Feeds

Chip and PIN card security compromised (again)

Relay attack hands baton to fraudsters

Top 5 reasons to deploy VMware with Tegile

Doctored payment machines could be used to lift confidential authorisation codes from Chip and PIN credit and debit cards, security researchers at Cambridge University have discovered.

Shoppers attempting to use fake terminals to make purchases might unwittingly allow scammers to hijack details and make fraudulent purchases using counterfeit cards at another shop. Card identity codes would be sent wirelessly from crooks running fake terminals to accomplices buying goods so that fake cards are accepted as genuine. The PIN is then sent from the fake terminal to the accomplice so fraudulent purchases can be authorised.

Fraudsters inside a store need to insert cards into a tampered machine without detection and inform their accomplices to stand by for the attack to succeed.

Cambridge University researchers are due to demonstrate the attack on Tuesday's edition of the BBC's consumer rights magazine show Watchdog. The programme features a demo of a cardholder's details being intercepted during a transaction in a book shop and sent to an accomplice via a wireless connection.

UK banking association APACS played down the threat of the attack by saying there's no evidence that the technique has been applied to make fraudulent purchases. "I think we should be more concerned about other types of fraud - there is no evidence that this is about to happen," Apacs' Sandra Quinn told the BBC.

Cambridge University researcher Steven J Murdoch agrees that it's unlikely criminals are currently using this so-called "Chip & Spin" attack, since the next-generation cards remain open to less sophisticated attacks. But, he argues that defences against the attack ought to be applied sooner rather than later to prevent relay attacks becoming a significant cause of fraud in the future. ®

Internet Security Threat Report 2014

More from The Register

next story
'Kim Kardashian snaps naked selfies with a BLACKBERRY'. *Twitterati gasps*
More alleged private, nude celeb pics appear online
Home Depot ignored staff warnings of security fail laundry list
'Just use cash', former security staffer warns friends
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Snowden, Dotcom, throw bombs into NZ election campaign
Claim of tapped undersea cable refuted by Kiwi PM as Kim claims extradition plot
Freenode IRC users told to change passwords after securo-breach
Miscreants probably got in, you guys know the drill by now
THREE QUARTERS of Android mobes open to web page spy bug
Metasploit module gobbles KitKat SOP slop
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.