5 ms·

There is a clever solution to this from a bank in Slovakia (Tatrabanka), you can use their mobile banking application to generate a one-time numerical code for

There is a clever solution to this from a bank in Slovakia (Tatrabanka), you can use their mobile banking application to generate a one-time numerical code for the withdrawal. So you can just generate the code and enter it on any ATM that is owned by this bank. You don't need to have the card with you (and you can forward this code to your wife for example). Also 100% of cards in Europe are also protected by PIN, so simple skimmers won't work.

eboyjr 8y ago
Does it work without a mobile data connection? Regardless this is a great idea and I would love to know what it would take to convince other banks to do the same.
- Daniel_sk 8y ago
  It doesn't - but usually everyone has a mobile data plan here and coverage is great, so it's not a concern. In the rare event you can use the card as backup. I wish this was some sort of standard between banks. But thankfully this is the biggest bank in the country, so their ATM is usually very close to you (there is no special hardware, it's an ordinary ATM - with just a menu option of entering the one-time code).
tjoff 8y ago
PIN does not protect you from skimmers... Everything you need is on the magnetic stripe, PIN is only needed if you use the chip - which an attacker obviously wouldn't. The whole concept of chip+pin is pretty pathetic considering that the magnetic stripe is still there for backwards compatibility. And now with wireless cards it is even less secure than a magnetic stripe.
- Daniel_sk 8y ago
  Ok, I didn't know that. But I have never used the magnetic strip in Europe, I don't think anyone accepts it here. My previous bank would even issue standard debit cards without the magnetic strip. So how would you use the card without the PIN? Can you read the whole card number + expiration + CVV code and then buy something online?
  - tjoff 8y ago
    In Sweden it is not that uncommon (majority of readers take both chip+magnetic stripe). Also, ATMs swallow the whole card so a skimmer would work there even if the ATM itself only uses the chip. And now with wireless you could probably trivially skim people that used the chip (or wireless) functionality as well. I have never seen a card without magnetic stripe, that is awesome. I even have some trouble getting a card without wireless... At least whole card number + expiration is on the magnetic stripe. You don't need CVV as it is optional. Everything is written in clear-text and by definition that text must contain everything needed to perform a purchase.
- tialaramex 8y ago
  As I described below, all of this is part of Authorization, in principle an old-fashioned carbon impression sheet of your card could be used to justify a $5000 payment and it's up to you to contest that if it's bogus. Authorization protects the bank, not the customers. But for the Authorization a PIN absolutely can be required for online card transactions using a mag stripe. And this was routinely done in countries which had PINs for debit cards years before EMV. The terminal calls the bank and says I have this card, and here's the PIN entered by the customer, is that OK? Unlike the mag stripe you can't clone a card using the "wireless" EMV mode, the chip isn't just playing back a fixed data stream, it's an active component. [ It might be instructive to expand here, so I shall ] A part of an EMV transaction the terminal and card are supposed to pick random ("unpredictable") numbers each time. If this is done correctly it presents a significant security feature. For example, suppose tomorrow I plan to tell a jewellery store's payment terminal that your card, which I was able to access briefly today when you were in the same elevator as me, authorises purchase of a $500 watch, then I'll pawn the watch and keep the cash. Well, I need the cryptographically signed message from your card saying this is authorized. But, that message needs the unpredictable number that the jewellery store terminal will choose tomorrow, which I don't know yet, so I can't do it. Now, in practice researchers found some terminals and cards are crap and e.g. the numbers they use aren't truly unpredictable. But that's an implementation flaw that can be fixed, just the same as if your bank has a habit of leaving the back door open and the vault unlocked. It's something your defence attorney should know if the bank accuses you of fraud for someone else's transaction, but it's not an inherent problem in "wireless" EMV.
  - tjoff 8y ago
    The whole point is that the attacker can opt to withdraw funds using a site/service/xxx that doesn't perform such authorization. I've only seen such authorizations be used on domestic sites, an attacker would probably even prefer to withdraw funds from a country other than that of the victim. Making the whole endeavor pointless.
    - tialaramex 8y ago
      Absent the authorization you can just unwind the transaction, since there's no evidence whatsoever that you authorized it. It will depend on how strong consumer protection is as to whether this actually leaves you financially whole afterwards or whether the bank is able to get away with just giving back the money for the single transaction. To the extent that Authorization isn't mandatory before the Payment step, sure, everything about payment cards is "pointless". Banks have decided they don't care about fraud and will just pass that cost on to you. shrug
- gsich 8y ago
  During my visit in the US, sometimes my European creditcard would not work with magnetic stripe, the dealer telling me to use the chip. There were some terminals which had a non working chip-reader, you had to enter the cardnumber + CVV to pay.
  - tjoff 8y ago
    Not sure what your point is, the success rate of a magnetic skimmer would be 100% regardless.
    - gsich 8y ago
      That the home bank somehow knows that you just used the magnetic stripe and says "I want the chip". Of course skimming (the act of reading and copying the magnetic data) still works, but payment not.
      - tjoff 8y ago
        My memory is hazy on this but I believe there is a bit on the magnetic stripe that says "hey, I have a chip please use that instead". And if the terminal supports chips it will probably ask you to use the chip instead. If the terminal does not have a chip reader (or doesn't parse that information) it will allow the purchase. If you are cloning the magnetic stripe you would of course reset that bit and you would be all good.
- rocqua 8y ago
  I've seen you claim wireless cards are really insecure a few times in this thread. I was wondering about a source, and about the mechanism. Certainly, using rather basic NFC smart card technology, all but on-line attacks could be eliminated. My question is then, what kind of low-protection protocol do they use in practice to make this so insecure. Specifically, I am asking about an offline attack that allows an actual spend the bank would accept. I am also only interested in debit cards (because that is what I have) so just reading a CC number from NFC doesn't bother me.
  - Crosseye_Jack 8y ago
    My "Party trick" when NFC payments was newish in the UK was using a pair of Nexus S phones in a relay attack. I would say to a friend "I bet I can buy the next round using your card, if I can you buy the round if not I'll buy the round" Get them to place their wallet with their card in it on the table with one of my phones near the wallet and I would present my other phone to the reader at the bar. At the time the bar I did it at had public wifi without Wireless Isolation so I could use the bar's wifi as a low latency connection between the two phones but back then the tolerances on the timings would allow you do do it with a decent mobile connection. (At one point you could just get a NexusS custom rom already set up for this replay attack). It was more of a party trick as you had to have close proximity to the payment card as it was just a relay attack and the banks limited NFC transactions to a max of £20 which the banks would cover (its been bumped upto £30 these days or more if you auth with biometrics like with Apple Pay if the store permits the transaction). I believe NFC payment terminals these days have tightened up the timings of card reads to make such relay attacks more difficult.
    - rocqua 8y ago
      Yeah, active attacks are where PIN-less NFC gets really scary. That said, just losing such a card is also scary. It amazes me how timing makes it possible to detect this kind of stuff.
      - Crosseye_Jack 8y ago
JorgeGT 8y ago
BBVA in Spain has the same thing, it directly asks which phone number to send the code to, in case you want another person to withdraw the money: https://www.youtube.com/watch?v=Hb6KNWSKXmE https://www.youtube.com/watch?v=Hb6KNWSKXmE
- icebraining 8y ago
  Same in Portugal (for all banks, as we have a single ATM network owned by all of them).

eboyjr 8y ago

Does it work without a mobile data connection? Regardless this is a great idea and I would love to know what it would take to convince other banks to do the same.

Daniel_sk 8y ago
It doesn't - but usually everyone has a mobile data plan here and coverage is great, so it's not a concern. In the rare event you can use the card as backup. I wish this was some sort of standard between banks. But thankfully this is the biggest bank in the country, so their ATM is usually very close to you (there is no special hardware, it's an ordinary ATM - with just a menu option of entering the one-time code).

tjoff 8y ago

PIN does not protect you from skimmers... Everything you need is on the magnetic stripe, PIN is only needed if you use the chip - which an attacker obviously wouldn't. The whole concept of chip+pin is pretty pathetic considering that the magnetic stripe is still there for backwards compatibility. And now with wireless cards it is even less secure than a magnetic stripe.

Daniel_sk 8y ago
Ok, I didn't know that. But I have never used the magnetic strip in Europe, I don't think anyone accepts it here. My previous bank would even issue standard debit cards without the magnetic strip. So how would you use the card without the PIN? Can you read the whole card number + expiration + CVV code and then buy something online?
- tjoff 8y ago
  In Sweden it is not that uncommon (majority of readers take both chip+magnetic stripe). Also, ATMs swallow the whole card so a skimmer would work there even if the ATM itself only uses the chip. And now with wireless you could probably trivially skim people that used the chip (or wireless) functionality as well. I have never seen a card without magnetic stripe, that is awesome. I even have some trouble getting a card without wireless... At least whole card number + expiration is on the magnetic stripe. You don't need CVV as it is optional. Everything is written in clear-text and by definition that text must contain everything needed to perform a purchase.
tialaramex 8y ago
As I described below, all of this is part of Authorization, in principle an old-fashioned carbon impression sheet of your card could be used to justify a $5000 payment and it's up to you to contest that if it's bogus. Authorization protects the bank, not the customers. But for the Authorization a PIN absolutely can be required for online card transactions using a mag stripe. And this was routinely done in countries which had PINs for debit cards years before EMV. The terminal calls the bank and says I have this card, and here's the PIN entered by the customer, is that OK? Unlike the mag stripe you can't clone a card using the "wireless" EMV mode, the chip isn't just playing back a fixed data stream, it's an active component. [ It might be instructive to expand here, so I shall ] A part of an EMV transaction the terminal and card are supposed to pick random ("unpredictable") numbers each time. If this is done correctly it presents a significant security feature. For example, suppose tomorrow I plan to tell a jewellery store's payment terminal that your card, which I was able to access briefly today when you were in the same elevator as me, authorises purchase of a $500 watch, then I'll pawn the watch and keep the cash. Well, I need the cryptographically signed message from your card saying this is authorized. But, that message needs the unpredictable number that the jewellery store terminal will choose tomorrow, which I don't know yet, so I can't do it. Now, in practice researchers found some terminals and cards are crap and e.g. the numbers they use aren't truly unpredictable. But that's an implementation flaw that can be fixed, just the same as if your bank has a habit of leaving the back door open and the vault unlocked. It's something your defence attorney should know if the bank accuses you of fraud for someone else's transaction, but it's not an inherent problem in "wireless" EMV.
- tjoff 8y ago
  The whole point is that the attacker can opt to withdraw funds using a site/service/xxx that doesn't perform such authorization. I've only seen such authorizations be used on domestic sites, an attacker would probably even prefer to withdraw funds from a country other than that of the victim. Making the whole endeavor pointless.
  - tialaramex 8y ago
    Absent the authorization you can just unwind the transaction, since there's no evidence whatsoever that you authorized it. It will depend on how strong consumer protection is as to whether this actually leaves you financially whole afterwards or whether the bank is able to get away with just giving back the money for the single transaction. To the extent that Authorization isn't mandatory before the Payment step, sure, everything about payment cards is "pointless". Banks have decided they don't care about fraud and will just pass that cost on to you. shrug
gsich 8y ago
During my visit in the US, sometimes my European creditcard would not work with magnetic stripe, the dealer telling me to use the chip. There were some terminals which had a non working chip-reader, you had to enter the cardnumber + CVV to pay.
- tjoff 8y ago
  Not sure what your point is, the success rate of a magnetic skimmer would be 100% regardless.
  - gsich 8y ago
    That the home bank somehow knows that you just used the magnetic stripe and says "I want the chip". Of course skimming (the act of reading and copying the magnetic data) still works, but payment not.
    - tjoff 8y ago
      My memory is hazy on this but I believe there is a bit on the magnetic stripe that says "hey, I have a chip please use that instead". And if the terminal supports chips it will probably ask you to use the chip instead. If the terminal does not have a chip reader (or doesn't parse that information) it will allow the purchase. If you are cloning the magnetic stripe you would of course reset that bit and you would be all good.
rocqua 8y ago
I've seen you claim wireless cards are really insecure a few times in this thread. I was wondering about a source, and about the mechanism. Certainly, using rather basic NFC smart card technology, all but on-line attacks could be eliminated. My question is then, what kind of low-protection protocol do they use in practice to make this so insecure. Specifically, I am asking about an offline attack that allows an actual spend the bank would accept. I am also only interested in debit cards (because that is what I have) so just reading a CC number from NFC doesn't bother me.
- Crosseye_Jack 8y ago
  My "Party trick" when NFC payments was newish in the UK was using a pair of Nexus S phones in a relay attack. I would say to a friend "I bet I can buy the next round using your card, if I can you buy the round if not I'll buy the round" Get them to place their wallet with their card in it on the table with one of my phones near the wallet and I would present my other phone to the reader at the bar. At the time the bar I did it at had public wifi without Wireless Isolation so I could use the bar's wifi as a low latency connection between the two phones but back then the tolerances on the timings would allow you do do it with a decent mobile connection. (At one point you could just get a NexusS custom rom already set up for this replay attack). It was more of a party trick as you had to have close proximity to the payment card as it was just a relay attack and the banks limited NFC transactions to a max of £20 which the banks would cover (its been bumped upto £30 these days or more if you auth with biometrics like with Apple Pay if the store permits the transaction). I believe NFC payment terminals these days have tightened up the timings of card reads to make such relay attacks more difficult.
  - rocqua 8y ago
    Yeah, active attacks are where PIN-less NFC gets really scary. That said, just losing such a card is also scary. It amazes me how timing makes it possible to detect this kind of stuff.
    - Crosseye_Jack 8y ago

JorgeGT 8y ago

BBVA in Spain has the same thing, it directly asks which phone number to send the code to, in case you want another person to withdraw the money: https://www.youtube.com/watch?v=Hb6KNWSKXmE https://www.youtube.com/watch?v=Hb6KNWSKXmE

icebraining 8y ago
Same in Portugal (for all banks, as we have a single ATM network owned by all of them).