Feeds

Industry groups leap to Chip and PIN's defence

Despite research showing signs of terminal weakness

Protecting against web application threats using SSL

“Cambridge University computer scientists’ discovery of a way to carry out transactions without knowing a card's PIN has hit the headlines; however consumers should not lose faith in credit card security," Brunswick said. "Chip and PIN is by far and away the most secure way of protecting payment transactions currently available."

Brunswick acknowledged that the Cambridge's team research "could be an important input to future revisions of card security technologies”, while arguing that the bigger problem is slow adoption in some parts of the world of improved payment security technologies such as Chip and PIN.

“No security system can claim to be completely bulletproof - there is always a three-way trade off between cost, ease of use and security and the industry is constantly looking for improvements. Consequently, the aim of security systems is not to make security unbreakable but to make it unprofitable for criminals to attempt to break it. The benefits of Chip and PIN are proven. Once the UK adopted Chip and PIN in 2003, losses on UK high street transactions reduced by 55 per cent by 2008. However, not all countries have followed suit and the US, for example, still uses magnetic stripe cards with signature verification."

"Verification by signature remains an option even for EMV cards, and it is the availability of this weaker security that has been exploited by the attack highlighted by Cambridge University", he added.

Change up

Gareth Wokes, chairman of secure payment specialist The Logic Group, struck a more combative pose, describing the Cambridge research as "alarmist" and "missing the point".

The Logic Group handles transactions across more than 250,000 points of sale (PoS) in the UK, the type of payment the Cambridge researchers argue has been left in the firing line of man-in-the-middle attacks. Wokes is dismissive of such concerns, arguing that banks and the payment industry have invested millions to fight fraud.

“I find the tone of this dumbed-down research alarmist. Fraudsters are always pushing the barriers and trying to find new ways to navigate security measures; it is not a static situation. And just as the fraudsters continue to innovate so too does the payment industry, which invests vast sums of money in continuous improvements to card payment security", Wokes said.

Wokes took particular exception to "Professor Anderson’s claim that the banks will have to re-write the software around the entire chip and PIN system also misses the point – they are constantly improving card payment security and will continue to do so as long as card fraud exists," Wokes said. "To position this as an overall failure of chip and PIN is also misleading and counter-productive to the industry’s efforts against fraud.

"A year after Chip and PIN was introduced, card fraud dropped by 48 per cent. The issue is that fraudsters then moved on to e-commerce fraud (where chip and PIN is irrelevant), which is why fraud figures subsequently began to increase again. It’s a constant battle to close down loopholes and the rules of engagement change month to month and even day to day," Wokes said. He cited the PCI DSS payment card industry standard for merchants as an example of industry efforts to improve transaction security.

Steven Murdoch, one of the four Cambridge University researchers who carried out the study, told El Reg that probably the best way of fixing the flaw in the credit card transaction process his team has identified would involve changing bank back-end systems.

"To fix this particular vulnerability, there does need to be a software change. It may only have to be at the banks, but it is possible that the terminals and/or cards would need to be upgraded too. We suggested a number of potential fixes in our paper, but have not heard which ones the banks are actually going to do," Murdoch explained.

Hairball

The security researcher added that the security hole the Cambridge team has identified stems from the complex web of payment transaction and bank authorisation technologies that badly need untangling even before they are strengthened.

"The more general point we are making is that this flaw has existed for over ten years, and nobody has spotted it (unless criminals have done so, but kept it quiet). The main reason is that Chip & PIN is incredibly complicated, with thousands of pages of vague, ambiguous, and incomplete specifications," Murdoch explained.

Reducing the cost and complexity of web vulnerability management

Next page: Sign of the times

More from The Register

next story
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.