Feeds

Industry groups leap to Chip and PIN's defence

Despite research showing signs of terminal weakness

The essential guide to IT transformation

"This latest vulnerability has not been the first flaw we have found in Chip & PIN and it is very likely there are others still to be found. So we are arguing that if the card payments system is going to be made secure, it needs to be redesigned using more robust security principles, and massively simplified," he added.

Sign of the times

One Reg reader raised a serious objection to how the attack might work in practice that we raised with the Cambridge team. The anonymous commentary asked how the transaction data would contain the digitally signed information the EMV chip calculates on basis of the PIN verification as, without that, it would be difficult to hold a cardholder responsible for a fraudulent transaction.

This does not present an obstacle to the attack, Murdoch explained in a detailed rebuttal (below).

In the existing EMV system there is no digital signature calculated over the result of PIN verification. With static data authentication (SDA) cards, there is a signature calculated over the card details (account number, expiry date etc...). With dynamic data authentication (DDA) cards, the same data is signed, and the card will also generate a signature over a random number sent to it by the terminal.

In neither case is the result of PIN verification included, because the signature generation and verification happens before the PIN has even been entered.

There is a message authentication code (MAC) calculated over various transaction-related data items, including the result of PIN verification. This cannot be checked by the terminal, but can be checked by the bank which issued the card. However, it seems that banks do not detect the inconsistency. The settlement logs, which come from the terminal, will show that the PIN has been verified successfully, when the attack we proposed is used. These logs are used for dispute resolution, so I think it is quite reasonable to conclude that the bank will have evidence which shows that the correct PIN was used, even if this is wrong.

In another disputed withdrawal case I dealt with, the bank presented the merchant receipts as evidence against the customer. Again, these will (incorrectly) show that the correct PIN was used, if our attack was used.

Enter the Matrix

Meanwhile other IT suppliers, such as UK-based GrIDure, are using the Cambridge research to tout the benefit of their technology as an alternative to PINs.

“This latest revelation about Chip and PIN cards has yet again called into question the confidence we can have in our banks and their attitude to our security," GrIDsure chief exec Stephen Howes said. "Consumers are being forced to use a system that has been shown to be broken, and ultimately it will be consumers who suffer."

"Banks must consider making a wholesale change to their approach to fraud," he concluded. ®

Next gen security for virtualised datacentres

More from The Register

next story
Ice cream headache as black hat hacks sack Dairy Queen
I scream, you scream, we all scream 'DATA BREACH'!
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
New Snowden leak: How NSA shared 850-billion-plus metadata records
'Federated search' spaffed info all over Five Eyes chums
Three quarters of South Korea popped in online gaming raids
Records used to plunder game items, sold off to low lifes
Oz fed police in PDF redaction SNAFU
Give us your metadata, we'll publish your data
prev story

Whitepapers

5 things you didn’t know about cloud backup
IT departments are embracing cloud backup, but there’s a lot you need to know before choosing a service provider. Learn all the critical things you need to know.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Backing up Big Data
Solving backup challenges and “protect everything from everywhere,” as we move into the era of big data management and the adoption of BYOD.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?