to be the ones making the decisions in matters of security?

      Because making the right decision on security will affect convenience, if you affect convenience people will stop using credit cards and start using cash again. If people started using cash again, credit card companies cant charge merchant service fees to merchants (as a side effect, merchants will be able to drop prices whilst increasing profit). Fewer merchants paying fees means less profit for banks.

      So they are happily sacrificing security because its cheaper than the profit they'd lose.

      Besides, the only reason this attack is highly improbable is the fact there is a much easier vector to attack. NFC, every NFC enabled card (PayPass/PayWave branding) transmits the card number, name and expiry date, which is all you need to start making online transactions, in very weak encryption to any device that asks for it. You don't need a large laptop with specialised software, I've got an app on my phone that does it. So a Raspberry Pi sized device would be way too large for this purpose.

      All you'd have to do is place a small device under a card terminal, near an ATM or just walk around a crowded shopping mall (no-one will question what a man with a high visibility vest and antenna is doing).

      In Europe and Australia, no-one bothers using cloned cards because shopping online with stolen details is easier and cloned cards are far too easy for the banks and authorities to trace, thus they never bother gathering the info needed to clone EMV/Chip and PIN cards. All they want is the card number, name and expiry date (even the CVV/CVC number is just a bonus). Every new card issued in Australia in the last several years has NFC.

      --
      Calling someone a "hater" only means you can not rationally rebut their argument.
    24. Re:I didn't think of it means... by KGIII · · Score: 2

      Then you're not really in the industry. DirecTV had the greatest reverse troll of all time. Basically the card cloners were keeping busy while DTV kept adding more and more security methods. Except they were sneaking in a little extra code at the time so all of their updates eventually built a time-bomb, in effect, and so the cloners were all happy and the war kept going. Finally, on Super Bowl Sunday, the DTV code got a final update which nuked every single one of the cloned cards that was plugged into the system - forever. Someone tried to figure out what went on and, sure enough, in the last code update - when disassembled, said something like, "Ha ha! We win!" It was epic. The greatest hack battle of all time. Even better than playing with live SysOps while you trashed their corporate system.

      That's just a brief history but that's the gist of it. If you worked in the industry then you'd know this. It's the stuff of legends. By the way, the DTV code took months and months and months to set up - they included something like an extra four bytes in their updates or something like that. It all went together like a giant puzzle in the background and hidden. It was beautiful - I think they overvolted the chip on them or did something to the memory but I don't recall exactly and am too lazy to look it up. My understanding is that some of the people who'd been stealing the service actually called and tried to get new cards and complained about the loss of equipment. It was, from an outsider, epic. I don't actually watch TV so it doesn't affect me but I still read about it as did everyone else. Which means you're probably not in the business.

      --
      "So long and thanks for all the fish."
    25. Re:I didn't think of it means... by Jack+Griffin · · Score: 2

      Because everyone is stupid when it comes to security until something security related happens to them.

      Not so much stupid as lazy. And a big part of the problem is that most of the time, security people are the boy crying wolf.
      How many times have we heard about vulnerabilities that had no impact? If we react to every single warning we'd never get anything done. So maybe the correct path is to ignore security people most of the time. The real trick however, is knowing when to pay attention and act.

    26. Re:I didn't think of it means... by Jack+Griffin · · Score: 1

      I think I'll stick primarily with good old fashioned cash. It isn't as readily hacked,

      Except by any bum with a knife at your throat.

    27. Re: I didn't think of it means... by cayenne8 · · Score: 1

      Countries with actual gun regulations have this little-known feature - ballistic fingerprinting. Every registered gun is required to get analyzed periodically, so its bullets are traceable. It's not foolproof, but it's fairly reliable if done correctly. Also, microstamping should be mandated for all guns.

      Its pretty trivial to swap out barrels on a gun (hand guns at least which is what I think we're mostly talking about here).

      --
      Light travels faster than sound. This is why some people appear bright until you hear them speak.........
    28. Re: I didn't think of it means... by cayenne8 · · Score: 1

      or if they are stolen. Any of the registered serial numbers could be used to create a watchlist for pawn/gun shops to check against and to alert authorities if the perp tries to sell them.

      Well, if they are stolen THEN I can give the authorities the serial numbers myself. They don't need to know about them beforehand.

      --
      Light travels faster than sound. This is why some people appear bright until you hear them speak.........
    29. Re:I didn't think of it means... by ebvwfbw · · Score: 1

      It's because they didn't want to invest the money to fix it. They didn't have someone that they trusted giving them the stats that this could be performed in the next 5 years. With just engineering grade stats, I put it at 97% with a 5% confidence interval. That is, you can take it to the bank that it'll happen.

      Now, the question is - are their heads still firmly in the sand or not?

    30. Re: I didn't think of it means... by Agripa · · Score: 1

      .Countries with actual gun regulations have this little-known feature - ballistic fingerprinting. Every registered gun is required to get analyzed periodically, so its bullets are traceable. It's not foolproof, but it's fairly reliable if done correctly. Also, microstamping should be mandated for all guns.

      Not foolproof? It is not even close to reliable if the perpetrator takes some simple steps.

      1. Dispose of the firearm and ammunition.
      2. Remove any microstamping. This happens if a gun is well used anyway.
      3. Change the characteristics of the rifling, firing pin, extractor, and ejector. This happens if the gun is well used anyway.
      4. Do not leave shell casing behind. This is trivial with a revolver but possible with autoloading and other designs. I have done it when target shooting to recover my brass.

  2. So basically by Big+Hairy+Ian · · Score: 1

    We didn't lock the door because we didn't think anyone would try the knob? Hope somebody's head rolled for this incompetence!

    --

    Build a Man a Fire, and He'll Be Warm for a Day. Set a Man on Fire, and He'll Be Warm for the Rest of His Life.

    1. Re:So basically by NoBrakes58 · · Score: 1

      I think it's a bit more like "we didn't bother to further secure our home past a pin and tumbler lock because we didn't think anyone would bring a bump key."

    2. Re:So basically by wardrich86 · · Score: 1

      We didn't lock the door because people had to turn the knob, but then people figured out how to make a device that just turns the knob for them, and here's how they did it!

    3. Re:So basically by serviscope_minor · · Score: 1

      Even worse:

      Well the last guy to bring a bump key brought a REALLY HUGE one. That sounds impractical so I don't think anyone will ever use a bump key.

      WONTFIX.

      --
      SJW n. One who posts facts.
  3. Chip cards would not have prevented Target Breach by sasparillascott · · Score: 4, Insightful

    Just good to mention that Chip & PIN cards would not have prevented the Target breach in any way as mentioned in Brian Krebs follow up article:

    https://krebsonsecurity.com/20...

    "0 – The number of customer cards that Chip-and-PIN-enabled terminals would have been able to stop the bad guys from stealing had Target put the technology in place prior to the breach (without end-to-end encryption of card data, the card numbers and expiration dates can still be stolen and used in online transactions)."

  4. Chip and Signature by rjstanford · · Score: 2

    If you read TFA, you'll see that the issue exists because people wanted the card to be able to be used without the PIN present, presumably in cases where a PIN terminal wasn't available. All that the hack does is convince the card to process the transaction as if it was a chip-and-signature transaction, which most places can choose to trigger by hand.

    As long as you want cards to work without the PIN, they will be vulnerable to being told to work without the PIN. That's just a fact, unfortunately.

    The other benefits of chip transactions, the best of which is that each transaction is unique rather than simply a relay of TRACKDATA with a M_ID and an amount attached to it (basically making stolen card transmissions worthless instead of the current "just as good as a real card"), still remain and are highly significant.

    --
    You're special forces then? That's great! I just love your olympics!
    1. Re:Chip and Signature by rjstanford · · Score: 2

      I could have been more clean; it returns that information to the POS, and it tells the card that its in signature mode rather than PIN mode.

      --
      You're special forces then? That's great! I just love your olympics!
    2. Re:Chip and Signature by complete+loony · · Score: 1

      You could build a system where you allow chip and sign, while making this MITM attack is impossible. All it requires is end-to-end hashing and signature of the whole conversation. We already have protocols like that baked into things like https.

      --
      09F91102 no, 455FE104 nope, F190A1E8 uh-uh, 7A5F8A09 that's not it, C87294CE no. Ah! 452F6E403CDF10714E41DFAA257D313F.
  5. YesCard by GuB-42 · · Score: 1

    Is it a rerun of the YesCard story from year 2000?
    A French engineer named Serge Humpich managed to make fake credit cards that could fool offline terminals no matter what PIN was entered.

  6. Chip is good security theatre by damn_registrars · · Score: 1

    I'm not the least bit sold on the security of these new cards. I had one issued to me by my bank a couple months ago, and the card was nonetheless compromised within a month. I made exactly one POS transaction with it at a chip terminal (several at non-chip terminals) and all of a sudden someone else decided to pay their cell phone bill with my card.

    Rather unsurprisingly said cell phone company didn't give a flying fuck about the fraud and refused to be the least bit helpful. Now I have to pay my bank to go after it.

    --
    Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
    1. Re:Chip is good security theatre by IamTheRealMike · · Score: 4, Insightful

      "I used my card in the old insecure mode several times and then am surprised when the card got skimmed"? Really?

    2. Re:Chip is good security theatre by Nkwe · · Score: 1

      I'm not the least bit sold on the security of these new cards. I had one issued to me by my bank a couple months ago, and the card was nonetheless compromised within a month. I made exactly one POS transaction with it at a chip terminal (several at non-chip terminals) and all of a sudden someone else decided to pay their cell phone bill with my card. Rather unsurprisingly said cell phone company didn't give a flying fuck about the fraud and refused to be the least bit helpful. Now I have to pay my bank to go after it.

      What does the cell phone company have to do with it? Your dispute is with the bank that issued your credit card. If your bank is charging you to dispute a fraudulent credit card charge, you need to find a different bank.

    3. Re:Chip is good security theatre by tkrotchko · · Score: 1

      Did you use this card online to pay for things?

      If so, that's the most likely way that your card was compromised. As other posters have stated, your issue is with the bank, not the phone company.

      Just dispute the charge with the bank, and it comes off your bill.

      --
      You were mistaken. Which is odd, since memory shouldn't be a problem for you
    4. Re:Chip is good security theatre by damn_registrars · · Score: 1

      What does the cell phone company have to do with it?

      When I call a merchant directly and tell them my card has been used fraudulently they should be willing to take my information and - at the very least - blacklist my card number upon my request so that it is never used again. They offered to do exactly nothing for me as I did not know the phone number that was used for the transaction.

      I've known other vendors - Blizzard comes to mind - who would go much further and reverse the charges over the phone.

      Your dispute is with the bank that issued your credit card.

      No, the dispute is with the merchant who was willing to accept stolen card data and couldn't be bothered to check the data against the thief using it.

      If your bank is charging you to dispute a fraudulent credit card charge, you need to find a different bank.

      The bank isn't charging me directly - as in with a fee - but they aren't doing it for free, either. No bank would do this for free, they have to be able to pay the employees whose job it is to deal with this.

      --
      Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
    5. Re:Chip is good security theatre by rickb928 · · Score: 1

      "I made exactly one POS transaction with it at a chip terminal (several at non-chip terminals) and all of a sudden someone else decided to pay their cell phone bill with my card."

      I'm betting the cell phone bill was paid online. Still no real security for EMV cards online, as there is no EMV in a card-not-present transaction. It's not even track data, just the account number, expiration date, and CVV/CID. Which, if the fraudster had the CVV, means they had your card at some point or saw front and back.

      I had a similarly interesting problem, my debit card was compromised and spotted making a fraudulent transaction at a supermarket. After the dust settled, I asked how the card was processed - was it swiped or the account entered manually. I could not get the bank and merchant to admit to how it was processed. My concerns were:

      0. If the card was swiped then it was cloned - I had the only card, there are no others in circulation.

      1. If the card was non-swiped, was it in person at the store? If so, was there an insider at the store helping, and were they investigated?

      2. If it was online, did they require the CVV?

      My concern was that the card was out of my possession only once in more than two weeks prior to the event. I know where. I would have been pressing that merchant for an investigation.

      ps- where did you find a working-mode chip terminal two months ago in the U.S.?

      --
      deleting the extra space after periods so i can stay relevant, yeah.
    6. Re:Chip is good security theatre by PPH · · Score: 1

      When I call a merchant directly and tell them my card has been used fraudulently

      You don't call the merchant. You call your bank (the card issuer) and contest the charges. The bank reverses the payment and then it's the bank vs the merchant for lax security procedures, accepting bad signatures, etc.

      If a merchant develops a bad track record w.r.t. accepting questionable cards, the bank (actually, I think it's the clearing company, like VISA) will levy a surcharge on that merchant and eventually blacklist them.

      --
      Have gnu, will travel.
    7. Re:Chip is good security theatre by TsuruchiBrian · · Score: 1

      I don't your account of what actually happened can be trusted because you are a fucking moron.

    8. Re:Chip is good security theatre by damn_registrars · · Score: 1

      You are so kind with your grammatical incoherence. May you have a great day, sir. Should you ever care to come back to actually discuss the topic, feel free to grace us again with your presence at that time.

      --
      Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
    9. Re:Chip is good security theatre by yzf750 · · Score: 1

      ps- where did you find a working-mode chip terminal two months ago in the U.S.?

      The Walmarts around here have had them since May or so. My local homebrew shop got theirs about the same time too.

    10. Re:Chip is good security theatre by rjstanford · · Score: 1

      When I call a merchant directly and tell them my card has been used fraudulently they should be willing to take my information and - at the very least - blacklist my card number upon my request so that it is never used again.

      Even though you're not their customer? Yeah, there's no way that that could ever be abused.

      There are well-established procedures for handling these kind of situations, if you follow them then most everything "just works".

      --
      You're special forces then? That's great! I just love your olympics!
    11. Re:Chip is good security theatre by damn_registrars · · Score: 1

      When I call a merchant directly and tell them my card has been used fraudulently they should be willing to take my information and - at the very least - blacklist my card number upon my request so that it is never used again.

      Even though you're not their customer? Yeah, there's no way that that could ever be abused.

      I have the card. It is in MY name. They took it and accepted it from someone else who is not me, and does not live at my address or have my phone number. I should be able to say "this is my card, do not ever accept it". Other vendors are more than happy to oblige to that request.

      It's not like it would be useful for someone to call and start guessing card numbers randomly for such a request, and they would have almost no chance of matching card numbers to names if they did.

      There are well-established procedures for handling these kind of situations, if you follow them then most everything "just works".

      There are also well-established procedures for how vendors are supposed to accept credit cards for transactions, which this cell phone carrier did not follow. This left me on the hook for over $200 worth of transactions that were not mine while they put their heads in the sand.

      --
      Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
    12. Re:Chip is good security theatre by TsuruchiBrian · · Score: 1

      I apologize for the typographical error. I meant to say that I don't *trust* your account of what actually happened because of your intellectual deficit, sir. Had someone of normal mental capacity made a similar claim, I might at least entertain the possibility that it was correct, but I am certain you just don't understand how anything works, and this general state of misunderstanding is no doubt what has lead to your perception of events.

    13. Re: Chip is good security theatre by rickb928 · · Score: 1

      Walmart stores here had slots in may, dead until September 28.

      --
      deleting the extra space after periods so i can stay relevant, yeah.
    14. Re:Chip is good security theatre by damn_registrars · · Score: 1

      You bring a lot of bias in to this, but based on what? I seem to have angered you at some time but I don't recall a past interaction with you. You've made it clear that you don't like me but you have not done anything to explain why.

      --
      Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
    15. Re:Chip is good security theatre by TsuruchiBrian · · Score: 1

      You haven't angered me. On the contrary, you have provided me with hours of entertainment.

    16. Re:Chip is good security theatre by damn_registrars · · Score: 1

      Really? You expect me to believe that your not angry when you come in lobbing insults and profanity? You haven't said a single word in this thread about the topic itself, instead you've been attacking me. If you are trying to act like a sane and non-angry person you are failing quite badly.

      Again, I don't know what I did to you to warrant such anger from you. If you'd like to discuss the topic, feel free.

      --
      Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
    17. Re:Chip is good security theatre by compro01 · · Score: 1

      Still no real security for EMV cards online, as there is no EMV in a card-not-present transaction

      There can be, but the number of companies that have implemented it is almost zero

      --
      upon the advice of my lawyer, i have no sig at this time
    18. Re:Chip is good security theatre by TsuruchiBrian · · Score: 1

      lol

    19. Re:Chip is good security theatre by damn_registrars · · Score: 1

      After anger comes laughter? Well, there are healthier ways to deal with the former than directing it randomly at people on slashdot, but there are worse options as well.

      --
      Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
    20. Re: Chip is good security theatre by rickb928 · · Score: 1

      Not going to happen. 3DSecure, etc are sufficient, but few merchants in the US bother. Too much friction .

      --
      deleting the extra space after periods so i can stay relevant, yeah.
    21. Re:Chip is good security theatre by BadDreamer · · Score: 1

      I should be able to say "this is my card, do not ever accept it".

      No, you should not. If you can do that with your card information, then I can do that with your card information. If I do that with your phone company, then what?

      What you should do is contact your bank and contest the charges. Talking to the vendor is a waste of everyone's time. Most of all yours. They have zero obligation to you.

    22. Re:Chip is good security theatre by TsuruchiBrian · · Score: 1

      You're like one of those dogs that falls down running across a slippery floor every single time. I feel a bit guilty laughing, but I just can't help it.

    23. Re:Chip is good security theatre by damn_registrars · · Score: 1

      So you just came here to troll me then, gotcha. Move along, have a nice day. You were very marginally successful in wasting my time but there are certainly less hackish ways to pull off that feat.

      --
      Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
    24. Re:Chip is good security theatre by TsuruchiBrian · · Score: 1

      Such as?

    25. Re:Chip is good security theatre by damn_registrars · · Score: 1

      Sorry kid, but I don't feel anywhere near bad enough for you to help you be a better troll.

      --
      Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
    26. Re:Chip is good security theatre by TsuruchiBrian · · Score: 1

      That's Ok sonny. You don't have to have all the answers. There are lots of nice and smart people out there who will take pity on you and make sure you don't hurt yourself too bad. You'll be ok. Just try to find an adult if you get scared.

    27. Re:Chip is good security theatre by damn_registrars · · Score: 1

      We already concluded that act doesn't work for you. It might be time for you to find a new hobby, or maybe study for your midterms.

      --
      Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
    28. Re:Chip is good security theatre by TsuruchiBrian · · Score: 1

      It's just hilarious when you go into "wise grandpa" mode :)

    29. Re:Chip is good security theatre by rjstanford · · Score: 1

      I should be able to say "this is my card, do not ever accept it". Other vendors are more than happy to oblige to that request.

      Really? Who?

      That's a serious question, by the way. I don't know of any company who's set up to allow random non-customers to call in and request that their credit card be placed on a do-not-accept list - or indeed any commercial software set up to accept those kind of restrictions.

      --
      You're special forces then? That's great! I just love your olympics!
    30. Re:Chip is good security theatre by damn_registrars · · Score: 1

      I don't know of any company who's set up to allow random non-customers to call in and request that their credit card be placed on a do-not-accept list - or indeed any commercial software set up to accept those kind of restrictions.

      Blizzard (now activision) will do exactly that. I know of someone who had their card compromised and whoever got the info used it to buy crap through World of Warcraft. They called Blizzard to say it wasn't them and Blizzard happily blacklisted the card number, permanently. It was a pretty simple act of showing that the person whose name was on the card was not the same as the person whose name was on the WoW account. There were other things their card was used for in the same round of fraud and many other vendors did the same.

      --
      Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
  7. So stupid and ignorant of history. by serviscope_minor · · Score: 4, Informative

    You'd think it would be obvious, but an attack never gets less good over time.

    Of course the research attack was large and bulky. It had a full laptop in a backpack and a bunch of not very dense electronics and stuff since it was part of a research demo. Research demos are generally the minimum required to prove that something works.

    Once an attack has been found the only vaguely sensible thing to assume is that it gets better, easier and more slick over time.

    Then again, the banks were idiots in the first place and tried legal threats to keep it quiet. Because as we all know that makes security holes vanish.

    --
    SJW n. One who posts facts.
  8. We can safely ignore Chip&Pin by Lord+Bitman · · Score: 1

    Chip&PIN has always been broken. We're already moving to systems such as Google Wallet / ApplePay, which (whether or not they actually are secure) at least have the theoretical potential to be secure - something which Chip&PIN could never claim.

    --
    -- 'The' Lord and Master Bitman On High, Master Of All
    1. Re:We can safely ignore Chip&Pin by DarenN · · Score: 4, Informative

      Chip and PIN is secure if used:
      1. With the card present
      2. With a PIN pad
      3. With online validation

      Which is all it ever guaranteed.

      Chip and Signature should help reduce card cloning attacks because unless the cryptographic key on the chip can be read the application request cryptograms will never be correct so the transactions will be flagged. What happens in the case of an ARQC validation failure is up to your bank, but they can hardly refuse a refund if they approve a transaction where the ARQC validation failed. (Well, they can, but they're likely to get shafted for it eventually)

      However what this attack enables is allowing stolen cards to be used because the fake chip would pass through the request to generate the ARQC to the chip card. So if your card's stolen, report it quickly. It's the same problem with the contactless cards. If it's stolen it can be used until it's blocked for the smaller amounts that it allows, but it's difficult to clone (I won't say impossible but I have not heard of it being done) because there's cryptographic key on the chip which generates a cryptogram that has to validate before the transaction will be approved.

      Chip of any flavour does not stop card-not-present fraud, so internet fraud and over-the-phone purchase fraud will continue unabated. It solves a different problem.

      --
      Rational thought is the only true freedom
    2. Re:We can safely ignore Chip&Pin by lars_stefan_axelsson · · Score: 1

      Chip and Signature should help reduce card cloning attacks because unless the cryptographic key on the chip can be read the application request cryptograms will never be correct so the transactions will be flagged. What happens in the case of an ARQC validation failure is up to your bank, but they can hardly refuse a refund if they approve a transaction where the ARQC validation failed. (Well, they can, but they're likely to get shafted for it eventually)

      And that's a real issue. That's why we in Europe right now have geofencing on our cards. When our card information is "stolen" it ends up being used on cloned cards in shops in other parts of the world. BUT, that's not just places like India (which is a perennial favourite), rather one of the major markets is the US as your POS security standards are so lax.

      So even if shoring up US standards would not help USians, it will help us in the rest of the world, by making one very popular attack less likely to succeed, by making geoblocking working better.(Blocking the US is more inconvenient than blocking many other countries.)

      --
      Stefan Axelsson
  9. Re:Chip cards would not have prevented Target Brea by ShanghaiBill · · Score: 2

    Just good to mention that Chip & PIN cards would not have prevented the Target breach in any way as mentioned in Brian Krebs follow up article

    The CC number would have been compromised. But the PIN would be secret. The whole point of the PIN is that the CC# alone is not enough to complete a transaction.

  10. Re:Chip cards would not have prevented Target Brea by TemporalBeing · · Score: 3, Interesting

    Just good to mention that Chip & PIN cards would not have prevented the Target breach in any way as mentioned in Brian Krebs follow up article: https://krebsonsecurity.com/20... "0 – The number of customer cards that Chip-and-PIN-enabled terminals would have been able to stop the bad guys from stealing had Target put the technology in place prior to the breach (without end-to-end encryption of card data, the card numbers and expiration dates can still be stolen and used in online transactions)."

    Correct. Chip & PIN would not have solved anything.

    To provide an example...I used my Chip card the other day. The vendor was having an issue with their chip reader, so the POS operator put in an override to allow it to be swiped. So another easy way to by pass the Chips? Make a hack that makes the system think the reader is unusable.

    --
    Truth is like the sun. You can shut it out for a time, but it ain't goin' away. - Elvis Presley (source: imdb.com)
  11. Re:Chip cards would not have prevented Target Brea by AmiMoJo · · Score: 2

    This doesn't seem to be right. To make online transactions you need the CCV number on the back of the card. That number is not normally transmitted when you make a chip-and-pin payment. At least, that's the way it works in Europe, maybe the US chip-and-pin system is different.

    --
    const int one = 65536; (Silvermoon, Texture.cs)
    SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
  12. Old method always works. by Roliverio · · Score: 1

    This system was hacked years ago by a handful of teenagers trying to get more minutes on their public phone calling cards (when Cellphones were not as popular as they're today) The method was exactly the same, strip an already used card of the circuit logic and file it so it fitted alongside a good card, this made the phone charge the funds but not update the remaining funds on the good card, rinse-and-repeat. Chip and PIN is of course, not secure, but at least it beats (if by little) the CHIPless cards that are way easier and cheaper to clone.

  13. Improbable = Inevitable by sjbe · · Score: 1

    Improbable in computer security means inevitable. Impossible means it cannot be done - yet.

  14. Re:Chip cards would not have prevented Target Brea by cayenne8 · · Score: 1

    The CC number would have been compromised. But the PIN would be secret. The whole point of the PIN is that the CC# alone is not enough to complete a transaction.

    But kind of a moot point, since in the US there is no "PIN" to go along with the Chip. Just is chip and sign, you don't have to come up with nor remember a pin for each credit card you have and use with the new system here.

    --
    Light travels faster than sound. This is why some people appear bright until you hear them speak.........
  15. Re:Chip cards would not have prevented Target Brea by IamTheRealMike · · Score: 1

    Merchants can pick what level of card security they use online. The best possible is 3D-Secure and friends which involve the user authenticating to their bank when a card transaction is made. But some merchants don't like the additional complexity and overhead it adds to the purchasing process, they prefer to do their own risk analysis and bug the user less .... possibly swallowing the fraud if they let it through. Amazon famously doesn't ask for the CVV code because they think they can sell more if they avoid it, and they are confident in their own fraud detection abilities.

    Criticising EMV for not preventing skimmed Target details from being used online is kind of dumb, given that it wasn't designed to protect internet transactions at all.

  16. Re:Chip cards would not have prevented Target Brea by jittles · · Score: 1

    Just good to mention that Chip & PIN cards would not have prevented the Target breach in any way as mentioned in Brian Krebs follow up article: https://krebsonsecurity.com/20... "0 – The number of customer cards that Chip-and-PIN-enabled terminals would have been able to stop the bad guys from stealing had Target put the technology in place prior to the breach (without end-to-end encryption of card data, the card numbers and expiration dates can still be stolen and used in online transactions)."

    Except that chip cards don't provide the same card number for every transaction. In an EMV transaction the cashier requests that the terminal read the chip. Data from the chip gets sent to the processor. The processor sends data back to the card, which is then used to perform an action on the chip. Once the chip is done, it sends all of the information needed to capture the transaction to the processor. But it does not contain the actual card number.

    EMV transactions all contain cryptograms with the card number. Target would only be able to see, at most, the first 6 digits and the last 4 digits of every card. Target would not have had anything to compromise. The processor would have had information that would be usable once to complete a single transaction. The card could not have been cloned. The card number could not have been reused in an online transaction because it would have been marked as a duplicate and fraudulent transaction. So therefore, chip and pin would have protected everyone in the Target breach. That's assuming an actual EMV spec transaction occurred. The back and forth communication between the card chip and the processor is the reason that the card must be left in during the transaction.

  17. Re:Chip cards would not have prevented Target Brea by jittles · · Score: 1

    This doesn't seem to be right. To make online transactions you need the CCV number on the back of the card. That number is not normally transmitted when you make a chip-and-pin payment. At least, that's the way it works in Europe, maybe the US chip-and-pin system is different.

    The CVV can be read, in clear text, from the terminal data. It is not encrypted. While they do not need to store the CVV data separately from the encrypted card data, Target could still have access to this info.

  18. At least by TsuruchiBrian · · Score: 1

    At least this hack requires the criminals to steal the actual card (rather than just skimming information from a real card when the owner lets you borrow it). I think 2-factor authentication is good and it's too bad this system failed, but the original mechanism of preventing unauthorized use without physical access to a real card seems to be working pretty well.

  19. pfft, PIN by j2.718ff · · Score: 3, Funny

    We in the US have chip and signature, and are therefore immune to any such attack involving a PIN.

    1. Re:pfft, PIN by mark-t · · Score: 1

      I am the only person on this planet that knows my pin. If somebody steals my card, they don't have my pin. If somebody should steal my pin, they still don't have my card. Both are required to fake a transaction. Duplicating the magstripe on my card is insufficient because most places accept chipped cards, and if a magstripe duplicate of my card were placed in such a machine, it would indicate that the transaction must be completed with the chip, not the magstripe. They would, therefore, have to forge the chip, which requires having a silicon fabrication facility at a bare *minimum*.

      --
      File under 'M' for 'Manic ranting'
    2. Re:pfft, PIN by MobyDisk · · Score: 1

      I take security even further than that: Even I don't know my own own PIN!

  20. Fuck You Slashdot by sexconker · · Score: 1

    Since Slashdot is useless, I'll post a summary.

    http://www.net-security.org/im...

    Stolen chip with malicious chip soldered on top. No idea why you need a second stolen card for the body as shown in the image.

    Malicious chip MITMs the POS PIN challenge and says it's all good. Malicious chip in this case is a "FUNcard" chip. Basically a generic system you can buy for your laundromat, arcade, carnival, whatever.

    This was done in France in 2011. EMVCo claims they've fixed this or made it harder. They won't say how. No one believes them.

    1. Re:Fuck You Slashdot by DarenN · · Score: 1

      Stolen chip with malicious chip soldered on top. No idea why you need a second stolen card for the body as shown in the image.

      So the card didn't have the chip protruding, which would have made it look tampered with. It may also have allowed the card to be inserted without damaging the new chip.

      This was done in France in 2011. EMVCo claims they've fixed this or made it harder. They won't say how. No one believes them.

      The will say how, they just won't give details. The basic problem is that you have offline PIN validation where the chip can validate the entered PIN and say "yo, it's all good, I've verified the PIN". This method is allowed for low-value stuff (think metro tickets) up to a bank-defined threshold for a bank-defined number of transactions, then the card is forced online.
      To allow this, the original implementations allowed completely separate PIN validation and Transaction validation. They said that they increased the coupling so that if the PIN is wrong the application request cryptogram will no longer validate correctly, I believe.

      --
      Rational thought is the only true freedom
    2. Re:Fuck You Slashdot by sexconker · · Score: 1

      Why couldn't you just use the first stolen card's body?

      As for the PIN, if it's wrong in an offline environment you'd never know. At best, you can reduce windows and thresholds for requiring allowing cards to be used offline. You can't stop this attack with the current hardware while still allowing offline transactions.

    3. Re:Fuck You Slashdot by DarenN · · Score: 1

      Why couldn't you just use the first stolen card's body?

      You need the original chip intact and the thickness increased from 0.4mm to 0.7mm. This made it harder to get into the reader so I assume it was to prevent the chip on top being pressured which may screw up the contact to the chip below, and also the card would look weird if it was half again as thick.

      As for the PIN, if it's wrong in an offline environment you'd never know. At best, you can reduce windows and thresholds for requiring allowing cards to be used offline. You can't stop this attack with the current hardware while still allowing offline transactions.

      True, but the customer's never going to see it!

      There are 3 verification steps with EMV, card verification, cardholder verification and transaction verification. They were pretty coy about what they did but they said that they'd coupled the card, cardholder and transaction verification in a way that made this attack more difficult. As I said, it's pretty generic and they won't say how they did it.

      --
      Rational thought is the only true freedom
  21. They will get better by rickb928 · · Score: 1

    Fraudsters will improve the hardware. Eventually a shim will be made that is barely visible, interposes a chip to intercept and alter messages, and the cycle continues.

    Terminal makers are probably working on reducing the tolerances for card thickness to defeat this shimming.

    And as cards move to non-embossed plastic, this will be a problem until all embossed cards are gone. then the slot will be thinned, and the shim will be harder to make. Possibly the cards will be shaved to permit a shim on the top. Expect such cardstock to become contraband, or someone to step up and make an unrelated card payment system to justify manufacture, avoiding the criminalization of shaved cards as the source of shimmed cards.

    Possibly even trying to restrict the use of EMV-compatible connector pads.

    All futile.

    --
    deleting the extra space after periods so i can stay relevant, yeah.
    1. Re:They will get better by guruevi · · Score: 1

      Did you see the shims? The entire SoC can be done on a sheet of flex plastic well within tolerance of the readers.

      --
      Custom electronics and digital signage for your business: www.evcircuits.com
    2. Re:They will get better by rickb928 · · Score: 1

      Key to being able to pass off a shimmed card is ease of use. The extra thickness of the fpga chip causes problems, and it probably needs to be welded at this point, though eventually conductive adhesives will be found. But using nonembossed cards solves some of this.

      The terminal makers are in a bind her.

      --
      deleting the extra space after periods so i can stay relevant, yeah.
  22. Re:Chip cards would not have prevented Target Brea by DarenN · · Score: 1

    The skimming could still take place but the card can't be cloned. Cloning is the majority of card-present fraud and the chip effectively eliminates it.

    --
    Rational thought is the only true freedom
  23. Technically, yes by bsdasym · · Score: 1

    The answer to that appears to be technically yes, but practically no. The PDF of the forensic analysis says that not all of the card standard was implemented on the funcard.

    First, it did not respond properly to parity errors in the data stream from the POS. The document says that "coding, testing, and deploying this countermeasure took less than a week." -- This means that POSes are updated or being updated to inject parity errors into the transaction to see if the card responds to them properly, an easy firmware fix for the hack to circumvent.

    Second, the PDF says that the card responded incorrectly to a VerifyPIN command sent outside of a transaction context, which the standard requires (the PIN associated with the last transaction), and that "coding, testing, and deploying this countermeasure was done overnight." Again, something an attacker could address with a simple firmware update.

    The document also says that "four other software-updatable countermeasures were developed and tested, but never deployed. These were left for future fraud control, if necessary.

    In other words they found even more vulnerabilities but did not implement the fixes, choosing to wait until after they're exploited to do something about it.

  24. Re:Chip cards would not have prevented Target Brea by TsuruchiBrian · · Score: 1

    Well the idea is that once enough there are enough chip readers out there, then banks don't need to accept numbers and expiration dates as valid authentication anymore. People can even get chip readers in their homes for instantly authenticated online purchases.

    So a deadbolt on your front door is not going to keep a burglar from going into the back door you left open, but that doesn't mean your deadbolt isn't secure, it just means you need another deadbolt on your back door too.

  25. Re:Chip cards would not have prevented Target Brea by TsuruchiBrian · · Score: 1

    It doesn't count as "chip and pin" if the hack involves bypassing the use of the chip and pin. A safe can't protect any items that aren't actually in it.

  26. Never trust the client by Chewbacon · · Score: 1

    That's one of the first lessons in secure programming I was taught.

    --
    Chewbacon
    The Bible is like Wikipedia: written by a bunch of people and verifiable by questionable sources.
  27. Re:Chip cards would not have prevented Target Brea by ewibble · · Score: 1

    This is even more silly, where I live if you simply put your card in backwards, the reader will say read error, ask you to swipe, then ask to put the card in again, if you put the card in backwards again it will ask to swipe and accept that. Yes you need to know the pin but you don't need the chip.

    It reminds me of Microsoft Bob's security if you entered your password wrong 3 times it would ask if you wanted to change it.

  28. Because we have a ruling class by rsilvergun · · Score: 1

    We just don't like to acknowledge them and prefer to kid ourselves into thinking were a meritocracy...

    --
    Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
  29. Don't even need to go that nuts in the US by Loconut1389 · · Score: 1

    Since the US adopted/is adopting the chip without the pin, we're already behind the curve.

  30. Re:Chip cards would not have prevented Target Brea by TemporalBeing · · Score: 1

    It doesn't count as "chip and pin" if the hack involves bypassing the use of the chip and pin. A safe can't protect any items that aren't actually in it.

    If you can by-pass it then it effectively nullifies any security provided, so yes, it does count.

    Even aside from that, chip+PIN it no where near as secure as things like Google Wallet that provide single-use card numbers for each transaction.

    It's also been shown that people can completely clone a chip+PIN card, again rendering the added security null and void.

    --
    Truth is like the sun. You can shut it out for a time, but it ain't goin' away. - Elvis Presley (source: imdb.com)
  31. Re:Chip cards would not have prevented Target Brea by TemporalBeing · · Score: 1

    This is even more silly, where I live if you simply put your card in backwards, the reader will say read error, ask you to swipe, then ask to put the card in again, if you put the card in backwards again it will ask to swipe and accept that. Yes you need to know the pin but you don't need the chip.

    Yeah. It doesn't save anything - just causes more headaches. They're only going after it to shift some liability.

    It reminds me of Microsoft Bob's security if you entered your password wrong 3 times it would ask if you wanted to change it.

    lol...kind of like a disk encryption software I used a few employers ago...if you ran out of attempts it was suppose to require help desk to unlock it. I accidentally discovered all you had to do was reboot the computer - even a soft-reboot worked IIRC.

    --
    Truth is like the sun. You can shut it out for a time, but it ain't goin' away. - Elvis Presley (source: imdb.com)
  32. Re:Chip cards would not have prevented Target Brea by TsuruchiBrian · · Score: 1

    If you can by-pass it then it effectively nullifies any security provided, so yes, it does count.

    So if I try to rob a house, and I "bypass" the security system by robbing the next house over, does that mean the security system of the first house sucks?

    Even aside from that, chip+PIN it no where near as secure as things like Google Wallet that provide single-use card numbers for each transaction.

    How is this more secure?

    It's also been shown that people can completely clone a chip+PIN card, again rendering the added security null and void.

    Do you have a citation?

  33. Re:Chip cards would not have prevented Target Brea by cheater512 · · Score: 1

    Signatures are now not accepted in Australia. Chip + Pin only (or Pay Wave).
    Far better since signatures were never checked anyway.

  34. Re:Chip cards would not have prevented Target Brea by TemporalBeing · · Score: 1

    If you can by-pass it then it effectively nullifies any security provided, so yes, it does count.

    So if I try to rob a house, and I "bypass" the security system by robbing the next house over, does that mean the security system of the first house sucks?

    If you are able to use entry into the second house to steal stuff from the first house, then yes, that the security on the first house is insufficient protection. If the two are completely unrelated, then the security of the first makes no difference.

    In this case, card vs card+chip+pin is like two homes with a tunnel between them. The first home might be more secure, but the tunnel is doesn't have any security on it. So the valuables in the first house are still at risk through entry into the second house; and the guy that sold the first house to the current owners failed to mention the existence of the tunnel.

    Even aside from that, chip+PIN it no where near as secure as things like Google Wallet that provide single-use card numbers for each transaction.

    How is this more secure?

    The card number is single use. If they try to use it again, it doesn't work. So it's more secure in the same way that a one-time password is more secure. Google approves the single transaction, and denies any further ones. So yes, it's actually more secure but it also relies on NFC (Wallet+NFC, now Android Pay). It's less secure in that you're putting your bank/credit cards at a single source (Google, Apple, etc) and then using their services to make more secure transactions with others - so single point of failure in security. However, you're card numbers won't be stolen from Target, Home Depot, Walmart, or any other vendor you do business with.

    It's also been shown that people can completely clone a chip+PIN card, again rendering the added security null and void.

    Do you have a citation?

    here's a couple:

    http://securityaffairs.co/word...
    http://www.theage.com.au/it-pr... - also referenced at http://krebsonsecurity.com/201...

    So yeah, if Krebs mentions it, it's probably been proven sufficiently, and likely happening.

    --
    Truth is like the sun. You can shut it out for a time, but it ain't goin' away. - Elvis Presley (source: imdb.com)
  35. Re:Chip cards would not have prevented Target Brea by TsuruchiBrian · · Score: 1

    If you are able to use entry into the second house to steal stuff from the first house, then yes, that the security on the first house is insufficient protection. If the two are completely unrelated, then the security of the first makes no difference. In this case, card vs card+chip+pin is like two homes with a tunnel between them. The first home might be more secure, but the tunnel is doesn't have any security on it. So the valuables in the first house are still at risk through entry into the second house; and the guy that sold the first house to the current owners failed to mention the existence of the tunnel.

    Yes, it is exactly like this, if the tunnel was put there specifically for people who did not know how to properly authenticate themselves to the security system, with the understanding that the tunnel will eventually be filled in when enough people know how to properly authenticate themselves. My point is that the existence of the tunnel is not a weakness in the security system, it is a temporary tunnel specifically designed to bypass the bypass the system, and can easily be filled in whenever "we" want.

    The card number is single use. If they try to use it again, it doesn't work

    It's more secure than a card number that is multi-use (old mag strip cards). But it is not more secure than a chip card with no numbers at all.

    here's a couple:

    Your first citation describes a vulnerability in a system with an "implementation flaw", and I think the 2nd citation is describing the same implementation flaw.

    In this situation I believe the problem is not with the EMV cars system itself but rather individual banks usage of the system.

    This is similar to how Sony's flawed implementation of ECDSA lead to the discovery of the PS3 private key. This is not a flaw in the ECDSA mechanism itself.

    This is like having a really good security system and forgetting to turn it on.

  36. Re:Chip cards would not have prevented Target Brea by compro01 · · Score: 1

    You can, but basically no one has implemented Chip Authentication Program.

    --
    upon the advice of my lawyer, i have no sig at this time
  37. Re:Chip cards would not have prevented Target Brea by guruevi · · Score: 1

    As these researchers have pointed out publicly in 2010 but all the way back to the early 2000's to these chip and pin companies, the pin can just as easy be read out with the right equipment. It was deemed 'impractical' but as Krebs has pointed out and the Cambridge researchers as well in a more recent post, the technology to clone the necessary card info to do other transactions exists and has been perfected to the point of being nearly invisible.

    --
    Custom electronics and digital signage for your business: www.evcircuits.com
  38. Re:EMV chip cloning by DarenN · · Score: 1

    Yeah, I was aware of that one and actually meant (but forgot) to add a qualifer. However, that article title is misleading - the attack used was against a stolen card and the author is incorrect in that you cannot record everything "bar the unpredectible number" from the chip, clone it and expect to validate a transaction. The cryptographic key isn't revealed. Now if the unpredictable numbers are too predictable it may be possible to eventually get that key which would be a serious issue which WOULD allow cloning.
    The unpredictable number is transmitted with everything else so it's, on it's own, inherently insecure in a cryptographic sense and given a raw message buffer I could read it for you without any tools. But it was not designed to be random (it's not called a random number, after all), it was designed to add a small element of "unpredictability" as an input to an althgorithm that's run on the card chip itself with key that's present on that chip and cannot be read.

    Are there insecurities in an EMV payment system? Yes. Is it possible to use a stolen card? Yes (but much harder than a magstripe to the point of being very difficult indeed if you want to use it in a card-present scenario). Is is possible to clone a chip card? Not, as far as we know, at this point.

    --
    Rational thought is the only true freedom
  39. Re:Chip cards would not have prevented Target Brea by nanoflower · · Score: 1

    I'm glad they don't verify the signatures as I mostly use my credit card at the local grocery store. They use one of those pads for you to sign and my signature when writing on glass looks nothing like my real signature. Not to say that my signature looks the same each time because it doesn't. Similar but often not that close.