Pages

Jump to bottom

2 comments

1 abolitionist  Thu, Jan 23, 2014 11:16:58am

From a Sept 2012 research report:

Chip and Skim: cloning EMV cards
with the pre-play attack
Mike Bond, Omar Choudary, Steven J. Murdoch,
Sergei Skorobogatov, and Ross Anderson
forename.lastname@cl.cam.ac.uk
Computer Laboratory, University of Cambridge, UK
Abstract
EMV, also known as “Chip and PIN”, is the leading system for card payments world-
wide. It is used throughout Europe and much of Asia, and is starting to be introduced
in North America too. Payment cards contain a chip so they can execute an authentica-
tion protocol. This protocol requires point-of-sale (POS) terminals or ATMs to generate
a nonce, called the unpredictable number, for each transaction to ensure it is fresh. We
have discovered that some EMV implementers have merely used counters, timestamps or
home-grown algorithms to supply this number. This exposes them to a “pre-play” attack
which is indistinguishable from card cloning from the standpoint of the logs available to
the card-issuing bank, and can be carried out even if it is impossible to clone a card phys-
ically (in the sense of extracting the key material and loading it into another card). Card
cloning is the very type of fraud that EMV was supposed to prevent.
[snip]

The first flaw is that the EMV protocol designers did not think through carefully enough
what is required for it to be “unpredictable”. The specifications and conformance testing
procedures simply require that four consecutive transactions performed by the terminal should
have unique unpredictable numbers [7, test 2CM.085.00].

I was initially optimistic upon learning from my bank that I’d be getting a new chip-n-pin MC in a few weeks. Now, not so much.

Links:
lightbluetouchpaper.org
krebsonsecurity.com

2 PeterWolf  Thu, Jan 23, 2014 4:41:18pm

No system is perfect. It’s simply a game. The good guys get one up on the bad guys, the bad guys work till they get one up on the good guys. Rinse and repeat.


This page has been archived.
Comments are closed.

Jump to top

Create a PageThis is the LGF Pages posting bookmarklet. To use it, drag this button to your browser's bookmark bar, and title it 'LGF Pages' (or whatever you like). Then browse to a site you want to post, select some text on the page to use for a quote, click the bookmarklet, and the Pages posting window will appear with the title, text, and any embedded video or audio files already filled in, ready to go.
Or... you can just click this button to open the Pages posting window right away.
Last updated: 2023-04-04 11:11 am PDT
LGF User's Guide RSS Feeds

Help support Little Green Footballs!

Subscribe now for ad-free access!Register and sign in to a free LGF account before subscribing, and your ad-free access will be automatically enabled.

Donate with
PayPal
Cash.app
Recent PagesClick to refresh
Once Praised, the Settlement to Help Sickened BP Oil Spill Workers Leaves Most With Nearly Nothing When a deadly explosion destroyed BP’s Deepwater Horizon drilling rig in the Gulf of Mexico, 134 million gallons of crude erupted into the sea over the next three months — and tens of thousands of ordinary people were hired ...
Cheechako
Yesterday
Views: 64 • Comments: 0 • Rating: 0
Texas County at Center of Border Fight Is Overwhelmed by Migrant Deaths EAGLE PASS, Tex. - The undertaker lighted a cigarette and held it between his latex-gloved fingers as he stood over the bloated body bag lying in the bed of his battered pickup truck. The woman had been fished out ...
Cheechako
4 days ago
Views: 167 • Comments: 0 • Rating: 1