12 ms·

How contactless cards are still vulnerable to relay attack

60 points by ivank 10y ago

prohor 10y ago
Just add an e-ink display (like this: https://plastc.com/ https://plastc.com/) that shows the transaction value and a button to approve on card. Only then the card would sign the transaction. Seems simple.
- drdaeman 10y ago
  It doesn't even have to be a card-shaped anymore, since it's NFC. There are other form factors that handled real-word payments, like bracelets, watches and phones. All of those can be easily equipped with a display (enough to show a transaction amount) and some sort of sensor (keypad, touchscreen, single "approve" button, fingerprint scanner) to handle user authorization. This will probably break the "fix" though, as the "card" may take up to tens of seconds to "respond", awaiting for owner granting permission. And won't work for stores that can't handle NFC.
  - oakwhiz 10y ago
    A device like that could use a 2-phase protocol so that each step of the transaction is kept under 2ms even if the whole thing takes 10s.
- thesimon 10y ago
  Would require double-tap though, which would be especially inconvenient for stuff like public transport in London.
  - aftbit 10y ago
    It could be configured to automatically allow X transactions below $Y every Z seconds. So you could tag into the subway once every five minutes without any user input, but larger or more frequent transactions would require confirmation.
    - bduerst 10y ago
      Or allow a tap to pre-approve purchases for the next 60 seconds.
ChuckMcM 10y ago
EM shielded financial pockets are going to become a deal breaker. While there are a few wallets and purses today which offer this (harder on a purse since it makes your phone unusable if stored in it) at some point if your card holder doesn't shield it will be considered impractical.
- misterdata 10y ago
  These have existed for a while [1]. I've been using one to make sure that my business and personal cards aren't both charged in public transport [1] https://www.secrid.com/en/ https://www.secrid.com/en/
  - Kubuxu 10y ago
    You don't need an expensive wallet, strip of aluminium foil works as great. NFC uses magnetic antennas/coupling meaning that shielding from one side is enough to block signal. My solution is to laminate strip of aluminium foil in card form factor.
    - kalleboo 10y ago
      More on this from Dave Jones at the EEVBlog where he actually tests the attenuation and visualises on an oscilloscope: https://www.youtube.com/watch?v=kp63MZ6RudE https://www.youtube.com/watch?v=kp63MZ6RudE As well as testing an active jammer that's for sale https://www.youtube.com/watch?v=rnOuEFR6qoM https://www.youtube.com/watch?v=rnOuEFR6qoM
- viraptor 10y ago
  Alternatively, simply the popularity of the NFC cards will sort it out. I've got 2 NFC credit cards and 2 NFC public transport cards. They're not compatible with the time-delay enumeration, so you can't scan them separately while they're in the wallet.
ar0 10y ago
I do not think the title corresponds particularly well to the article, as it focuses on at least something being done: The article details how the new MasterCard specification for contactless payments requires that payment terminals time the response of contactless cards to 2ms or less. This would as I understand it almost eliminate real-world relay attacks: it would exclude using the Internet to relay data and thus require building sophisticated radio equipment, all for relatively little gain as contactless payments without PIN are usually capped to low sums. The article does point out, though, that this might well be "too little too late" as the MasterCard specification is only one of many and it will take years For new cards to actually end up in the hands of consumers. I guess this is what the title refers too, but I have to admit that at least I was surprised to learn that something is being done at all about this...
peeters 10y ago
I'm curious about the example used. They show a fraudulent purchase of $2000. I know my MC caps the size of the purchase that can use tap for auth (somewhere under $100). Is the same challenge/response used for both tap and chip? Otherwise, wouldn't the bank catch that it got a tap response for a purchase that should've used chip and pin? Or is this assuming the bank allows a $2000 purchase using only tap?
- dtech 10y ago
  The article is a bit confusing (perhaps deliberately to scare the reader). The attack is possible on all current electronic chip payment forms (contacted/contactless, with & without PIN). For contactless without PIN, transactions are limited (in my country to €25 per transaction and €50 total before a PIN is required). Contactless without PIN is much easier to attack (for obvious reasons), but cannot break this limit. Contacted with PIN is fully vulnerable, but also a lot harder to pull off. The 600km limit is also highly deceptive, as it doesn't take into account latency introduced by electronics. E.g. a typical good wifi connection has a much higher ping than 2ms.
k3nx 10y ago
would it be too hard to do: send request to bank, bank checks, says it's ok and returns the amount to withdraw, the card reader already says "is amount $20.00 ok", just replace that with what the bank said it was authorizing, user wouldn't have to do anything else, but the real amount would be shown at the time of transaction not what the card reader was told
- greenshackle 10y ago
  in this attack the card reader is compromised. the attackers can make it display whatever they want it to. Edit: For this to work the card itself would have to have it's own display. Another commenter suggested e-ink.
drazvan 10y ago
I've actually used the "attack" in the article to design a P2P Bitcoin exchange based on the idea of using someone else's contactless card (with permission) in exchange for Bitcoin. This would solve one of the big issues in exchanges today - that is the fiat escrow handling. There's a demo for a quick PoC here https://www.youtube.com/watch?v=ZsOzeELdjxM https://www.youtube.com/watch?v=ZsOzeELdjxM . It makes me sad that they're closing this, the fraud potential was really small (as the article implies).
honkhonkpants 10y ago
So many ridiculous hacks upon hacks going on here. There is only ONE WAY to implement these payment systems and it was known to the designers of the smart card and related public-key crypto designers 40 years ago: the merchant must sign the transaction with their key, the user must inspect the signed transaction on their own trusted device and enter PIN to sign with their private key, and the whole thing is verified and cleared by the network operators. The pile of hacks we have today is just a result of the fact that the networks don't want to operate the PKI.
- germanier 10y ago
  Or more likely because customers don't want to inspect a transaction on their own device at the supermarket checkout or even worse a transport fare gate. A "solution" which takes minutes to perform is not a solution to the real-world problem.
  - honkhonkpants 10y ago
    It's a tradeoff between speed and security. Anyway there's certainly no reason why minutes need be the case. A contactless smartcard with an integrated e-ink display and PIN pad would not take anywhere near the amount of time we currently suffer in the US implementation of chip and PIN. Edit: fare gate is a special class of problem. I don't expect TfL to be screwing with me, whereas I may be highly suspicious of the point-of-sale system down at the corner bodega.
    - sjtgraham 10y ago
      Totally unreasonable to implement. How are these cards supposed to run? They don't have batteries. Even if this was realistic to deploy it would be prohibitively expensive, far exceeding what it's costing banks to eat the fraud.
      - honkhonkpants 10y ago
        Why? Forget the e-ink for a moment and just use lcd instead. I once had an lcd calculator (no backlight, of course) that ran for a decade on a lithium battery. smart cards barely use any energy at all.
deutronium 10y ago
Even if you use distance bounding protocols, couldn't someone just use one of those contactless paypal machines, to steal your money directly?
- girvo 10y ago
  If they don't have your pin, they're limited to $100 max.
Nursie 10y ago
Contactless cards are vulnerable to some kinds of fraud, fraud in such low amounts that it's not been worth the effort to actually commit on any great scale. Non-chip cards are by far the bigger liability. The levels of fraud on contactless cards have been so low that the banks put the limit up from £10 to £30 recently here, and take full liability themselves.

60 points by ivank 10y ago

Just add an e-ink display (like this: https://plastc.com/ https://plastc.com/) that shows the transaction value and a button to approve on card. Only then the card would sign the transaction. Seems simple.

drdaeman 10y ago
It doesn't even have to be a card-shaped anymore, since it's NFC. There are other form factors that handled real-word payments, like bracelets, watches and phones. All of those can be easily equipped with a display (enough to show a transaction amount) and some sort of sensor (keypad, touchscreen, single "approve" button, fingerprint scanner) to handle user authorization. This will probably break the "fix" though, as the "card" may take up to tens of seconds to "respond", awaiting for owner granting permission. And won't work for stores that can't handle NFC.
- oakwhiz 10y ago
  A device like that could use a 2-phase protocol so that each step of the transaction is kept under 2ms even if the whole thing takes 10s.
thesimon 10y ago
Would require double-tap though, which would be especially inconvenient for stuff like public transport in London.
- aftbit 10y ago
  It could be configured to automatically allow X transactions below $Y every Z seconds. So you could tag into the subway once every five minutes without any user input, but larger or more frequent transactions would require confirmation.
  - bduerst 10y ago
    Or allow a tap to pre-approve purchases for the next 60 seconds.

ChuckMcM 10y ago

EM shielded financial pockets are going to become a deal breaker. While there are a few wallets and purses today which offer this (harder on a purse since it makes your phone unusable if stored in it) at some point if your card holder doesn't shield it will be considered impractical.

misterdata 10y ago
These have existed for a while [1]. I've been using one to make sure that my business and personal cards aren't both charged in public transport [1] https://www.secrid.com/en/ https://www.secrid.com/en/
- Kubuxu 10y ago
  You don't need an expensive wallet, strip of aluminium foil works as great. NFC uses magnetic antennas/coupling meaning that shielding from one side is enough to block signal. My solution is to laminate strip of aluminium foil in card form factor.
  - kalleboo 10y ago
    More on this from Dave Jones at the EEVBlog where he actually tests the attenuation and visualises on an oscilloscope: https://www.youtube.com/watch?v=kp63MZ6RudE https://www.youtube.com/watch?v=kp63MZ6RudE As well as testing an active jammer that's for sale https://www.youtube.com/watch?v=rnOuEFR6qoM https://www.youtube.com/watch?v=rnOuEFR6qoM
viraptor 10y ago
Alternatively, simply the popularity of the NFC cards will sort it out. I've got 2 NFC credit cards and 2 NFC public transport cards. They're not compatible with the time-delay enumeration, so you can't scan them separately while they're in the wallet.

ar0 10y ago

I do not think the title corresponds particularly well to the article, as it focuses on at least something being done: The article details how the new MasterCard specification for contactless payments requires that payment terminals time the response of contactless cards to 2ms or less. This would as I understand it almost eliminate real-world relay attacks: it would exclude using the Internet to relay data and thus require building sophisticated radio equipment, all for relatively little gain as contactless payments without PIN are usually capped to low sums. The article does point out, though, that this might well be "too little too late" as the MasterCard specification is only one of many and it will take years For new cards to actually end up in the hands of consumers. I guess this is what the title refers too, but I have to admit that at least I was surprised to learn that something is being done at all about this...

peeters 10y ago

I'm curious about the example used. They show a fraudulent purchase of $2000. I know my MC caps the size of the purchase that can use tap for auth (somewhere under $100). Is the same challenge/response used for both tap and chip? Otherwise, wouldn't the bank catch that it got a tap response for a purchase that should've used chip and pin? Or is this assuming the bank allows a $2000 purchase using only tap?

dtech 10y ago
The article is a bit confusing (perhaps deliberately to scare the reader). The attack is possible on all current electronic chip payment forms (contacted/contactless, with & without PIN). For contactless without PIN, transactions are limited (in my country to €25 per transaction and €50 total before a PIN is required). Contactless without PIN is much easier to attack (for obvious reasons), but cannot break this limit. Contacted with PIN is fully vulnerable, but also a lot harder to pull off. The 600km limit is also highly deceptive, as it doesn't take into account latency introduced by electronics. E.g. a typical good wifi connection has a much higher ping than 2ms.

k3nx 10y ago

would it be too hard to do: send request to bank, bank checks, says it's ok and returns the amount to withdraw, the card reader already says "is amount $20.00 ok", just replace that with what the bank said it was authorizing, user wouldn't have to do anything else, but the real amount would be shown at the time of transaction not what the card reader was told

greenshackle 10y ago
in this attack the card reader is compromised. the attackers can make it display whatever they want it to. Edit: For this to work the card itself would have to have it's own display. Another commenter suggested e-ink.

drazvan 10y ago

I've actually used the "attack" in the article to design a P2P Bitcoin exchange based on the idea of using someone else's contactless card (with permission) in exchange for Bitcoin. This would solve one of the big issues in exchanges today - that is the fiat escrow handling. There's a demo for a quick PoC here https://www.youtube.com/watch?v=ZsOzeELdjxM https://www.youtube.com/watch?v=ZsOzeELdjxM . It makes me sad that they're closing this, the fraud potential was really small (as the article implies).

honkhonkpants 10y ago

So many ridiculous hacks upon hacks going on here. There is only ONE WAY to implement these payment systems and it was known to the designers of the smart card and related public-key crypto designers 40 years ago: the merchant must sign the transaction with their key, the user must inspect the signed transaction on their own trusted device and enter PIN to sign with their private key, and the whole thing is verified and cleared by the network operators. The pile of hacks we have today is just a result of the fact that the networks don't want to operate the PKI.

germanier 10y ago
Or more likely because customers don't want to inspect a transaction on their own device at the supermarket checkout or even worse a transport fare gate. A "solution" which takes minutes to perform is not a solution to the real-world problem.
- honkhonkpants 10y ago
  It's a tradeoff between speed and security. Anyway there's certainly no reason why minutes need be the case. A contactless smartcard with an integrated e-ink display and PIN pad would not take anywhere near the amount of time we currently suffer in the US implementation of chip and PIN. Edit: fare gate is a special class of problem. I don't expect TfL to be screwing with me, whereas I may be highly suspicious of the point-of-sale system down at the corner bodega.
  - sjtgraham 10y ago
    Totally unreasonable to implement. How are these cards supposed to run? They don't have batteries. Even if this was realistic to deploy it would be prohibitively expensive, far exceeding what it's costing banks to eat the fraud.
    - honkhonkpants 10y ago
      Why? Forget the e-ink for a moment and just use lcd instead. I once had an lcd calculator (no backlight, of course) that ran for a decade on a lithium battery. smart cards barely use any energy at all.

deutronium 10y ago

Even if you use distance bounding protocols, couldn't someone just use one of those contactless paypal machines, to steal your money directly?

girvo 10y ago
If they don't have your pin, they're limited to $100 max.

Nursie 10y ago

Contactless cards are vulnerable to some kinds of fraud, fraud in such low amounts that it's not been worth the effort to actually commit on any great scale. Non-chip cards are by far the bigger liability. The levels of fraud on contactless cards have been so low that the banks put the limit up from £10 to £30 recently here, and take full liability themselves.