3 ms·
I thought chip and pin could be trivially captured/cloned due to some flaw in the underlying technology?
by sizzle 8y ago
I thought chip and pin could be trivially captured/cloned due to some flaw in the underlying technology?
- tialaramex 8y agoThere are plenty of flaws in the underlying technology, and most especially in real world implementations, but I don't know that any of them result in the chip being cloned. Anybody? An example I know about with one of those flaws was the "Yes card" which MITMs a real (presumably stolen) card and arranges that the conversation goes like this: * Legitimate terminal "Hi, I'm a Legitimate terminal, who are you?" * Real card: "Hi, I'm Sizzle's Real Payment Card from Real Bank" * Legitimate terminal "OK, let's do an offline transaction. I want Sizzle to authorise payment of 24.50. They entered PIN 1234, is that OK?" MITM Yes card blocks this and tells the card instead: "OK, let's do an offline transaction. I want Sizzle to authorize payment of 24.50, but I can't be bothered with a PIN so let's skip that" * Real card: "OK, yes, payment of 24.50 sounds fine" (cryptographically signed message) So this way you don't need the correct PIN, since the card never realises you entered a PIN, and so the transaction OK simply never mentions the PIN at all. You don't clone the card though, you need a real card, you're just using something like a Confused Deputy attack where the card and terminal misunderstand the situation. A _smart_ backend at the bank could identify this fraud when the offline transactions are processed, hours or days later, but many did not, and even if they did spot it the fraudsters got away with their transaction meanwhile. The permanent "fix" for this was to roll out new cards and terminals, given this costs money it was probably not done widely or quickly.
- sizzle 8y agoI may be mistaken about the chip/pin capturing, thanks for the breakdown.