4 ms·

>The retail side blew up -- no consumer wanted it, and it was technologically bad. Didn't help that thr superior user experience of NFC built into cards was dr

>The retail side blew up -- no consumer wanted it, and it was technologically bad. Didn't help that thr superior user experience of NFC built into cards was drowned out by the klaxons of the media continuously warning customers of proximity theft. Wrong threat model, the cheap mag skimmer or camera or unsecured database models were the real risks. It wasn't that someone will stand butt-to-butt with you to steal a NFC token.

tialaramex 6y ago
There isn't anything to really "steal", a contactless card is willing to participate in transactions but "I am standing next to you" isn't a transaction on its own. You need to do a relay attack. Here's how that goes: 1. Jenny's payment card is in her jacket pocket. 2. Charlie walks into a store wearing a small NFC-capable computer and a medium distance radio (a cell phone might do) perhaps concealed inside his clothing 3. Charlie's friend Barry walks near Jenny, Barry is also wearing a similar setup to Charlie. 4. As Barry gets close to Jenny, Charlie "checks out" at the store, paying with NFC. The transaction travels from a machine near Charlie, through the radio, to Barry (now creepily close to Jenny) and then back over NFC to Jenny's card. Jenny's card agrees to the purchase - everything seems legit. Jenny just paid for Charlie's purchases even though they've never met. This attack isn't economically attractive because transaction sizes are limited. A complicated trick that sometimes allows you to get "free" pizza or coffee in exchange for risking time behind bars seems like a bad idea. If you could get a laptop, or a big TV then it might be more attractive, but you can't because those cost too much to allow mere NFC presence authorization.
- cesarb 6y ago
  What about mobile payment terminals (where I live, they're very common)? Instead of virtually moving the card to the store through a relay attack, move the store to the card through one of the spare payment terminals (many stores have several as a backup for when the POS or the network is down, or for deliveries) hidden in the clothing. Of course, this changes the threat model a bit, since it now needs collusion from a store employee.
  - tialaramex 6y ago
    > Of course, this changes the threat model a bit, since it now needs collusion from a store employee. An employee? Or the store owner? These terminals don't offer a choice of destination bank account, if you type $16.94 into Walmart terminal and hold it near Jenny's card the card will authorize $16.94 payment... to Walmart. For an independent merchant (including e.g. franchise operators) in some sense that's their money in the merchant account, so it makes a little bit more sense, but I still don't think it really adds up. It's like opening a bar so you can get cheap booze, the economics don't make sense. There are opportunities for insider crooks. In the UK for example there were a rash of what are morally skimmers built into chip card terminals. Here's how that worked: You own one or more stores with shiny new EMV payment terminals. From an instructional video you learn how to prise open a common model of terminal without setting off its tamper detection. Then you use the huge space inside the terminal left for an optional security feature (never implemented because features costs money) to add a board that taps the communication to the card and uses a cell phone connection to upload it. You seal up the tampered terminal and install it at one of your busier stores. Customer puts their chip card in, the terminal works as expected but unknown to them your modification stores the card details and transmits them to other crooks half way around the world. The other crooks are making old-fashioned magnetic stripe cards with details that have been uploaded. They send small fry out with these bogus cards to buy stuff in a country that doesn't have EMV yet. The stuff is fenced, and you, back in the country with EMV, get say 10% of the proceeds for your contribution to this international crime. Some people in the UK got prison time for this. International card fraud is easier to spot (this person bought groceries just outside Luton, then forty minutes later they bought a laptop computer in Hyderabad or Houston?) but until EMV is rolled out everywhere similar tricks will be done.
  - PeterisP 6y ago
    Let's suppose that you take a mobile payment terminal, get on the train, and make ten $10 charges (you can't do large transactions contactless) through clothing of some people. What does that mean? First, it does not mean that you're getting any money. Such a charge is effectively "sending an invoice" to the issuing bank from the store which is supposed to have that terminal, and they will pay your merchant bank, which will give money to the institution who got issued that terminal. There's no way for the store clerk personally or someone else to get to these funds. Second, the money is not coming today. You get an authorization message, but you'll receive the actual money later.. if ever. If the payment is disputed, you won't get that money. If it's disputed a month later, they'll take that money back from you. If many of your payments are disputed, then all your incoming funds will be frozen until they verify if all of them should be returned. If multiple payments are disputed, then the standard methods of tracing 'common point of purchase' will reveal the particular terminal as the culprit. Also, malicious merchants is a known threat, so the merchant bank will ensure that you can't just spam a day's worth of fraudulent purchases and run - standard terms will expect that some amount of money is frozen (e.g. rolling 15 days worth of transactions) so if you suddenly get a bunch of chargebacks, the customers will be paid back in full. Fake stores and shell companies are a thing, but there are reasonably effective measures to try and prevent that. So there's no threat through collusion from a store employee - the fraudsters would get identified and would not get any money at all; and there's limited threat from collusion with a whole merchant - the fraudsters would get identified and can't get any meaningful amount of money. Extracting a couple hundred dollars could probably work - but you're "burning" the identities of multiple people and a company; the bank will 'eat' that loss if you succeed, but you can't repeat this trick.

tialaramex 6y ago

There isn't anything to really "steal", a contactless card is willing to participate in transactions but "I am standing next to you" isn't a transaction on its own. You need to do a relay attack. Here's how that goes: 1. Jenny's payment card is in her jacket pocket. 2. Charlie walks into a store wearing a small NFC-capable computer and a medium distance radio (a cell phone might do) perhaps concealed inside his clothing 3. Charlie's friend Barry walks near Jenny, Barry is also wearing a similar setup to Charlie. 4. As Barry gets close to Jenny, Charlie "checks out" at the store, paying with NFC. The transaction travels from a machine near Charlie, through the radio, to Barry (now creepily close to Jenny) and then back over NFC to Jenny's card. Jenny's card agrees to the purchase - everything seems legit. Jenny just paid for Charlie's purchases even though they've never met. This attack isn't economically attractive because transaction sizes are limited. A complicated trick that sometimes allows you to get "free" pizza or coffee in exchange for risking time behind bars seems like a bad idea. If you could get a laptop, or a big TV then it might be more attractive, but you can't because those cost too much to allow mere NFC presence authorization.

cesarb 6y ago
What about mobile payment terminals (where I live, they're very common)? Instead of virtually moving the card to the store through a relay attack, move the store to the card through one of the spare payment terminals (many stores have several as a backup for when the POS or the network is down, or for deliveries) hidden in the clothing. Of course, this changes the threat model a bit, since it now needs collusion from a store employee.
- tialaramex 6y ago
  > Of course, this changes the threat model a bit, since it now needs collusion from a store employee. An employee? Or the store owner? These terminals don't offer a choice of destination bank account, if you type $16.94 into Walmart terminal and hold it near Jenny's card the card will authorize $16.94 payment... to Walmart. For an independent merchant (including e.g. franchise operators) in some sense that's their money in the merchant account, so it makes a little bit more sense, but I still don't think it really adds up. It's like opening a bar so you can get cheap booze, the economics don't make sense. There are opportunities for insider crooks. In the UK for example there were a rash of what are morally skimmers built into chip card terminals. Here's how that worked: You own one or more stores with shiny new EMV payment terminals. From an instructional video you learn how to prise open a common model of terminal without setting off its tamper detection. Then you use the huge space inside the terminal left for an optional security feature (never implemented because features costs money) to add a board that taps the communication to the card and uses a cell phone connection to upload it. You seal up the tampered terminal and install it at one of your busier stores. Customer puts their chip card in, the terminal works as expected but unknown to them your modification stores the card details and transmits them to other crooks half way around the world. The other crooks are making old-fashioned magnetic stripe cards with details that have been uploaded. They send small fry out with these bogus cards to buy stuff in a country that doesn't have EMV yet. The stuff is fenced, and you, back in the country with EMV, get say 10% of the proceeds for your contribution to this international crime. Some people in the UK got prison time for this. International card fraud is easier to spot (this person bought groceries just outside Luton, then forty minutes later they bought a laptop computer in Hyderabad or Houston?) but until EMV is rolled out everywhere similar tricks will be done.
- PeterisP 6y ago
  Let's suppose that you take a mobile payment terminal, get on the train, and make ten $10 charges (you can't do large transactions contactless) through clothing of some people. What does that mean? First, it does not mean that you're getting any money. Such a charge is effectively "sending an invoice" to the issuing bank from the store which is supposed to have that terminal, and they will pay your merchant bank, which will give money to the institution who got issued that terminal. There's no way for the store clerk personally or someone else to get to these funds. Second, the money is not coming today. You get an authorization message, but you'll receive the actual money later.. if ever. If the payment is disputed, you won't get that money. If it's disputed a month later, they'll take that money back from you. If many of your payments are disputed, then all your incoming funds will be frozen until they verify if all of them should be returned. If multiple payments are disputed, then the standard methods of tracing 'common point of purchase' will reveal the particular terminal as the culprit. Also, malicious merchants is a known threat, so the merchant bank will ensure that you can't just spam a day's worth of fraudulent purchases and run - standard terms will expect that some amount of money is frozen (e.g. rolling 15 days worth of transactions) so if you suddenly get a bunch of chargebacks, the customers will be paid back in full. Fake stores and shell companies are a thing, but there are reasonably effective measures to try and prevent that. So there's no threat through collusion from a store employee - the fraudsters would get identified and would not get any money at all; and there's limited threat from collusion with a whole merchant - the fraudsters would get identified and can't get any meaningful amount of money. Extracting a couple hundred dollars could probably work - but you're "burning" the identities of multiple people and a company; the bank will 'eat' that loss if you succeed, but you can't repeat this trick.