8 ms·

You can just buy counterfeit anti-tamper stickers but if there is a switch inside the unit that flips a bit in some sort of write-once memory, then that would r

by moftz 8y ago

You can just buy counterfeit anti-tamper stickers but if there is a switch inside the unit that flips a bit in some sort of write-once memory, then that would require removal of an entire chip and replacing it with another that may not be 100% the same. You can have a chain of trust in the system where chips will only talk to each other if they all spit out the right hash. Bury the SPI/I2C lines you use for this trust check within the PCB so you can't access it without drilling the card and add a layer of anti-tamper traces that trigger another tamper event if disturbed. Now what was just a quick install has turned into a whole PCB rework job where you are having to swap all the chips with a virgin set, assuming you can't get your hardware in there prior to final assembly. Use an AES256 key from the factory to hash the chip's burned-in serial number and the time from the RTC. Lock out JTAG interfaces so once the chips are burned, they are inside their own fortress. There are a ton of ways to really lock down the hardware other than a shiny sticker and weird screws. Those keep people from breaking their own hardware, anti-tamper tech in chips keep out bad guys.

lmilcin 8y ago
The device outer enclosure was tamper evident but the device itself was tamper proof HSM, basically. Any kind of intrusion (melting, dissolving, drilling, etc.) into a secure internal enclosure (separate processor, memory and battery) would cause internal battery to be disconnected from internal SRAM and basically the device would loose all cryptographic material and then self-destruct. To give a bit of background, when you type your PIN on credit card terminal it is not the terminal application that is really getting the pin (well, except for special credit cards but that is really problem of the Bank that issued the card). The Visa/Mastercard mandate that the application don't have control over the PIN and that the PIN entry uses physically separate keyboard and display. To achieve this, the keyboard and the display is galvanically separated for the duration of the PIN entry and the PIN is transferred directly to the HSM where it is being encrypted before it is transferred to the application processor for the rest of processing.
- caf 8y ago
  Those VISA/MasterCard rules can't be universal because there's at least one bank issuing merchant terminals that run Android and take the PIN on the touchscreen: https://www.commbank.com.au/business/merchant-services/eftpos-terminals/albert.html https://www.commbank.com.au/business/merchant-services/eftpo...
  - jekub 8y ago
    This only accept contact-less payment who doesn't require pincode.
    - dogma1138 8y ago
      PED/PTS devices have even stricter guidelines than contactless payments.
      - jekub 8y ago
        But this device doesn't need a way for the user to enter the pincode. So, all the sensitive part of the terminal is probably completely isolated from the android part. I don't know this device internal and the PED/PTS exact requirement but it seems plausible for me. You have something like a physical compartment who include the NFC and everything needed to process it like in a classical terminal. This compartment is highly secured as requested by the specification with just a very simple interface for the android part to send the amount to bill. I've seen a lot of each-machine running on windows. Doesn't they work like this with the windows machine just managing the display buttons to select the amount and sending this information to the secure part who handle card interaction, pincode and delivery of the money ?
        dogma1138 8y ago
        Yes this is a common design in fact most current solution segregated the POS and POI completely anything that handles the actual credit card whether it's C&P, Track2 or NFC is a closed black box with the required PED/PTS/POI and P2PE certifications the merchant never sees what's going on they only can talk to the thing in bill the next card X and get a confirmation of the transaction that's it they don't see any of the card data they don't even see any card holder data unless they collect it in a side channel e.g. a loyalty program. Now none of these certifications or standards is bullet proof but people have a very skewed vision of the PCI certification process likely due to bias of only having interacting with the PCI-DSS requirements for merchants and low levels to boot meaning they didn't had to do anything but to fill the SAQ themselves and be on their way.
- datavirtue 8y ago
  Worked in the payment industry for years. Visa/Mastercard do absolutely nothing to verify that companies are not storing Pin codes. The HSM is required for communication with them only.
  - dogma1138 8y ago
    That's not correct the QSA will validate that the device does not store PIN codes or the that the merchant does not store anything they are not allowed. Devices that accept cards need to comply with PED/PTS security requirements including very strict physical security requirements which are validated by PCI council approved laboratories and firms. You are not getting a device on the market or usable with any merchanet network without complying with this: https://www.pcisecuritystandards.org/documents/pos_ped_security_requirements.pdf https://www.pcisecuritystandards.org/documents/pos_ped_secur... and a few other standards.
    - baybal2 8y ago
      About that, I can only say that Chinese android POSes do everything in software, for sure, without any hsm present. The question is, how Chinese banks coax Visa into allowing them using them.
      - contingencies 8y ago
        Probably it just goes through as a card not present (CNP) transaction?
        baybal2 8y ago
        So you mean it first authenticates the pin, and initiates CNP after? Never thought of that as possible.
        dogma1138 8y ago
        It's not CNP doesn't use the pin it uses the CVV2, you also can't use the chip and pin or track 2 swipe data for a CNP transaction. I think the GP is confused on how a POS works, POS isn't a POI most of them don't touch the credit card they just talk to the reader, most readers today are P2PE closed loop solutions so the only thing the POS does is sends to the reader charge the next card $X the reader will then reply if the transaction went through or not and that's it. The reader itself will talk to the acquiring bank or the payment provider in a point to point encrypted closed loop and the merchant would never see any credit card details.
- pritambaral 8y ago
  > To achieve this, the keyboard and the display is galvanically separated for the duration of the PIN entry Perhaps this sounds too dull to ask, but what stops the terminal from just ... not separating the keyboard and display?
  - koffiezet 8y ago
    Certification. Worked in the same industry, and there were very strict both hardware and software requirements for POS software. Having gone trough credit-card audits, early EMV certification programs, and certification to place non-payment software next to payment software on such systems, I can tell you - it's no joke :)
    - amelius 8y ago
      > I can tell you - it's no joke :) But still as a user I have no idea if I'm talking to a certified machine or not.
      - closeparen 8y ago
        As a user, fraud is not your problem. Security isn’t there for your benefit.
      - lmilcin 8y ago
        It's not your problem. For the transaction to take place it has to go to your bank and your bank trusts Visa/Mastercard to manage risks. You would be surprised to know most frauds are absorbed by banks. Nobody is interested in people fearing plastic because it causes people to increase very expensive debt plus additional interchange fee from every transaction.
    - joe_the_user 8y ago
      Certification [...] I can tell you - it's no joke :) I'm not so sure. "And then initial supplier inserted hardware that thwarted all those pressing considerations" sounds a punchline to me. :(.
- seanp2k2 8y ago
  But in the US we just use signatures for card transactions instead of chip PIN :/
jsjohnst 8y ago
Do you honestly think any of that is not something a nation state actor could pull off though?
- moftz 8y ago
  I never said a nation state couldn't attempt this but just that if you try really hard to lock down your hardware, it becomes very expensive and risky. You may be better off attacking the system in another way other than cracking it open and soldering your payload in there.
deleted 8y ago
[deleted]

by moftz 8y ago

lmilcin 8y ago

The device outer enclosure was tamper evident but the device itself was tamper proof HSM, basically. Any kind of intrusion (melting, dissolving, drilling, etc.) into a secure internal enclosure (separate processor, memory and battery) would cause internal battery to be disconnected from internal SRAM and basically the device would loose all cryptographic material and then self-destruct. To give a bit of background, when you type your PIN on credit card terminal it is not the terminal application that is really getting the pin (well, except for special credit cards but that is really problem of the Bank that issued the card). The Visa/Mastercard mandate that the application don't have control over the PIN and that the PIN entry uses physically separate keyboard and display. To achieve this, the keyboard and the display is galvanically separated for the duration of the PIN entry and the PIN is transferred directly to the HSM where it is being encrypted before it is transferred to the application processor for the rest of processing.

caf 8y ago
Those VISA/MasterCard rules can't be universal because there's at least one bank issuing merchant terminals that run Android and take the PIN on the touchscreen: https://www.commbank.com.au/business/merchant-services/eftpos-terminals/albert.html https://www.commbank.com.au/business/merchant-services/eftpo...
- jekub 8y ago
  This only accept contact-less payment who doesn't require pincode.
  - dogma1138 8y ago
    PED/PTS devices have even stricter guidelines than contactless payments.
    - jekub 8y ago
      But this device doesn't need a way for the user to enter the pincode. So, all the sensitive part of the terminal is probably completely isolated from the android part. I don't know this device internal and the PED/PTS exact requirement but it seems plausible for me. You have something like a physical compartment who include the NFC and everything needed to process it like in a classical terminal. This compartment is highly secured as requested by the specification with just a very simple interface for the android part to send the amount to bill. I've seen a lot of each-machine running on windows. Doesn't they work like this with the windows machine just managing the display buttons to select the amount and sending this information to the secure part who handle card interaction, pincode and delivery of the money ?
      - dogma1138 8y ago
        Yes this is a common design in fact most current solution segregated the POS and POI completely anything that handles the actual credit card whether it's C&P, Track2 or NFC is a closed black box with the required PED/PTS/POI and P2PE certifications the merchant never sees what's going on they only can talk to the thing in bill the next card X and get a confirmation of the transaction that's it they don't see any of the card data they don't even see any card holder data unless they collect it in a side channel e.g. a loyalty program. Now none of these certifications or standards is bullet proof but people have a very skewed vision of the PCI certification process likely due to bias of only having interacting with the PCI-DSS requirements for merchants and low levels to boot meaning they didn't had to do anything but to fill the SAQ themselves and be on their way.
datavirtue 8y ago
Worked in the payment industry for years. Visa/Mastercard do absolutely nothing to verify that companies are not storing Pin codes. The HSM is required for communication with them only.
- dogma1138 8y ago
  That's not correct the QSA will validate that the device does not store PIN codes or the that the merchant does not store anything they are not allowed. Devices that accept cards need to comply with PED/PTS security requirements including very strict physical security requirements which are validated by PCI council approved laboratories and firms. You are not getting a device on the market or usable with any merchanet network without complying with this: https://www.pcisecuritystandards.org/documents/pos_ped_security_requirements.pdf https://www.pcisecuritystandards.org/documents/pos_ped_secur... and a few other standards.
  - baybal2 8y ago
    About that, I can only say that Chinese android POSes do everything in software, for sure, without any hsm present. The question is, how Chinese banks coax Visa into allowing them using them.
    - contingencies 8y ago
      Probably it just goes through as a card not present (CNP) transaction?
      - baybal2 8y ago
        So you mean it first authenticates the pin, and initiates CNP after? Never thought of that as possible.
        dogma1138 8y ago
        It's not CNP doesn't use the pin it uses the CVV2, you also can't use the chip and pin or track 2 swipe data for a CNP transaction. I think the GP is confused on how a POS works, POS isn't a POI most of them don't touch the credit card they just talk to the reader, most readers today are P2PE closed loop solutions so the only thing the POS does is sends to the reader charge the next card $X the reader will then reply if the transaction went through or not and that's it. The reader itself will talk to the acquiring bank or the payment provider in a point to point encrypted closed loop and the merchant would never see any credit card details.
pritambaral 8y ago
> To achieve this, the keyboard and the display is galvanically separated for the duration of the PIN entry Perhaps this sounds too dull to ask, but what stops the terminal from just ... not separating the keyboard and display?
- koffiezet 8y ago
  Certification. Worked in the same industry, and there were very strict both hardware and software requirements for POS software. Having gone trough credit-card audits, early EMV certification programs, and certification to place non-payment software next to payment software on such systems, I can tell you - it's no joke :)
  - amelius 8y ago
    > I can tell you - it's no joke :) But still as a user I have no idea if I'm talking to a certified machine or not.
    - closeparen 8y ago
      As a user, fraud is not your problem. Security isn’t there for your benefit.
    - lmilcin 8y ago
      It's not your problem. For the transaction to take place it has to go to your bank and your bank trusts Visa/Mastercard to manage risks. You would be surprised to know most frauds are absorbed by banks. Nobody is interested in people fearing plastic because it causes people to increase very expensive debt plus additional interchange fee from every transaction.
  - joe_the_user 8y ago
    Certification [...] I can tell you - it's no joke :) I'm not so sure. "And then initial supplier inserted hardware that thwarted all those pressing considerations" sounds a punchline to me. :(.
seanp2k2 8y ago
But in the US we just use signatures for card transactions instead of chip PIN :/

jsjohnst 8y ago

Do you honestly think any of that is not something a nation state actor could pull off though?

moftz 8y ago
I never said a nation state couldn't attempt this but just that if you try really hard to lock down your hardware, it becomes very expensive and risky. You may be better off attacking the system in another way other than cracking it open and soldering your payload in there.

deleted 8y ago

[deleted]