5 ms·

This sounds like the attack presented at DEFCON 19 (in 2011!): https://www.defcon.org/images/defcon-19/dc-19-presentations/Barisani-Bianco-Laurie-Franken/DEFCON

This sounds like the attack presented at DEFCON 19 (in 2011!): https://www.defcon.org/images/defcon-19/dc-19-presentations/Barisani-Bianco-Laurie-Franken/DEFCON-19-Barisani-Bianco-Laurie-Franken.pdf https://www.defcon.org/images/defcon-19/dc-19-presentations/.... Basically, the chip used to contain all the information present on the magstripe, which made it easy to create a copy of the magstripe via the chip interface.

callesgg 10y ago
With that information i make the conclusion that it should not be a problem in countries that have moved 100% to "chip & pin". Only for countries like USA which have not completed the move from magnetic readers.
- vmarsy 10y ago
  In France it always has been 100% chip & pin, but if you have a hardware like this device between your card and the card reader, it can apparently intercept any signal, including the pin code. I don't know how exactly the protocol and how they get the pin, but they get it according to this article. (would it be possible to implement a SSL-like protocol to avoid this type of MitM attack?) An old school version of this would be installing a camera in top of your ATM and recording your card data with the stripe, which as you say would be the stripe's fault, but here they get the information and the pin simply from the shimmer, which looking at the picture shows only a chip connector. Then a fraudster can duplicate the card exactly, and use the duplicate with the same pin at a random ATM across the world. I think this is why banks can block your card if you didn't warn them about going abroad, as they're unable to tell if this is your card or a replica of your card used by a fraudster.
  - PeterisP 10y ago
    In a proper EMV solution, hardware like this can not intercept the PIN code even if it can interpret any signal, as the unencrypted PIN is not sent anywhere beyond the keypad - even if you do MITM on the wires between the keypad and POS terminal, you would get only an encrypted version that then gets sent to the bank for online verification or to the chip for offline verification. You can get the PIN code by cameras or extra keypad on top of the real keypad, as sometimes is done for ATM skimming. Furthermore, they can't get the card private keys in this manner, so they can't duplicate the card chip, only its magstripe; and they are definitely able to tell if a replica of your card is suddenly used in a magstripe-only mode. This means that it's a problem, as the parent post said, "only for countries like USA which have not completed the move from magnetic readers" because otherwise you can simply reject any transactions that might use a cloned magstripe.
    - seanp2k2 10y ago
      Defcon 24 vid about skimming EMV cards at ATMs and withdrawing cash from the skimmed account at a different remote ATM (cashout): https://m.youtube.com/watch?v=FgIk_oIK2SM https://m.youtube.com/watch?v=FgIk_oIK2SM
      - PeterisP 10y ago
        A very nice video and a very interesting attack. That being said, this doesn't allow to duplicate a card (it relays the fraudulent transaction in real time to the real card while it's stuck into compromised hardware), the PIN is captured from video or the "la-cara"device, and you do need to have the "extracting" device mounted to a real ATM for prolonged periods until you can empty it (you can do it only as fast as the real transactions come in, and they do so at unpredictable intervals), which gives a nice opportunity to capture the involved people. It's a very powerful proof of concept, but harder to scale than the current "cashout crews"/mules - the logistic problems are somewhat comparable to the classic approach of setting up a completely fake ATM.
djrogers 10y ago
> the chip used to contain all the information present on the magstripe Not all of it - the chip has a dynamic CVV that differs from the one on the magstripe. This only works if the bank isn't checking CVVs.
- lucb1e 10y ago
  > This only works if the bank isn't checking CVVs. Source please? Because if you're right, my bank lied to me when they said they couldn't see whether I paid by chip or by magstripe.
  - redbluff 10y ago
    Your Bank is lying, or more correctly has either poorly trained front end staff or a rubbish interface to their EFT system. Source: 25 years of EFT development on Bank transaction systems.
  - feld 10y ago
    They have to know for fraud investigation. I believe it's also why many companies can't upgrade: they need a new POS that can log the transaction as stripe, chip or NFC/Apple aPay
PeterisP 10y ago
From the issuer side, the solution to remove this risk is simple (and I believe I was told it in an EMV implementation seminar 10 years ago): If the incoming transaction lists that the terminal is chip&pin capable, so you'd simply automatically reject a magstripe transaction with a code that should result in POS showing "please insert card in the chip reader"; If the incoming transaction lists that the terminal is not chip&pin capable, the merchant has chosen to be liable for all fraud cases themselves, so it can't cause a loss for you and your customers. It is an inconvenience, but as all the fraud in the country concentrates on the (fewer and fewer) merchants accepting these transactions, it causes an increasing financial pressure on them to switch.
- chrsstrm 10y ago
  If you try to swipe a chip card then yes, the terminal will reject the swipe and tell you to insert the chip. If your chip fails three successive tries, the terminal will accept a mag swipe instead. I don't know if this is true everywhere but I have seen it in multiple retailers across the US. Point is, if attackers are cloning mag cards from chip data, those cards can still be used in chip terminals.
  - redbluff 10y ago
    That can be true, but then the transaction is considered "fallback" and most issuer Banks that have any brains will be examining these very closely with their real time fraud systems. Some deny fallback outright, but I am not sure if this is within scheme rules, it may depend on the region.
    - cpncrunch 10y ago
      From what I can determine, the retailer is liable for fraud when using magnetic strip, whether or not the chip has failed: http://www.emvcanada.com/forum/what-happens-when.html http://www.emvcanada.com/forum/what-happens-when.html
  - kiwijamo 10y ago
    New Zealand chip card machines does the same but I think it only need two chip read failures before it falls back to swiping using the magnetic strip.
caconym_ 10y ago
This is interesting. I would totally believe that with the information you can intercept passing between the chip and the reader, you could in some cases construct magnetic stripe data that would be recognized as valid. It kinda seems like the magnetic stripe system should be completely separate from the chip system. Make it so that the card ID (or whatever) reported by the chip can never be used for swipe transactions, and vice-versa. Combining them just seems to cross-product-ify the attack surface, which is dumb.

callesgg 10y ago

With that information i make the conclusion that it should not be a problem in countries that have moved 100% to "chip & pin". Only for countries like USA which have not completed the move from magnetic readers.

vmarsy 10y ago
In France it always has been 100% chip & pin, but if you have a hardware like this device between your card and the card reader, it can apparently intercept any signal, including the pin code. I don't know how exactly the protocol and how they get the pin, but they get it according to this article. (would it be possible to implement a SSL-like protocol to avoid this type of MitM attack?) An old school version of this would be installing a camera in top of your ATM and recording your card data with the stripe, which as you say would be the stripe's fault, but here they get the information and the pin simply from the shimmer, which looking at the picture shows only a chip connector. Then a fraudster can duplicate the card exactly, and use the duplicate with the same pin at a random ATM across the world. I think this is why banks can block your card if you didn't warn them about going abroad, as they're unable to tell if this is your card or a replica of your card used by a fraudster.
- PeterisP 10y ago
  In a proper EMV solution, hardware like this can not intercept the PIN code even if it can interpret any signal, as the unencrypted PIN is not sent anywhere beyond the keypad - even if you do MITM on the wires between the keypad and POS terminal, you would get only an encrypted version that then gets sent to the bank for online verification or to the chip for offline verification. You can get the PIN code by cameras or extra keypad on top of the real keypad, as sometimes is done for ATM skimming. Furthermore, they can't get the card private keys in this manner, so they can't duplicate the card chip, only its magstripe; and they are definitely able to tell if a replica of your card is suddenly used in a magstripe-only mode. This means that it's a problem, as the parent post said, "only for countries like USA which have not completed the move from magnetic readers" because otherwise you can simply reject any transactions that might use a cloned magstripe.
  - seanp2k2 10y ago
    Defcon 24 vid about skimming EMV cards at ATMs and withdrawing cash from the skimmed account at a different remote ATM (cashout): https://m.youtube.com/watch?v=FgIk_oIK2SM https://m.youtube.com/watch?v=FgIk_oIK2SM
    - PeterisP 10y ago
      A very nice video and a very interesting attack. That being said, this doesn't allow to duplicate a card (it relays the fraudulent transaction in real time to the real card while it's stuck into compromised hardware), the PIN is captured from video or the "la-cara"device, and you do need to have the "extracting" device mounted to a real ATM for prolonged periods until you can empty it (you can do it only as fast as the real transactions come in, and they do so at unpredictable intervals), which gives a nice opportunity to capture the involved people. It's a very powerful proof of concept, but harder to scale than the current "cashout crews"/mules - the logistic problems are somewhat comparable to the classic approach of setting up a completely fake ATM.

djrogers 10y ago

> the chip used to contain all the information present on the magstripe Not all of it - the chip has a dynamic CVV that differs from the one on the magstripe. This only works if the bank isn't checking CVVs.

lucb1e 10y ago
> This only works if the bank isn't checking CVVs. Source please? Because if you're right, my bank lied to me when they said they couldn't see whether I paid by chip or by magstripe.
- redbluff 10y ago
  Your Bank is lying, or more correctly has either poorly trained front end staff or a rubbish interface to their EFT system. Source: 25 years of EFT development on Bank transaction systems.
- feld 10y ago
  They have to know for fraud investigation. I believe it's also why many companies can't upgrade: they need a new POS that can log the transaction as stripe, chip or NFC/Apple aPay

PeterisP 10y ago

From the issuer side, the solution to remove this risk is simple (and I believe I was told it in an EMV implementation seminar 10 years ago): If the incoming transaction lists that the terminal is chip&pin capable, so you'd simply automatically reject a magstripe transaction with a code that should result in POS showing "please insert card in the chip reader"; If the incoming transaction lists that the terminal is not chip&pin capable, the merchant has chosen to be liable for all fraud cases themselves, so it can't cause a loss for you and your customers. It is an inconvenience, but as all the fraud in the country concentrates on the (fewer and fewer) merchants accepting these transactions, it causes an increasing financial pressure on them to switch.

chrsstrm 10y ago
If you try to swipe a chip card then yes, the terminal will reject the swipe and tell you to insert the chip. If your chip fails three successive tries, the terminal will accept a mag swipe instead. I don't know if this is true everywhere but I have seen it in multiple retailers across the US. Point is, if attackers are cloning mag cards from chip data, those cards can still be used in chip terminals.
- redbluff 10y ago
  That can be true, but then the transaction is considered "fallback" and most issuer Banks that have any brains will be examining these very closely with their real time fraud systems. Some deny fallback outright, but I am not sure if this is within scheme rules, it may depend on the region.
  - cpncrunch 10y ago
    From what I can determine, the retailer is liable for fraud when using magnetic strip, whether or not the chip has failed: http://www.emvcanada.com/forum/what-happens-when.html http://www.emvcanada.com/forum/what-happens-when.html
- kiwijamo 10y ago
  New Zealand chip card machines does the same but I think it only need two chip read failures before it falls back to swiping using the magnetic strip.

caconym_ 10y ago

This is interesting. I would totally believe that with the information you can intercept passing between the chip and the reader, you could in some cases construct magnetic stripe data that would be recognized as valid. It kinda seems like the magnetic stripe system should be completely separate from the chip system. Make it so that the card ID (or whatever) reported by the chip can never be used for swipe transactions, and vice-versa. Combining them just seems to cross-product-ify the attack surface, which is dumb.