Apacs staffer outed as anonymous Chip and PIN research basher

A computer registered to UK payments body Apacs was used to anonymously rubbish research by Cambridge University academics into vulnerabilities in the Chip and PIN system.

5 comments

Apacs staffer outed as anonymous Chip and PIN research basher

Editorial

This content has been selected, created and edited by the Finextra editorial team based upon its relevance and interest to our community.

The research, Chip and PIN is broken, demonstrated a middleperson attack on EMV which lets criminals use stolen chip and PIN cards without knowing the PIN.

The paper was published the day after a nine-minute slot on prestige TV show Newsnight which detailed the loophole uncovered by researchers Saar Drimer, Ross Anderson, Mike Bond and Steven Murdoch.

The publication of the research - which had been circulating in the banking industry for about two months - on a Cambridge University technical blog prompted a long rant by an anonymous poster using the handle Scrutineer.

"The quality of this so called research leaves a lot to be desired," railed Scrutineer. "At a time when other academics are under pressure because of doubts over the validity of their research and findings on climate research it is very worrying that others seem hell bent on following the same path...For Cambridge post graduates with doctorates one would have expected more than a first year electronic engineering student could achieve. Can we please have some meaningful security research rather than this alarmist opinion speak."

The poster was outed by a simple whois IP address search, which pointed to an computer registered at Apacs (aka the UK Cards Association).

As Ross Anderson acidly commented: "Pity Apacs couldn't get it together to put up a spokesman for Newsnight."

A spokeswoman for UK Card Association told tech newswire The Register that the posts violated staff Internet-use guidelines.

"We have a very clear policy on staff posting comments to blogs/newsgroups and as such this has now become a disciplinary issue," she said.

Sponsored [Webinar] Using modern technology platforms to create an AI-driven bank

Comments: (5)

A Finextra member 

What the &*@$ is a "middleperson attack"?

Paul Penrose Head of Research at Finextra

New jargon alert: It's the PC (as in politically correct) equivalent of a man-in-the-middle attack. Popular in academe.

Adam Nybäck System Developer at Anyro

If this is something "a first year electronic engineering student could achieve", then it's even more likely that criminals have used this attack already.

Lachlan Gunn Director at BenAlpin Ltd

if the man (umm.. person!) was up for carrying a backpack with a card wired to it down his sleeve, or otherwise concealed on his person................a real gift for 'stop and search'

A Finextra member 

If only there were more cyber criminals as inept as "Scrutineer" at hiding their tracks then we just email them asking that they hand themselves in at the nearest police station/ psychological evaluation unit.

[Webinar] Banks and Credit Unions: How to Establish the Core Banking BlueprintFinextra Promoted[Webinar] Banks and Credit Unions: How to Establish the Core Banking Blueprint