Feeds

Chip and PIN security busted

UnVerified by PIN attack undermines bank security assurances

SANS - Survey on application security programs

Security researchers have demonstrated a gaping security hole in Chip and PIN credit card authorisations which undermines trust in the technology as a means to verify retail purchases.

Cambridge University security researchers have demonstrated how it might be possible to trick the card into thinking it’s doing a chip-and-signature transaction while the terminal thinks it’s authorised by chip-and-PIN. The flaw creates a means to make transactions that are "Verified by PIN" using a stolen (uncancelled) card without knowing the PIN number.

Fraudsters would insert a "wedge" between the stolen card and terminal, tricking the terminal into believing that the PIN was correctly verified.

It's not surprising that the attack works when a terminal is offline but it works when the terminal is connected too. Victims of fraud who complain of phantom transactions are denied refunds in cases where a purchase is PIN verified. The attack undermines faith in the banking industry’s claim that its systems are secure.

Saar Drimer, one of the Cambridge researchers, warned: "The technical sophistication for carrying out this attack is low, and the compact equipment will not be noticed by shop staff. A single criminal can develop and industrialize a kit to be used by others who do not need to understand how the attack works.”

The man-in-middle attack outlined by the Cambridge researchers doesn’t work at ATMs but it can work regardless of the amount spent in retail transactions. The security shortcomings apply to cards based on EMV (Eurocard Mastercard Visa), the most widely deployed standard for smartcard payments, which is used millions of credit and debit cards, mostly in Europe.

The research was carried out by Steven J Murdoch, Saar Drimer, Ross Anderson and Mike Bond, researchers at the Computer Laboratory, University of Cambridge, and is due to be presented at the IEEE Symposium on Security and Privacy conference in Oakland in May (draft paper here in pdf). Researchers from the team demonstrated the attack in an episode of the BBC Newsnight programme on Thursday night.

"There is a gaping hole in the specifications which together create the 'Chip and PIN' system... The EMV specification stack is broken, and needs fixing," the researchers conclude in a blog posting.

"We’re really worried that if something isn’t done to fix this problem, and the many others we’ve found in EMV, other regions adopting it (like the USA) are going to make the same mistakes again and again – and that means customers stay vulnerable."

"That’s why again we’re arguing that Chip and PIN is broken. We don’t want people keeping their money in shoe boxes – we want the problems fixed. That means getting decent governance for the system that involves all the stakeholders – banks, regulators, merchants and customers." ®

Combat fraud and increase customer satisfaction

More from The Register

next story
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
prev story

Whitepapers

Designing a defence for mobile apps
In this whitepaper learn the various considerations for defending mobile applications; from the mobile application architecture itself to the myriad testing technologies needed to properly assess mobile applications risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.