7 ms·

I'm having a surprising amount of trouble finding this information online: does the "chip" include some functionality (maybe called iCVV or dCVV) that allows it

I'm having a surprising amount of trouble finding this information online: does the "chip" include some functionality (maybe called iCVV or dCVV) that allows it to individually "sign" transactions using internal secret keys, or does it not? This was my understanding of why the new system was supposed to be safer. If the answer is yes, secret keys that never leave the chip are used to sign each transaction and the signature is verified by the bank, I'm not sure how these "shimmers" would be useful, since the secret key would presumably not be compromised and so the shimmer may obtain some data identifying the card and transaction but not the ability to sign new transactions. If the answer is no, none of this is happening, then I'm not sure what the point of the switch was in the first place. Maybe the answer is something in between? Banks suck, so they've implemented chip cards in a half-assed way with gaping security holes?

jrkatz 10y ago
Not all terminals in the States support chip functionality, so for the time being chip & pin cards here still have normal mag strips and can be run as older, regular cards - the mag strips can still be read/stolen & used.
- lvh 10y ago
  That's true, but the shimmers in question clearly have smart card pins. What you're describing is the traditional skimmer; a shimmer is not merely a thinner skimmer. These devices read the data between the chip and the terminal. This would be fine, if payment processing consistently used iCVV/EMV, but it turns out they don't.
- sly010 10y ago
  And it's unlikely that this will change anytime soon due to the lack on incentives on all sides. Funny as it may be my debit card for some reason has a $500 (unmodifiable) limit on chip&pin purchases, but it has no such limit for swipe purchases. When I asked them how is that more secure, I got a verbal shoulder shrug. Banks are in the business of underwriting. I believe at least on the corporate level they probably don't like the idea of fully secure, verifiable payments, because that would mean you don't need them anymore.
  - nine_k 10y ago
    Banks are also in a business of storing your money, transferring your money, and borrowing you money. Note that "storing" here is actually "letting the bank invest the money". I don't think any of these activities are undermined by completely verifiable purchase transactions.
  - lostlogin 10y ago
    Can you explain what you mean by "unmodifiable"? I have a limit, but on the banks app and website I can lower it (and I keep it very low) in the hope that any issues I have would be limited by this. Is this not actually worth doing?
- seanp2k2 10y ago
  IMO it's super dumb that we're going through the whole business of replacing card readers to get chip support but NOT getting pin requirements. I've had a few CCs stolen from my mailbox (apartment with a large shared mailbox with simple padlocks). The new chip-only doesn't protect against this at all. MasterCard SecureCode was also a step in the right direction IMO, but the adoption rate seems very low. Basically, I want to require a second factor for every purchase. There's no way to do that right now with US cards that I know of. Debit cards can do it in person, but the fraud liability is different from CCs, and I don't get the fat 3% back or help my credit score. The best option online seems to be PayPal, which again loses the CC benefits. Thus, I just accept the inconvenience of getting my CC stolen a few times per year, since I'm not liable for the fraud, but it makes me cringe how this is currently the best solution available because of how messed up the incentives in the payment industry are here.
  - kibibyte 10y ago
    Given that the transition from magstripe to chip-and-sign hasn't been so smooth (confusion among customers and cashiers for a few months), I can see why we haven't moved towards it yet. Merchants would be more nervous about additional lost sales because of customers not knowing what to do or not being used to having to memorize PINs for their credit cards. PINs really only just deter someone from physically stealing your card and then using it, so until card theft becomes a problem, I don't think we're going to be moving to chip-and-PIN any time soon. (On the bright side, Android/Apple Pay are generally good enough to function as chip-and-pin: it's as secure as a chip card, and don't allow thieves to use your cards unless they're either sophisticated enough to get past the fingerprint sensor, or they know your passcode. It's just a bit awkward to set up.)
  - TwoBit 10y ago
    How were thieves able to activate cards stolen from your mail box?
    - kiwijamo 10y ago
      My current bank considers a purchase using a PIN to be sufficient for automatic instant activation of the card. I was surprised given my previous bank required a phone call to confirm my identity. I guess the policy varies from bank to bank.
bramblerose 10y ago
This sounds like the attack presented at DEFCON 19 (in 2011!): https://www.defcon.org/images/defcon-19/dc-19-presentations/Barisani-Bianco-Laurie-Franken/DEFCON-19-Barisani-Bianco-Laurie-Franken.pdf https://www.defcon.org/images/defcon-19/dc-19-presentations/.... Basically, the chip used to contain all the information present on the magstripe, which made it easy to create a copy of the magstripe via the chip interface.
- callesgg 10y ago
  With that information i make the conclusion that it should not be a problem in countries that have moved 100% to "chip & pin". Only for countries like USA which have not completed the move from magnetic readers.
  - vmarsy 10y ago
    In France it always has been 100% chip & pin, but if you have a hardware like this device between your card and the card reader, it can apparently intercept any signal, including the pin code. I don't know how exactly the protocol and how they get the pin, but they get it according to this article. (would it be possible to implement a SSL-like protocol to avoid this type of MitM attack?) An old school version of this would be installing a camera in top of your ATM and recording your card data with the stripe, which as you say would be the stripe's fault, but here they get the information and the pin simply from the shimmer, which looking at the picture shows only a chip connector. Then a fraudster can duplicate the card exactly, and use the duplicate with the same pin at a random ATM across the world. I think this is why banks can block your card if you didn't warn them about going abroad, as they're unable to tell if this is your card or a replica of your card used by a fraudster.
    - PeterisP 10y ago
      In a proper EMV solution, hardware like this can not intercept the PIN code even if it can interpret any signal, as the unencrypted PIN is not sent anywhere beyond the keypad - even if you do MITM on the wires between the keypad and POS terminal, you would get only an encrypted version that then gets sent to the bank for online verification or to the chip for offline verification. You can get the PIN code by cameras or extra keypad on top of the real keypad, as sometimes is done for ATM skimming. Furthermore, they can't get the card private keys in this manner, so they can't duplicate the card chip, only its magstripe; and they are definitely able to tell if a replica of your card is suddenly used in a magstripe-only mode. This means that it's a problem, as the parent post said, "only for countries like USA which have not completed the move from magnetic readers" because otherwise you can simply reject any transactions that might use a cloned magstripe.
mjcl 10y ago
> Maybe the answer is something in between? Banks suck, so they've implemented chip cards in a half-assed way with gaping security holes? This is the problem. Some banks don't verify the signature/iCVV.
loeg 10y ago
Magstrip only terminals are still widely used in the US.
salicideblock 10y ago
The answer is yes, most chip cards can do public key cryptography to sign a transaction without compromising the secret key burned in. Also, more frequently than I would wish banks or payment processors ask payment terminal operators for a "simpler", meaning less secure, transaction protocol. Most often it's for compatibility with some legacy system from the 80's somewhere in their payment validation backend. From my experience in the industry, this happened very rarely in Europe but considerably more often in the Americas and Middle East.
- ams6110 10y ago
  A good number of the supermarkets and other retailers around me are still just swiping cards. Gas pumps of course as well. I'm guessing the added cost of the fraud liability for swiped cards is turning out to be lower than the cost to convert to chip readers.
  - revelation 10y ago
    It's not the cost of conversion, it's that the fraud just vanishes in the insane rents American credit card processors extract. In the EU, these fees are limited to 0.3% for CC and 0.2% for debit cards, so there is less margin to just keep paying the fraudsters instead of updating systems.
    - bluedino 10y ago
      They have the new readers but they don't use them
      - cpncrunch 10y ago
        Notable the article is from Canada. Here in Canada virtually all retailers have been using chip+pin for a good number of years now. The same in the UK, where they have been using it for over 10 years. Retailers have to use chip+pin to avoid fraud liability. In the USA, however, a lot of retailers were still using signatures up until a year or two. It seems to be only in the last year that retailers are starting to move to chip+pin. I think it is simply the large number of credit card terminals, and the cost of upgrading them all.
xaduha 10y ago
They probably just steal data from the magnetic stripe + detect key-presses somehow for a PIN.
- icelancer 10y ago
  Yeah, this is what I automatically assumed.

jrkatz 10y ago

Not all terminals in the States support chip functionality, so for the time being chip & pin cards here still have normal mag strips and can be run as older, regular cards - the mag strips can still be read/stolen & used.

lvh 10y ago
That's true, but the shimmers in question clearly have smart card pins. What you're describing is the traditional skimmer; a shimmer is not merely a thinner skimmer. These devices read the data between the chip and the terminal. This would be fine, if payment processing consistently used iCVV/EMV, but it turns out they don't.
sly010 10y ago
And it's unlikely that this will change anytime soon due to the lack on incentives on all sides. Funny as it may be my debit card for some reason has a $500 (unmodifiable) limit on chip&pin purchases, but it has no such limit for swipe purchases. When I asked them how is that more secure, I got a verbal shoulder shrug. Banks are in the business of underwriting. I believe at least on the corporate level they probably don't like the idea of fully secure, verifiable payments, because that would mean you don't need them anymore.
- nine_k 10y ago
  Banks are also in a business of storing your money, transferring your money, and borrowing you money. Note that "storing" here is actually "letting the bank invest the money". I don't think any of these activities are undermined by completely verifiable purchase transactions.
- lostlogin 10y ago
  Can you explain what you mean by "unmodifiable"? I have a limit, but on the banks app and website I can lower it (and I keep it very low) in the hope that any issues I have would be limited by this. Is this not actually worth doing?
seanp2k2 10y ago
IMO it's super dumb that we're going through the whole business of replacing card readers to get chip support but NOT getting pin requirements. I've had a few CCs stolen from my mailbox (apartment with a large shared mailbox with simple padlocks). The new chip-only doesn't protect against this at all. MasterCard SecureCode was also a step in the right direction IMO, but the adoption rate seems very low. Basically, I want to require a second factor for every purchase. There's no way to do that right now with US cards that I know of. Debit cards can do it in person, but the fraud liability is different from CCs, and I don't get the fat 3% back or help my credit score. The best option online seems to be PayPal, which again loses the CC benefits. Thus, I just accept the inconvenience of getting my CC stolen a few times per year, since I'm not liable for the fraud, but it makes me cringe how this is currently the best solution available because of how messed up the incentives in the payment industry are here.
- kibibyte 10y ago
  Given that the transition from magstripe to chip-and-sign hasn't been so smooth (confusion among customers and cashiers for a few months), I can see why we haven't moved towards it yet. Merchants would be more nervous about additional lost sales because of customers not knowing what to do or not being used to having to memorize PINs for their credit cards. PINs really only just deter someone from physically stealing your card and then using it, so until card theft becomes a problem, I don't think we're going to be moving to chip-and-PIN any time soon. (On the bright side, Android/Apple Pay are generally good enough to function as chip-and-pin: it's as secure as a chip card, and don't allow thieves to use your cards unless they're either sophisticated enough to get past the fingerprint sensor, or they know your passcode. It's just a bit awkward to set up.)
- TwoBit 10y ago
  How were thieves able to activate cards stolen from your mail box?
  - kiwijamo 10y ago
    My current bank considers a purchase using a PIN to be sufficient for automatic instant activation of the card. I was surprised given my previous bank required a phone call to confirm my identity. I guess the policy varies from bank to bank.

bramblerose 10y ago

This sounds like the attack presented at DEFCON 19 (in 2011!): https://www.defcon.org/images/defcon-19/dc-19-presentations/Barisani-Bianco-Laurie-Franken/DEFCON-19-Barisani-Bianco-Laurie-Franken.pdf https://www.defcon.org/images/defcon-19/dc-19-presentations/.... Basically, the chip used to contain all the information present on the magstripe, which made it easy to create a copy of the magstripe via the chip interface.

callesgg 10y ago
With that information i make the conclusion that it should not be a problem in countries that have moved 100% to "chip & pin". Only for countries like USA which have not completed the move from magnetic readers.
- vmarsy 10y ago
  In France it always has been 100% chip & pin, but if you have a hardware like this device between your card and the card reader, it can apparently intercept any signal, including the pin code. I don't know how exactly the protocol and how they get the pin, but they get it according to this article. (would it be possible to implement a SSL-like protocol to avoid this type of MitM attack?) An old school version of this would be installing a camera in top of your ATM and recording your card data with the stripe, which as you say would be the stripe's fault, but here they get the information and the pin simply from the shimmer, which looking at the picture shows only a chip connector. Then a fraudster can duplicate the card exactly, and use the duplicate with the same pin at a random ATM across the world. I think this is why banks can block your card if you didn't warn them about going abroad, as they're unable to tell if this is your card or a replica of your card used by a fraudster.
  - PeterisP 10y ago
    In a proper EMV solution, hardware like this can not intercept the PIN code even if it can interpret any signal, as the unencrypted PIN is not sent anywhere beyond the keypad - even if you do MITM on the wires between the keypad and POS terminal, you would get only an encrypted version that then gets sent to the bank for online verification or to the chip for offline verification. You can get the PIN code by cameras or extra keypad on top of the real keypad, as sometimes is done for ATM skimming. Furthermore, they can't get the card private keys in this manner, so they can't duplicate the card chip, only its magstripe; and they are definitely able to tell if a replica of your card is suddenly used in a magstripe-only mode. This means that it's a problem, as the parent post said, "only for countries like USA which have not completed the move from magnetic readers" because otherwise you can simply reject any transactions that might use a cloned magstripe.

mjcl 10y ago

> Maybe the answer is something in between? Banks suck, so they've implemented chip cards in a half-assed way with gaping security holes? This is the problem. Some banks don't verify the signature/iCVV.

loeg 10y ago

Magstrip only terminals are still widely used in the US.

salicideblock 10y ago

The answer is yes, most chip cards can do public key cryptography to sign a transaction without compromising the secret key burned in. Also, more frequently than I would wish banks or payment processors ask payment terminal operators for a "simpler", meaning less secure, transaction protocol. Most often it's for compatibility with some legacy system from the 80's somewhere in their payment validation backend. From my experience in the industry, this happened very rarely in Europe but considerably more often in the Americas and Middle East.

ams6110 10y ago
A good number of the supermarkets and other retailers around me are still just swiping cards. Gas pumps of course as well. I'm guessing the added cost of the fraud liability for swiped cards is turning out to be lower than the cost to convert to chip readers.
- revelation 10y ago
  It's not the cost of conversion, it's that the fraud just vanishes in the insane rents American credit card processors extract. In the EU, these fees are limited to 0.3% for CC and 0.2% for debit cards, so there is less margin to just keep paying the fraudsters instead of updating systems.
  - bluedino 10y ago
    They have the new readers but they don't use them
    - cpncrunch 10y ago
      Notable the article is from Canada. Here in Canada virtually all retailers have been using chip+pin for a good number of years now. The same in the UK, where they have been using it for over 10 years. Retailers have to use chip+pin to avoid fraud liability. In the USA, however, a lot of retailers were still using signatures up until a year or two. It seems to be only in the last year that retailers are starting to move to chip+pin. I think it is simply the large number of credit card terminals, and the cost of upgrading them all.

xaduha 10y ago

They probably just steal data from the magnetic stripe + detect key-presses somehow for a PIN.

icelancer 10y ago
Yeah, this is what I automatically assumed.