Feeds

Industry groups leap to Chip and PIN's defence

Despite research showing signs of terminal weakness

Internet Security Threat Report 2014

“Cambridge University computer scientists’ discovery of a way to carry out transactions without knowing a card's PIN has hit the headlines; however consumers should not lose faith in credit card security," Brunswick said. "Chip and PIN is by far and away the most secure way of protecting payment transactions currently available."

Brunswick acknowledged that the Cambridge's team research "could be an important input to future revisions of card security technologies”, while arguing that the bigger problem is slow adoption in some parts of the world of improved payment security technologies such as Chip and PIN.

“No security system can claim to be completely bulletproof - there is always a three-way trade off between cost, ease of use and security and the industry is constantly looking for improvements. Consequently, the aim of security systems is not to make security unbreakable but to make it unprofitable for criminals to attempt to break it. The benefits of Chip and PIN are proven. Once the UK adopted Chip and PIN in 2003, losses on UK high street transactions reduced by 55 per cent by 2008. However, not all countries have followed suit and the US, for example, still uses magnetic stripe cards with signature verification."

"Verification by signature remains an option even for EMV cards, and it is the availability of this weaker security that has been exploited by the attack highlighted by Cambridge University", he added.

Change up

Gareth Wokes, chairman of secure payment specialist The Logic Group, struck a more combative pose, describing the Cambridge research as "alarmist" and "missing the point".

The Logic Group handles transactions across more than 250,000 points of sale (PoS) in the UK, the type of payment the Cambridge researchers argue has been left in the firing line of man-in-the-middle attacks. Wokes is dismissive of such concerns, arguing that banks and the payment industry have invested millions to fight fraud.

“I find the tone of this dumbed-down research alarmist. Fraudsters are always pushing the barriers and trying to find new ways to navigate security measures; it is not a static situation. And just as the fraudsters continue to innovate so too does the payment industry, which invests vast sums of money in continuous improvements to card payment security", Wokes said.

Wokes took particular exception to "Professor Anderson’s claim that the banks will have to re-write the software around the entire chip and PIN system also misses the point – they are constantly improving card payment security and will continue to do so as long as card fraud exists," Wokes said. "To position this as an overall failure of chip and PIN is also misleading and counter-productive to the industry’s efforts against fraud.

"A year after Chip and PIN was introduced, card fraud dropped by 48 per cent. The issue is that fraudsters then moved on to e-commerce fraud (where chip and PIN is irrelevant), which is why fraud figures subsequently began to increase again. It’s a constant battle to close down loopholes and the rules of engagement change month to month and even day to day," Wokes said. He cited the PCI DSS payment card industry standard for merchants as an example of industry efforts to improve transaction security.

Steven Murdoch, one of the four Cambridge University researchers who carried out the study, told El Reg that probably the best way of fixing the flaw in the credit card transaction process his team has identified would involve changing bank back-end systems.

"To fix this particular vulnerability, there does need to be a software change. It may only have to be at the banks, but it is possible that the terminals and/or cards would need to be upgraded too. We suggested a number of potential fixes in our paper, but have not heard which ones the banks are actually going to do," Murdoch explained.

Hairball

The security researcher added that the security hole the Cambridge team has identified stems from the complex web of payment transaction and bank authorisation technologies that badly need untangling even before they are strengthened.

"The more general point we are making is that this flaw has existed for over ten years, and nobody has spotted it (unless criminals have done so, but kept it quiet). The main reason is that Chip & PIN is incredibly complicated, with thousands of pages of vague, ambiguous, and incomplete specifications," Murdoch explained.

Remote control for virtualized desktops

Next page: Sign of the times

More from The Register

next story
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
Astro-boffins start opening universe simulation data
Got a supercomputer? Want to simulate a universe? Here you go
State Dept shuts off unclassified email after hack. Classified mail? That's CLASSIFIED
Classified systems 'not affected' - but, is this reconnaissance?
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
How to determine if cloud backup is right for your servers
Two key factors, technical feasibility and TCO economics, that backup and IT operations managers should consider when assessing cloud backup.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Protecting against web application threats using SSL
SSL encryption can protect server‐to‐server communications, client devices, cloud resources, and other endpoints in order to help prevent the risk of data loss and losing customer trust.