5 ms·
My "Party trick" when NFC payments was newish in the UK was using a pair of Nexus S phones in a relay attack. I would say to a friend "I bet I can buy the next
by Crosseye_Jack 8y ago
My "Party trick" when NFC payments was newish in the UK was using a pair of Nexus S phones in a relay attack.
I would say to a friend "I bet I can buy the next round using your card, if I can you buy the round if not I'll buy the round" Get them to place their wallet with their card in it on the table with one of my phones near the wallet and I would present my other phone to the reader at the bar.
At the time the bar I did it at had public wifi without Wireless Isolation so I could use the bar's wifi as a low latency connection between the two phones but back then the tolerances on the timings would allow you do do it with a decent mobile connection. (At one point you could just get a NexusS custom rom already set up for this replay attack).
It was more of a party trick as you had to have close proximity to the payment card as it was just a relay attack and the banks limited NFC transactions to a max of £20 which the banks would cover (its been bumped upto £30 these days or more if you auth with biometrics like with Apple Pay if the store permits the transaction).
I believe NFC payment terminals these days have tightened up the timings of card reads to make such relay attacks more difficult.
- rocqua 8y agoYeah, active attacks are where PIN-less NFC gets really scary. That said, just losing such a card is also scary. It amazes me how timing makes it possible to detect this kind of stuff.
- Crosseye_Jack 8y agoI've never been asked for a pin when using NFC payments (if you don't count the times I've used my phone) but I mix my card transactions up all the time between cash width drawls, Chip and Pin payments and NFC so I guess the "ask for a pin counter / algo" gets reset when I use a pin in Chip and Pin / ATM. I believe that after so many NFC payments (without reseting the count) or try and make a purchase over £30 they ask for a pin and my bank will cover any NFC payments on a lost card as long as you make them aware of the loss within a reasonable time period. So personally I'm not too worried about losing my NFC card. They know its not a perfect system (is anything perfect?) so limit their loss by restricting the amounts used on such cards. EDIT: Esp as a lost card could be used for online transactions as they have the CVV (as they have the card) and losing your card prob means losing your wallet and prob your driving license with your address on it (almost everything a bad actor needs to make an online purchase, just got to hope that Verified by Visa / Mastercard SecureCode kicks in).
- rocqua 8y agoI actually need the PIN for any payment over €25, which can still be done with NFC. Besides that, I'd say I still need to enter my PIN for small payments roughly once every 2 weeks.
- Crosseye_Jack 8y agoI believe the "purchase over £30" in the UK is dependant on the store. Instead of asking I've just use Chip and Pin for such transactions. But yeah never had the "enter your pin" for small NFC payments. Guess the bank thinks I'm a low risk :-p (Now I've said it I bet the next time I use NFC it will pester me for a pin :-p)
- rocqua 8y agoIn the Netherlands, its something along the lines of "Every x payments, you need a PIN". I'd guess that any payment with PIN resets the counter. I was discussing with colleagues how smart the interval is. Perhaps the bank is doing some anomaly detection to inform whether a PIN is needed.