Pages

Jump to bottom

2 comments

1 abolitionist  Thu, Jan 23, 2014 11:16:58am

From a Sept 2012 research report:

Chip and Skim: cloning EMV cards
with the pre-play attack
Mike Bond, Omar Choudary, Steven J. Murdoch,
Sergei Skorobogatov, and Ross Anderson
forename.lastname@cl.cam.ac.uk
Computer Laboratory, University of Cambridge, UK
Abstract
EMV, also known as “Chip and PIN”, is the leading system for card payments world-
wide. It is used throughout Europe and much of Asia, and is starting to be introduced
in North America too. Payment cards contain a chip so they can execute an authentica-
tion protocol. This protocol requires point-of-sale (POS) terminals or ATMs to generate
a nonce, called the unpredictable number, for each transaction to ensure it is fresh. We
have discovered that some EMV implementers have merely used counters, timestamps or
home-grown algorithms to supply this number. This exposes them to a “pre-play” attack
which is indistinguishable from card cloning from the standpoint of the logs available to
the card-issuing bank, and can be carried out even if it is impossible to clone a card phys-
ically (in the sense of extracting the key material and loading it into another card). Card
cloning is the very type of fraud that EMV was supposed to prevent.
[snip]

The first flaw is that the EMV protocol designers did not think through carefully enough
what is required for it to be “unpredictable”. The specifications and conformance testing
procedures simply require that four consecutive transactions performed by the terminal should
have unique unpredictable numbers [7, test 2CM.085.00].

I was initially optimistic upon learning from my bank that I’d be getting a new chip-n-pin MC in a few weeks. Now, not so much.

Links:
lightbluetouchpaper.org
krebsonsecurity.com

2 PeterWolf  Thu, Jan 23, 2014 4:41:18pm

No system is perfect. It’s simply a game. The good guys get one up on the bad guys, the bad guys work till they get one up on the good guys. Rinse and repeat.


This page has been archived.
Comments are closed.

Jump to top

Create a PageThis is the LGF Pages posting bookmarklet. To use it, drag this button to your browser's bookmark bar, and title it 'LGF Pages' (or whatever you like). Then browse to a site you want to post, select some text on the page to use for a quote, click the bookmarklet, and the Pages posting window will appear with the title, text, and any embedded video or audio files already filled in, ready to go.
Or... you can just click this button to open the Pages posting window right away.
Last updated: 2023-04-04 11:11 am PDT
LGF User's Guide RSS Feeds

Help support Little Green Footballs!

Subscribe now for ad-free access!Register and sign in to a free LGF account before subscribing, and your ad-free access will be automatically enabled.

Donate with
PayPal
Cash.app
Recent PagesClick to refresh
A Water War Is Brewing Between the U.S. And Mexico. Here’s Why A water dispute between the United States and Mexico that goes back decades is turning increasingly urgent in Texas communities that rely on the Rio Grande. Their leaders are now demanding the Mexican government either share water or face ...
Cheechako
Yesterday
Views: 105 • Comments: 0 • Rating: 1
Harper’s Magazine: Slippery Slope - How Private Equity Shapes a Ski Town …Big Sky stands apart for other reasons. The obvious distinction is the Yellowstone Club, a private resort hidden in the mountains above the community that Justin Farrell, a professor of sociology at Yale and the author of Billionaire Wilderness, ...
teleskiguy
3 days ago
Views: 307 • Comments: 0 • Rating: 2