10 ms·

X-Ray Scans Expose Chip-And-Pin Card Hack

185 points by miralabs 11y ago

kbenson 11y ago
That's amazing. They were able to MITM the chip-and-pin chip by taking it out and attaching it to another hobbyist chip that's capable of spoofing the response, and the whole thing when put back in the card was only a slight bulge bigger than the original. They say nearly 600k Euros were charged, but given the sophistication of the attack, I wouldn't be surprised if we hear later that it was in use at different locations as well, and we just aren't hearing about it because they haven't caught those people yet. They only caught these ones because they kept going back to the same locations.
- tejaswiy 11y ago
  It's a clever hack, but shouldn't people have thought of this before they developed the whole protocol? How can any random chip answer a "true" response to the pin request? Shouldn't it have some sort of authorization built-in? Maybe public / private key with a bunch of implicitly trusted public keys? As I say that, I guess this relies on having a network connection which cannot be assumed when you're developing a POS. Hmm.
  - joosters 11y ago
    Yeah, it'd be a huge complication to maintain and update the keys across all the terminals, many of which are not network attached. Plus an attacker could extract a key from the chip (probably hard, due to anti-tampering technology, but not impossible)
  - kbenson 11y ago
    Although I'm pretty sure when you are talking about validating a credit card, a network connection is a given. Otherwise how do you authorize or deny the purchase?
    - BHSPitMonkey 11y ago
      Maybe it's a possibility that the POS is networked but the physical card reader hardware is not?
      - kbenson 11y ago
        The reverse is more likely in the US. There's plenty of old legacy POS systems/registers, which have a card reader that's with it, attached or not. The only way I've ever seen a card run without a network (whether it be an existing network or an integrated modem and phone line), is when there's a power outage and someone busts out one of the old carbon copy manual card machines, where they take an impression of the card. Those may not even be accepted anymore, since they don't deal with CVV numbers and some cards don't even have embossed numbers anymore.
- jessaustin 11y ago
  Don't keep purchasing at the same merchants; that's like Carder 101! Regardless, this whole "ask the card if the PIN was right" protocol is just dumb. Surely they could have e.g. had the card sign a challenge in a way it could only do if given the right PIN? That gets slightly more complicated when revoking old PINs or issuing new ones, but it would still be possible. For all we heard about the wonders of C'n'P, this seems to fall short. If you're going to the expense of chipping all those cards and replacing all those terminals, at least get the software right.
  - kbenson 11y ago
    > Don't keep purchasing at the same merchants; that's like Carder 101! I know! It's the stupid details and extra people they bring in that seems to eventually get these rings caught. > Surely they could have e.g. had the card sign a challenge in a way it could only do if given the right PIN? Well, the article seemed to imply the chip put in the CC was from a different card, so maybe they know the pin for that chip, and the MITM is really about the authentication of the chip in the wrong card? Later they do seem to imply the fix was to authenticate the chip, but I'm not sure without reading the original paper if that's an over-simplification of what the fix was, and maybe it's better authentication of the chip.
  - joosters 11y ago
    But the chip is the only part of the communication that knows the PIN. (the protocol does not need a network connection to the bank). The chips could be made to sign their response with a bank's private key and the terminal checks this against a known list of banks. But that would be cumbersome (lots of banks, lots of keys), the terminals would need to be constantly updated to keep the key list up to date, and it all falls apart when a key is extracted out of the chip. Now if the protocol required a network connection to the bank, you could speak to the bank to validate a PIN instead of talking to the chip at all.
    - bravo22 11y ago
      They signed transaction would indeed fix this issue but it was ignored by the bank (to their detriment) for other reasons. The implementation is actually pretty decent. It doesn't require key management the way you describe it. Banks use a derived key schemes for EMV transactions. In a way you can think of it as PKI. In any event, the actual verification doesn't happen on the terminal. The terminal is supposed to take the signed transaction and pass it up through the network where it will end up with the originating bank who will say "Yes, we accept it", or "No, we don't accept this charge". This is something that happens today but it is the CC# and the CVV that get passed. If they are revealed/stolen you're screwed.
- TeMPOraL 11y ago
  Makes me wonder if carder community has systems to protect from and/or punish idiots with poor OPSEC. It takes only one such idiot to ruin a perfectly good attack vector.
  - kbenson 11y ago
    My understanding is that the online forums for this work quite a bit on reputation (for sellers at least). I can imagine people that use these hacks remove themselves from the ecosystem when they get caught. I also imagine the selling of this hack, if it happened, was probably brokered as a unique sale where the seller would not resell the hack, similar to how I imagine a lot of high-end zero-day exploits are sold. This, of course, is where the seller reputation would come into play.
Sleaker 11y ago
I'm dealing with development on some of this right now for US based POS customers and so far everything I've been told is that the US isn't even going to attempt to utilize the PIN entry capabilities, so we're still using signature validation in case of fraud. I'm not sure how this is any better than MSRs. The whole spoofing PIN validation thing doesn't even come into play because it's not even going to be checked.
- ghshephard 11y ago
  "signature validation " I've left the back of my credit-card unsigned for 2+ years, and in that entire time, and north of 500+ transactions with a signature, I've been asked for identification less than 10 times. I wonder if there has been a single person challenged on a signature in the last 5+ years with a credit card if they even made the slightest attempt to sign in a fashion similar to what's on the back of the card?
  - hga 11y ago
    Tip from my father, who switched from cash to almost all credit cards at POS: write "Photo ID Req." in permanent marker in the signature area. And, hey, one time when he sent me in to BBQ joint for some takeout with his card the cashier did look, but I was able to show my ID and make a plausible case for being his eldest son ^_^.
    - ghshephard 11y ago
      How often do people actually request Photo ID?
      - fweespeech 11y ago
        Certain organizations require cashiers to check ID 100% of the time. They generally deal with high value purchases (3-4 figures). But outside of those? Almost never.
    - MichaelGG 11y ago
bmsleight_ 11y ago
Found some details of the cards http://www.infinityusb.com/default.asp?show=store&ProductGrp=8 http://www.infinityusb.com/default.asp?show=store&ProductGrp...
- rasz_pl 11y ago
  no, afaik this article talks about super thin shim glued on top of real chip on real card but I guess you could use cards you linked IF you drill them, cut real chip from real card, place it in drilled hole, cover hole so its not visible, print card over with authentic looking color scheme/logo, stamp number, sounds like a lot of work
ajross 11y ago
FTA: A fraudulent chip can listen for that query and pre-empt the real chip with its own answer: a “yes” signal regardless of whatever random PIN the fraudster has entered. “The attacker intercepts the PIN query and replies that it’s correct, whatever the code is,” Wait, what? How is that the protocol? There's no two way validation at all? The chip just says "yes"?! Can anyone with knowledge of details confirm? This seems isomorphic to my ears with "the PIN is just security theater".
- deutronium 11y ago
  I believe there is either Online or Offline PIN verification. http://www.smartcardalliance.org/publications-emv-faq/#q14 http://www.smartcardalliance.org/publications-emv-faq/#q14
- cnvogel 11y ago
  > The chip just says "yes"?! Yes. From https://www.cl.cam.ac.uk/research/security/banking/nopin/oakland10chipbroken.pdf https://www.cl.cam.ac.uk/research/security/banking/nopin/oak... page 446 (last page), T: Terminal, M: "Man in the Middle": T → M 00 20 00 80 08 24 00 00 ff ff ff ff ff Verify PIN “0000” M → T 90 00 PIN correct
- bravo22 11y ago
  In this case the fault lies with the bank. The chip can authenticate the transaction and also optionally cryptographically sign it as verified. The bank should check the last step but most/some don't because a lot of the first wave of terminals that went out didn't have full/proper implementation, therefore they only relied on the chip saying "yeah it looks good", instead of "yeah it looks good, btw here is my signature on this transaction which you can pass to the bank to verify that it really is kosher". So it is more an issue of the bank accepting partially verified transactions on large dollar amounts.
  - ChuckMcM 11y ago
    Really? Its like the banks saying "really all this fraud stuff isn't really our problem."
derekp7 11y ago
I was under the impression that the card created a cryptographic signature on the transaction, and the card had to receive the correct pin before it would sign it. Which is why you have to leave the card in the reader until the total is completed. Is this really not the case? Or does the card still cryptographically sign the transaction, but doesn't process the PIN first (other than answering valid/invalid)?
893helios 11y ago
What's this (Chip and Pin) being crap already disclosed here? https://media.blackhat.com/bh-us-11/Laurie/BH_US_11_Laurie_Chip_Pin-Slides.pdf https://media.blackhat.com/bh-us-11/Laurie/BH_US_11_Laurie_C...
klagermkii 11y ago
Watched this a couple of days ago and found it quite interesting talking about C&P flaws https://www.youtube.com/watch?v=Ks0SOn8hjG8 https://www.youtube.com/watch?v=Ks0SOn8hjG8
- bardworx 11y ago
  Great video. I just posted it in a reply to another comment. My biggest takeaway is that all systems are safe until the bad guys really try to break them.
coleca 11y ago
> "They also note that other protections have been added to the system at the network level, which they decline to detail for fear of tipping off criminals." Security by obscurity. That's always a good plan. I'm sure that folks who went through all this trouble to design this hack wouldn't ever be able to find that information. </sarcasm>
JimmaDaRustla 11y ago
This is technically old news - as the article states, it has since been resolved. Edit: I guess they're shedding new light on how they performed the hack. Another thing, in context of USA, is that the authentication being done isn't much of a vulnerability as this only applies to offline chip transactions. In the USA (I believe) and here in Canada, all transactions are online, which means the pin will be rejected by your financial institute's back end systems in these scenarios. These types of hacks have since been corrected using what is called CDA (Combined Data Authentication). Blurb on SDA/DDA/CDA here: http://www.cryptomathic.com/hubfs/docs/cryptomathic_white_paper-emv_key_management.pdf http://www.cryptomathic.com/hubfs/docs/cryptomathic_white_pa... Edit: Many Canadian financial institutes still use the weakest data authentication (SDA) because all transactions go online - spoofing a card PIN verification response doesn't fool the back-end system. Visa and Mastercard both have mandates to have newly issued cards be provisioned on chips with CDA (I believe, could be DDA which would still be susceptible to this attack). Edit 2: When I say "offline", I mean at a point of sale machine - the POS does not reach out to the payment network to perform an "online" transaction where the PIN and card are validated by the back-end systems. Edit 3: The article doesn't give EMVCo any credit for actually solving the issue before any real world hack was known to exist.
- cjhopman 11y ago
  If you read the linked paper, this vulnerability is not limited to offline transactions. Edit: clarification, there are sort of three types of transactions-- offline - vulnerable to this (and a simpler attack) online w/ offline pin - vulnerable online w/ online pin - not vulnerable
  - JimmaDaRustla 11y ago
    Well, this article only applies to point of sale transactions, so it is either online or offline. Offline transaction, meaning "authorized within the acquirer domain (at acceptance device, or at the acquirer host)". In other words, the transaction does not hit the issuer's system. Edit: Even in an online transaction, offline pin is still performed, but the online would fail.
- 11y ago
jgalt212 11y ago
pretty lame if the card can just say "yes" no matter what PIN is entered. Away from being a proprietary tech, I'm not sure why fingerprinting the magnetic stripe never took off. It seems so much simpler, and if you cannot rearrange iron at the molecular level impossible to replicate. http://www.magtek.com/V2/media/whitePapers/2012/MagTek-WP-An-Introduction-to-Dynamic-Authentication-To-Launch.pdf http://www.magtek.com/V2/media/whitePapers/2012/MagTek-WP-An...
- rsfern 11y ago
  Probably it's lack of infrastructure buy-in. And personally, I find the misuse of the word biometric in the white paper off-putting, along with the lack of detail on the basis for the technique. The fingerprint is somehow related to the magnetic particle distribution--how stable is it against weak magnetic fields, or against heat? If you really can reliably get magnetic signatures, it would be really hard to clone cards. Edit: the particles won't really change, but their magnetic states feasibly could
nathanb 11y ago
Let's not lose sight of one thing -- this doesn't make chip-and-pin less secure than swipe-and-sign, it just makes it no more secure, in the worst case.
- kbenson 11y ago
  It's not just about security though, it's also about liability. Chip-and-pin may have different liability rules than have been established for signatures. If so, then a hacked chip-and-pin system may be no less secure for the consumer, but it may be much more costly.
ck2 11y ago
So those millions spent replacing everyone's card and all the vendors merchant machines was a waste. Besides you can just use the chipped card online without the chip or pin?
ljk 11y ago
So is the safest way just to use cash?
akavel 11y ago
Noteworthy: For the Cambridge researchers, the French attack is an “I-told-you-so” moment. Five years ago, EMVCo and the UK Cards Association both dismissed their attack as improbable or impossible.

185 points by miralabs 11y ago

That's amazing. They were able to MITM the chip-and-pin chip by taking it out and attaching it to another hobbyist chip that's capable of spoofing the response, and the whole thing when put back in the card was only a slight bulge bigger than the original. They say nearly 600k Euros were charged, but given the sophistication of the attack, I wouldn't be surprised if we hear later that it was in use at different locations as well, and we just aren't hearing about it because they haven't caught those people yet. They only caught these ones because they kept going back to the same locations.

tejaswiy 11y ago
It's a clever hack, but shouldn't people have thought of this before they developed the whole protocol? How can any random chip answer a "true" response to the pin request? Shouldn't it have some sort of authorization built-in? Maybe public / private key with a bunch of implicitly trusted public keys? As I say that, I guess this relies on having a network connection which cannot be assumed when you're developing a POS. Hmm.
- joosters 11y ago
  Yeah, it'd be a huge complication to maintain and update the keys across all the terminals, many of which are not network attached. Plus an attacker could extract a key from the chip (probably hard, due to anti-tampering technology, but not impossible)
- kbenson 11y ago
  Although I'm pretty sure when you are talking about validating a credit card, a network connection is a given. Otherwise how do you authorize or deny the purchase?
  - BHSPitMonkey 11y ago
    Maybe it's a possibility that the POS is networked but the physical card reader hardware is not?
    - kbenson 11y ago
      The reverse is more likely in the US. There's plenty of old legacy POS systems/registers, which have a card reader that's with it, attached or not. The only way I've ever seen a card run without a network (whether it be an existing network or an integrated modem and phone line), is when there's a power outage and someone busts out one of the old carbon copy manual card machines, where they take an impression of the card. Those may not even be accepted anymore, since they don't deal with CVV numbers and some cards don't even have embossed numbers anymore.
jessaustin 11y ago
Don't keep purchasing at the same merchants; that's like Carder 101! Regardless, this whole "ask the card if the PIN was right" protocol is just dumb. Surely they could have e.g. had the card sign a challenge in a way it could only do if given the right PIN? That gets slightly more complicated when revoking old PINs or issuing new ones, but it would still be possible. For all we heard about the wonders of C'n'P, this seems to fall short. If you're going to the expense of chipping all those cards and replacing all those terminals, at least get the software right.
- kbenson 11y ago
  > Don't keep purchasing at the same merchants; that's like Carder 101! I know! It's the stupid details and extra people they bring in that seems to eventually get these rings caught. > Surely they could have e.g. had the card sign a challenge in a way it could only do if given the right PIN? Well, the article seemed to imply the chip put in the CC was from a different card, so maybe they know the pin for that chip, and the MITM is really about the authentication of the chip in the wrong card? Later they do seem to imply the fix was to authenticate the chip, but I'm not sure without reading the original paper if that's an over-simplification of what the fix was, and maybe it's better authentication of the chip.
- joosters 11y ago
  But the chip is the only part of the communication that knows the PIN. (the protocol does not need a network connection to the bank). The chips could be made to sign their response with a bank's private key and the terminal checks this against a known list of banks. But that would be cumbersome (lots of banks, lots of keys), the terminals would need to be constantly updated to keep the key list up to date, and it all falls apart when a key is extracted out of the chip. Now if the protocol required a network connection to the bank, you could speak to the bank to validate a PIN instead of talking to the chip at all.
  - bravo22 11y ago
    They signed transaction would indeed fix this issue but it was ignored by the bank (to their detriment) for other reasons. The implementation is actually pretty decent. It doesn't require key management the way you describe it. Banks use a derived key schemes for EMV transactions. In a way you can think of it as PKI. In any event, the actual verification doesn't happen on the terminal. The terminal is supposed to take the signed transaction and pass it up through the network where it will end up with the originating bank who will say "Yes, we accept it", or "No, we don't accept this charge". This is something that happens today but it is the CC# and the CVV that get passed. If they are revealed/stolen you're screwed.
TeMPOraL 11y ago
Makes me wonder if carder community has systems to protect from and/or punish idiots with poor OPSEC. It takes only one such idiot to ruin a perfectly good attack vector.
- kbenson 11y ago
  My understanding is that the online forums for this work quite a bit on reputation (for sellers at least). I can imagine people that use these hacks remove themselves from the ecosystem when they get caught. I also imagine the selling of this hack, if it happened, was probably brokered as a unique sale where the seller would not resell the hack, similar to how I imagine a lot of high-end zero-day exploits are sold. This, of course, is where the seller reputation would come into play.

Sleaker 11y ago

I'm dealing with development on some of this right now for US based POS customers and so far everything I've been told is that the US isn't even going to attempt to utilize the PIN entry capabilities, so we're still using signature validation in case of fraud. I'm not sure how this is any better than MSRs. The whole spoofing PIN validation thing doesn't even come into play because it's not even going to be checked.

ghshephard 11y ago
"signature validation " I've left the back of my credit-card unsigned for 2+ years, and in that entire time, and north of 500+ transactions with a signature, I've been asked for identification less than 10 times. I wonder if there has been a single person challenged on a signature in the last 5+ years with a credit card if they even made the slightest attempt to sign in a fashion similar to what's on the back of the card?
- hga 11y ago
  Tip from my father, who switched from cash to almost all credit cards at POS: write "Photo ID Req." in permanent marker in the signature area. And, hey, one time when he sent me in to BBQ joint for some takeout with his card the cashier did look, but I was able to show my ID and make a plausible case for being his eldest son ^_^.
  - ghshephard 11y ago
    How often do people actually request Photo ID?
    - fweespeech 11y ago
      Certain organizations require cashiers to check ID 100% of the time. They generally deal with high value purchases (3-4 figures). But outside of those? Almost never.
  - MichaelGG 11y ago

bmsleight_ 11y ago

Found some details of the cards http://www.infinityusb.com/default.asp?show=store&ProductGrp=8 http://www.infinityusb.com/default.asp?show=store&ProductGrp...

rasz_pl 11y ago
no, afaik this article talks about super thin shim glued on top of real chip on real card but I guess you could use cards you linked IF you drill them, cut real chip from real card, place it in drilled hole, cover hole so its not visible, print card over with authentic looking color scheme/logo, stamp number, sounds like a lot of work

ajross 11y ago

FTA: A fraudulent chip can listen for that query and pre-empt the real chip with its own answer: a “yes” signal regardless of whatever random PIN the fraudster has entered. “The attacker intercepts the PIN query and replies that it’s correct, whatever the code is,” Wait, what? How is that the protocol? There's no two way validation at all? The chip just says "yes"?! Can anyone with knowledge of details confirm? This seems isomorphic to my ears with "the PIN is just security theater".

deutronium 11y ago
I believe there is either Online or Offline PIN verification. http://www.smartcardalliance.org/publications-emv-faq/#q14 http://www.smartcardalliance.org/publications-emv-faq/#q14
cnvogel 11y ago
> The chip just says "yes"?! Yes. From https://www.cl.cam.ac.uk/research/security/banking/nopin/oakland10chipbroken.pdf https://www.cl.cam.ac.uk/research/security/banking/nopin/oak... page 446 (last page), T: Terminal, M: "Man in the Middle": T → M 00 20 00 80 08 24 00 00 ff ff ff ff ff Verify PIN “0000” M → T 90 00 PIN correct
bravo22 11y ago
In this case the fault lies with the bank. The chip can authenticate the transaction and also optionally cryptographically sign it as verified. The bank should check the last step but most/some don't because a lot of the first wave of terminals that went out didn't have full/proper implementation, therefore they only relied on the chip saying "yeah it looks good", instead of "yeah it looks good, btw here is my signature on this transaction which you can pass to the bank to verify that it really is kosher". So it is more an issue of the bank accepting partially verified transactions on large dollar amounts.
- ChuckMcM 11y ago
  Really? Its like the banks saying "really all this fraud stuff isn't really our problem."

derekp7 11y ago

I was under the impression that the card created a cryptographic signature on the transaction, and the card had to receive the correct pin before it would sign it. Which is why you have to leave the card in the reader until the total is completed. Is this really not the case? Or does the card still cryptographically sign the transaction, but doesn't process the PIN first (other than answering valid/invalid)?

893helios 11y ago

What's this (Chip and Pin) being crap already disclosed here? https://media.blackhat.com/bh-us-11/Laurie/BH_US_11_Laurie_Chip_Pin-Slides.pdf https://media.blackhat.com/bh-us-11/Laurie/BH_US_11_Laurie_C...

klagermkii 11y ago

Watched this a couple of days ago and found it quite interesting talking about C&P flaws https://www.youtube.com/watch?v=Ks0SOn8hjG8 https://www.youtube.com/watch?v=Ks0SOn8hjG8

bardworx 11y ago
Great video. I just posted it in a reply to another comment. My biggest takeaway is that all systems are safe until the bad guys really try to break them.

coleca 11y ago

> "They also note that other protections have been added to the system at the network level, which they decline to detail for fear of tipping off criminals." Security by obscurity. That's always a good plan. I'm sure that folks who went through all this trouble to design this hack wouldn't ever be able to find that information. </sarcasm>

JimmaDaRustla 11y ago

This is technically old news - as the article states, it has since been resolved. Edit: I guess they're shedding new light on how they performed the hack. Another thing, in context of USA, is that the authentication being done isn't much of a vulnerability as this only applies to offline chip transactions. In the USA (I believe) and here in Canada, all transactions are online, which means the pin will be rejected by your financial institute's back end systems in these scenarios. These types of hacks have since been corrected using what is called CDA (Combined Data Authentication). Blurb on SDA/DDA/CDA here: http://www.cryptomathic.com/hubfs/docs/cryptomathic_white_paper-emv_key_management.pdf http://www.cryptomathic.com/hubfs/docs/cryptomathic_white_pa... Edit: Many Canadian financial institutes still use the weakest data authentication (SDA) because all transactions go online - spoofing a card PIN verification response doesn't fool the back-end system. Visa and Mastercard both have mandates to have newly issued cards be provisioned on chips with CDA (I believe, could be DDA which would still be susceptible to this attack). Edit 2: When I say "offline", I mean at a point of sale machine - the POS does not reach out to the payment network to perform an "online" transaction where the PIN and card are validated by the back-end systems. Edit 3: The article doesn't give EMVCo any credit for actually solving the issue before any real world hack was known to exist.

cjhopman 11y ago
If you read the linked paper, this vulnerability is not limited to offline transactions. Edit: clarification, there are sort of three types of transactions-- offline - vulnerable to this (and a simpler attack) online w/ offline pin - vulnerable online w/ online pin - not vulnerable
- JimmaDaRustla 11y ago
  Well, this article only applies to point of sale transactions, so it is either online or offline. Offline transaction, meaning "authorized within the acquirer domain (at acceptance device, or at the acquirer host)". In other words, the transaction does not hit the issuer's system. Edit: Even in an online transaction, offline pin is still performed, but the online would fail.
11y ago

jgalt212 11y ago

pretty lame if the card can just say "yes" no matter what PIN is entered. Away from being a proprietary tech, I'm not sure why fingerprinting the magnetic stripe never took off. It seems so much simpler, and if you cannot rearrange iron at the molecular level impossible to replicate. http://www.magtek.com/V2/media/whitePapers/2012/MagTek-WP-An-Introduction-to-Dynamic-Authentication-To-Launch.pdf http://www.magtek.com/V2/media/whitePapers/2012/MagTek-WP-An...

rsfern 11y ago
Probably it's lack of infrastructure buy-in. And personally, I find the misuse of the word biometric in the white paper off-putting, along with the lack of detail on the basis for the technique. The fingerprint is somehow related to the magnetic particle distribution--how stable is it against weak magnetic fields, or against heat? If you really can reliably get magnetic signatures, it would be really hard to clone cards. Edit: the particles won't really change, but their magnetic states feasibly could

nathanb 11y ago

Let's not lose sight of one thing -- this doesn't make chip-and-pin less secure than swipe-and-sign, it just makes it no more secure, in the worst case.

kbenson 11y ago
It's not just about security though, it's also about liability. Chip-and-pin may have different liability rules than have been established for signatures. If so, then a hacked chip-and-pin system may be no less secure for the consumer, but it may be much more costly.

ck2 11y ago

So those millions spent replacing everyone's card and all the vendors merchant machines was a waste. Besides you can just use the chipped card online without the chip or pin?

ljk 11y ago

So is the safest way just to use cash?

akavel 11y ago

Noteworthy: For the Cambridge researchers, the French attack is an “I-told-you-so” moment. Five years ago, EMVCo and the UK Cards Association both dismissed their attack as improbable or impossible.