5 ms·

I've seen you claim wireless cards are really insecure a few times in this thread. I was wondering about a source, and about the mechanism. Certainly, using ra

by rocqua 8y ago

I've seen you claim wireless cards are really insecure a few times in this thread. I was wondering about a source, and about the mechanism. Certainly, using rather basic NFC smart card technology, all but on-line attacks could be eliminated. My question is then, what kind of low-protection protocol do they use in practice to make this so insecure. Specifically, I am asking about an offline attack that allows an actual spend the bank would accept. I am also only interested in debit cards (because that is what I have) so just reading a CC number from NFC doesn't bother me.

Crosseye_Jack 8y ago
My "Party trick" when NFC payments was newish in the UK was using a pair of Nexus S phones in a relay attack. I would say to a friend "I bet I can buy the next round using your card, if I can you buy the round if not I'll buy the round" Get them to place their wallet with their card in it on the table with one of my phones near the wallet and I would present my other phone to the reader at the bar. At the time the bar I did it at had public wifi without Wireless Isolation so I could use the bar's wifi as a low latency connection between the two phones but back then the tolerances on the timings would allow you do do it with a decent mobile connection. (At one point you could just get a NexusS custom rom already set up for this replay attack). It was more of a party trick as you had to have close proximity to the payment card as it was just a relay attack and the banks limited NFC transactions to a max of £20 which the banks would cover (its been bumped upto £30 these days or more if you auth with biometrics like with Apple Pay if the store permits the transaction). I believe NFC payment terminals these days have tightened up the timings of card reads to make such relay attacks more difficult.
- rocqua 8y ago
  Yeah, active attacks are where PIN-less NFC gets really scary. That said, just losing such a card is also scary. It amazes me how timing makes it possible to detect this kind of stuff.
  - Crosseye_Jack 8y ago
    I've never been asked for a pin when using NFC payments (if you don't count the times I've used my phone) but I mix my card transactions up all the time between cash width drawls, Chip and Pin payments and NFC so I guess the "ask for a pin counter / algo" gets reset when I use a pin in Chip and Pin / ATM. I believe that after so many NFC payments (without reseting the count) or try and make a purchase over £30 they ask for a pin and my bank will cover any NFC payments on a lost card as long as you make them aware of the loss within a reasonable time period. So personally I'm not too worried about losing my NFC card. They know its not a perfect system (is anything perfect?) so limit their loss by restricting the amounts used on such cards. EDIT: Esp as a lost card could be used for online transactions as they have the CVV (as they have the card) and losing your card prob means losing your wallet and prob your driving license with your address on it (almost everything a bad actor needs to make an online purchase, just got to hope that Verified by Visa / Mastercard SecureCode kicks in).
    - rocqua 8y ago
      I actually need the PIN for any payment over €25, which can still be done with NFC. Besides that, I'd say I still need to enter my PIN for small payments roughly once every 2 weeks.
      - Crosseye_Jack 8y ago
        I believe the "purchase over £30" in the UK is dependant on the store. Instead of asking I've just use Chip and Pin for such transactions. But yeah never had the "enter your pin" for small NFC payments. Guess the bank thinks I'm a low risk :-p (Now I've said it I bet the next time I use NFC it will pester me for a pin :-p)
        rocqua 8y ago
        In the Netherlands, its something along the lines of "Every x payments, you need a PIN". I'd guess that any payment with PIN resets the counter. I was discussing with colleagues how smart the interval is. Perhaps the bank is doing some anomaly detection to inform whether a PIN is needed.
tjoff 8y ago
Why would just reading a CC number and expiration date not bother you? (on lots of cards they are just plain-text for anyone who asks)
- rocqua 8y ago
  Because I use a (Dutch) debit card. This is not a Credit Card, so it does not have a real card number (it has a 4-digit number to identify it among potential other cards issued for my account). I just checked, and was surprised to see it had an expiration date, because that does not play any role in authentication. Note that I am coming at this from the perspective "Is payment in my country done well". So I only care about attacks against my card, and the cards of people I know. It does seem stupid to me to have a CC number and expiration date available in plain text. But honestly, I am more amazed by that information being sufficient to authorize payment. That said, it amazes that 'upgrades' both neglect to fix the underlying issue, and fail to take it into account in their implementation. Besides this entire story, there is an interesting issue of PIN-less tap-and-pay, which scares me more (from the dutch perspective) than plaintext data on my NFC card. It doesn't scare me enough to disable it though.
  - tjoff 8y ago
    How do you purchase something on international sites? I totally agree that the requirements to authorize a transaction is laughable. Even more so that the information is printed on the card itself, insane.
    - rocqua 8y ago
      I use paypal when possible. Otherwise, I have a separate, rarely used, credit card. The card has no NFC. Notably, every time I've used it on-line, it forwarded me to my banks website, where I needed to do a 2 factor thing. I'd guess that is vendor-dependent though. I can't imagine US webshops are setup for that. (Most of my usage is amazon.de)

by rocqua 8y ago

Crosseye_Jack 8y ago

My "Party trick" when NFC payments was newish in the UK was using a pair of Nexus S phones in a relay attack. I would say to a friend "I bet I can buy the next round using your card, if I can you buy the round if not I'll buy the round" Get them to place their wallet with their card in it on the table with one of my phones near the wallet and I would present my other phone to the reader at the bar. At the time the bar I did it at had public wifi without Wireless Isolation so I could use the bar's wifi as a low latency connection between the two phones but back then the tolerances on the timings would allow you do do it with a decent mobile connection. (At one point you could just get a NexusS custom rom already set up for this replay attack). It was more of a party trick as you had to have close proximity to the payment card as it was just a relay attack and the banks limited NFC transactions to a max of £20 which the banks would cover (its been bumped upto £30 these days or more if you auth with biometrics like with Apple Pay if the store permits the transaction). I believe NFC payment terminals these days have tightened up the timings of card reads to make such relay attacks more difficult.

rocqua 8y ago
Yeah, active attacks are where PIN-less NFC gets really scary. That said, just losing such a card is also scary. It amazes me how timing makes it possible to detect this kind of stuff.
- Crosseye_Jack 8y ago
  I've never been asked for a pin when using NFC payments (if you don't count the times I've used my phone) but I mix my card transactions up all the time between cash width drawls, Chip and Pin payments and NFC so I guess the "ask for a pin counter / algo" gets reset when I use a pin in Chip and Pin / ATM. I believe that after so many NFC payments (without reseting the count) or try and make a purchase over £30 they ask for a pin and my bank will cover any NFC payments on a lost card as long as you make them aware of the loss within a reasonable time period. So personally I'm not too worried about losing my NFC card. They know its not a perfect system (is anything perfect?) so limit their loss by restricting the amounts used on such cards. EDIT: Esp as a lost card could be used for online transactions as they have the CVV (as they have the card) and losing your card prob means losing your wallet and prob your driving license with your address on it (almost everything a bad actor needs to make an online purchase, just got to hope that Verified by Visa / Mastercard SecureCode kicks in).
  - rocqua 8y ago
    I actually need the PIN for any payment over €25, which can still be done with NFC. Besides that, I'd say I still need to enter my PIN for small payments roughly once every 2 weeks.
    - Crosseye_Jack 8y ago
      I believe the "purchase over £30" in the UK is dependant on the store. Instead of asking I've just use Chip and Pin for such transactions. But yeah never had the "enter your pin" for small NFC payments. Guess the bank thinks I'm a low risk :-p (Now I've said it I bet the next time I use NFC it will pester me for a pin :-p)
      - rocqua 8y ago
        In the Netherlands, its something along the lines of "Every x payments, you need a PIN". I'd guess that any payment with PIN resets the counter. I was discussing with colleagues how smart the interval is. Perhaps the bank is doing some anomaly detection to inform whether a PIN is needed.

tjoff 8y ago

Why would just reading a CC number and expiration date not bother you? (on lots of cards they are just plain-text for anyone who asks)

rocqua 8y ago
Because I use a (Dutch) debit card. This is not a Credit Card, so it does not have a real card number (it has a 4-digit number to identify it among potential other cards issued for my account). I just checked, and was surprised to see it had an expiration date, because that does not play any role in authentication. Note that I am coming at this from the perspective "Is payment in my country done well". So I only care about attacks against my card, and the cards of people I know. It does seem stupid to me to have a CC number and expiration date available in plain text. But honestly, I am more amazed by that information being sufficient to authorize payment. That said, it amazes that 'upgrades' both neglect to fix the underlying issue, and fail to take it into account in their implementation. Besides this entire story, there is an interesting issue of PIN-less tap-and-pay, which scares me more (from the dutch perspective) than plaintext data on my NFC card. It doesn't scare me enough to disable it though.
- tjoff 8y ago
  How do you purchase something on international sites? I totally agree that the requirements to authorize a transaction is laughable. Even more so that the information is printed on the card itself, insane.
  - rocqua 8y ago
    I use paypal when possible. Otherwise, I have a separate, rarely used, credit card. The card has no NFC. Notably, every time I've used it on-line, it forwarded me to my banks website, where I needed to do a 2 factor thing. I'd guess that is vendor-dependent though. I can't imagine US webshops are setup for that. (Most of my usage is amazon.de)