“Cambridge University computer scientists’ discovery of a way to carry out transactions without knowing a card's PIN has hit the headlines; however consumers should not lose faith in credit card security," Brunswick said. "Chip and PIN is by far and away the most secure way of protecting payment transactions currently available."
Brunswick acknowledged that the Cambridge's team research "could be an important input to future revisions of card security technologies”, while arguing that the bigger problem is slow adoption in some parts of the world of improved payment security technologies such as Chip and PIN.
“No security system can claim to be completely bulletproof - there is always a three-way trade off between cost, ease of use and security and the industry is constantly looking for improvements. Consequently, the aim of security systems is not to make security unbreakable but to make it unprofitable for criminals to attempt to break it. The benefits of Chip and PIN are proven. Once the UK adopted Chip and PIN in 2003, losses on UK high street transactions reduced by 55 per cent by 2008. However, not all countries have followed suit and the US, for example, still uses magnetic stripe cards with signature verification."
"Verification by signature remains an option even for EMV cards, and it is the availability of this weaker security that has been exploited by the attack highlighted by Cambridge University", he added.
Gareth Wokes, chairman of secure payment specialist The Logic Group, struck a more combative pose, describing the Cambridge research as "alarmist" and "missing the point".
The Logic Group handles transactions across more than 250,000 points of sale (PoS) in the UK, the type of payment the Cambridge researchers argue has been left in the firing line of man-in-the-middle attacks. Wokes is dismissive of such concerns, arguing that banks and the payment industry have invested millions to fight fraud.
“I find the tone of this dumbed-down research alarmist. Fraudsters are always pushing the barriers and trying to find new ways to navigate security measures; it is not a static situation. And just as the fraudsters continue to innovate so too does the payment industry, which invests vast sums of money in continuous improvements to card payment security", Wokes said.
Wokes took particular exception to "Professor Anderson’s claim that the banks will have to re-write the software around the entire chip and PIN system also misses the point – they are constantly improving card payment security and will continue to do so as long as card fraud exists," Wokes said. "To position this as an overall failure of chip and PIN is also misleading and counter-productive to the industry’s efforts against fraud.
"A year after Chip and PIN was introduced, card fraud dropped by 48 per cent. The issue is that fraudsters then moved on to e-commerce fraud (where chip and PIN is irrelevant), which is why fraud figures subsequently began to increase again. It’s a constant battle to close down loopholes and the rules of engagement change month to month and even day to day," Wokes said. He cited the PCI DSS payment card industry standard for merchants as an example of industry efforts to improve transaction security.
Steven Murdoch, one of the four Cambridge University researchers who carried out the study, told El Reg that probably the best way of fixing the flaw in the credit card transaction process his team has identified would involve changing bank back-end systems.
"To fix this particular vulnerability, there does need to be a software change. It may only have to be at the banks, but it is possible that the terminals and/or cards would need to be upgraded too. We suggested a number of potential fixes in our paper, but have not heard which ones the banks are actually going to do," Murdoch explained.
The security researcher added that the security hole the Cambridge team has identified stems from the complex web of payment transaction and bank authorisation technologies that badly need untangling even before they are strengthened.
"The more general point we are making is that this flaw has existed for over ten years, and nobody has spotted it (unless criminals have done so, but kept it quiet). The main reason is that Chip & PIN is incredibly complicated, with thousands of pages of vague, ambiguous, and incomplete specifications," Murdoch explained.
It is all about the burden of proof
With magnetic stripes and signatures, banks and retailers had the burden of proof to show that a disputed transaction was not fraud. Otherwise the cardholder did not pay the disputed transaction.
With chip & pin, by default if the pin verification is supposedly completed, the cardholder is on the hook and the burden of proof on possible fraud rests on him. Which is nice, as individuals do not have the resources to fight such disputes.
I don't really care about the technical details of the system - that's bank's business, they want to prevent losses to them, by all means, do whatever you want. However, if said technology is used to shift the burden of proof to the customer, it has to be absolutely 100% bulletproof. Chip & pin demonstrably is not. Just change the assumption back to magnetic stripe/signature mode - burden of proof lies with the bank and/or the merchant to prove that the cardholder made the disputed purchase (more than just "we have these logs that show you inputted the pin") or the cardholder is not liable and the current system is fine.
Why can't we just skip this whole technical stuff and try simple social engineering.
Change the law so that a bank is responsible for all fraud or theft made on one of their cards until such a time as the customer holding the card is convicted by a jury of their peers of *deliberate* theft or fraud. And by "responsible", I mean "you have to give the complainant their money back the instant they report it".
Then we'll be spared all the banks lies about how chip and pin is secure and force them to implement a security scheme that is good enough to reduce their losses to an acceptable level.
Mine's the one with a wodge of non-sequential notes, a chequebook, an rfid blocker and a signed credit card (and microwaved chip) in the pocket.
Verified by Visa
So, there is yet another way around chip and pin. Ultimately it's pretty similar to
and plenty more.
What has been most interesting has been the banks response to these failings - that they have introduced the Verified by Visa scheme which includes a condition that transfers any liability for losses onto the customer. I do wonder what is the point of having regulatory bodies when banks are free to act like that in response to security breaches,