Community
There was a 9-minute film on Newsnight yesterday evening (available online) showing some research by Saar Drimer, Ross Anderson, Mike Bond and me. We demonstrate a middleperson attack on EMV which lets criminals use stolen chip and PIN cards without knowing the PIN.
Our technical paper “Chip and PIN is Broken” explains how. It has been causing quite a stir as it has circulated the banking industry privately for over 2 months, and it has been accepted for the IEEE Symposium on Security and Privacy, the top conference in computer security. (See also our FAQ, press release, and summary from the BBC.)
The flaw is that when you put a card into a terminal, a negotiation takes place about how the cardholder should be authenticated: using a PIN, using a signature or not at all. This particular subprotocol is not authenticated, so you can trick the card into thinking it’s doing a chip-and-signature transaction while the terminal thinks it’s chip-and-PIN. The upshot is that you can buy stuff using a stolen card and a PIN of 0000 (or anything you want). We did so, on camera, using various journalists’ cards. The transactions went through fine and the receipts say “Verified by PIN”.
It’s no surprise to us or bankers that this attack works offline (when the merchant cannot contact the bank). But the real shocker is that it works online too: even when the bank authorisation system has all the transaction data sent back to it for verification.
Read more at Light Blue Touchpaper...
This content is provided by an external author without editing by Finextra. It expresses the views and opinions of the author.
Patrick Bermingham CEO at Adflex
29 August
Ben Lane VP of Colleague Experience Group at American Express UK
28 August
Alex Kreger Founder & CEO at UXDA
27 August
Luigi Wewege President at Caye International Bank
Welcome to Finextra. We use cookies to help us to deliver our services. You may change your preferences at our Cookie Centre.
Please read our Privacy Policy.