7 ms·

I don't think tap to pay can be skimmed in the same way you can with swiping. You'd have to actually clone the data on the NFC chip, which isn't possible throug

I don't think tap to pay can be skimmed in the same way you can with swiping. You'd have to actually clone the data on the NFC chip, which isn't possible through a tap from what I understand.

samwillis 5y ago
I believe it's possible to perform a MITM attack on contactless cards. From a quick google: https://ieeexplore.ieee.org/document/9220841 https://ieeexplore.ieee.org/document/9220841 I do also remember reading about researchers at Cambridge University who were looking at this maybe 7-8 years ago.
- thebean11 5y ago
  Interesting! Wasn't aware of that. Is this something that's being actively exploited in the wild though? It won't let me read the actual paper so it's hard for me to tell how practical the attack is.
  - alimov 5y ago
    Impractical things have a tendency to become practical when enough money is involved:)
- judge2020 5y ago
  There's also this: https://youtu.be/YmJ4ULncNwg https://youtu.be/YmJ4ULncNwg // https://i.blackhat.com/asia-20/Thursday/asia-20-Galloway-First-Contact-New-Vulnerabilities-In-Contactless-Payments-wp.pdf https://i.blackhat.com/asia-20/Thursday/asia-20-Galloway-Fir...
djrogers 5y ago
It’d be trivial for a rogue payment app to display one $ amount on the screen yet deduct another.
- thebean11 5y ago
  Display the $ amount on which device though? If you want to be secure, you display it on the customer's iPhone and have them confirm. Either way though, this is different from skimming. Skimming allows the skimmer to make future transactions which is much much worse.
  - nmstoker 5y ago
    Absolutely agree, it ought to be displayed and then consented to based on that knowledge. Right now with most contactless in shops in the UK you're left thinking "did they key that amount in right?" and if you're paranoid you ask for a receipt (from the machine, although merchants often drag their feet or try to give you one from the till not the reader!) and/or you check on the phone afterwards (which would be a pain if it showed an issue because by then it's a bit late!)
- minitoar 5y ago
  Presumably these apps will be heavily locked down and reviewed by Apple to mitigate this. Could also imagine iOS ux to help here (obviously could still be phished).
- samwillis 5y ago
  I suspect that Apple will have full control of the screen, like Apple Pay. Your POS app will call an apple+(stripe/other) api which will show the payment screen and enable the NFC hardware. There will be no way of an app to display a fake payment screen in front of the real one, or accessing the NFT apis themselves. It's clearly one of the key reasons why Apple have not opened up the NFC hardware for outside developers.
- pimterry 5y ago
  This risk also applies to any card terminal where you pay contactlessly. In Europe, that effectively means every card terminal everywhere and a comfortable majority of card transactions (https://www.mastercard.com/news/europe/en-uk/newsroom/press-releases/en-gb/2020/march/mastercard-enables-contactless-limit-raise-across-29-countries-and-champions-permanent-increase/ https://www.mastercard.com/news/europe/en-uk/newsroom/press-... says 75% of mastercard transactions in Europe are contactless). The main protections against this are maximum limits for unverified contactless purchases (about €50, depending on the country) and banks outright guaranteeing customers against fraud (https://europa.eu/youreurope/citizens/consumers/financial-products-and-services/payments-transfers-cheques/index_en.htm#shortcut-2 https://europa.eu/youreurope/citizens/consumers/financial-pr...). No idea how that can translate directly onto phone-based terminals though. On cards, the extra-validation backup for suspicious/over the daily limit transactions is that the contactless machine asks you for your pin, but there's no way anybody should be typing their card pin into a random stranger's iPhone.

I don't think tap to pay can be skimmed in the same way you can with swiping. You'd have to actually clone the data on the NFC chip, which isn't possible through a tap from what I understand.

samwillis 5y ago

I believe it's possible to perform a MITM attack on contactless cards. From a quick google: https://ieeexplore.ieee.org/document/9220841 https://ieeexplore.ieee.org/document/9220841 I do also remember reading about researchers at Cambridge University who were looking at this maybe 7-8 years ago.

thebean11 5y ago
Interesting! Wasn't aware of that. Is this something that's being actively exploited in the wild though? It won't let me read the actual paper so it's hard for me to tell how practical the attack is.
- alimov 5y ago
  Impractical things have a tendency to become practical when enough money is involved:)
judge2020 5y ago
There's also this: https://youtu.be/YmJ4ULncNwg https://youtu.be/YmJ4ULncNwg // https://i.blackhat.com/asia-20/Thursday/asia-20-Galloway-First-Contact-New-Vulnerabilities-In-Contactless-Payments-wp.pdf https://i.blackhat.com/asia-20/Thursday/asia-20-Galloway-Fir...

djrogers 5y ago

It’d be trivial for a rogue payment app to display one $ amount on the screen yet deduct another.

thebean11 5y ago
Display the $ amount on which device though? If you want to be secure, you display it on the customer's iPhone and have them confirm. Either way though, this is different from skimming. Skimming allows the skimmer to make future transactions which is much much worse.
- nmstoker 5y ago
  Absolutely agree, it ought to be displayed and then consented to based on that knowledge. Right now with most contactless in shops in the UK you're left thinking "did they key that amount in right?" and if you're paranoid you ask for a receipt (from the machine, although merchants often drag their feet or try to give you one from the till not the reader!) and/or you check on the phone afterwards (which would be a pain if it showed an issue because by then it's a bit late!)
minitoar 5y ago
Presumably these apps will be heavily locked down and reviewed by Apple to mitigate this. Could also imagine iOS ux to help here (obviously could still be phished).
samwillis 5y ago
I suspect that Apple will have full control of the screen, like Apple Pay. Your POS app will call an apple+(stripe/other) api which will show the payment screen and enable the NFC hardware. There will be no way of an app to display a fake payment screen in front of the real one, or accessing the NFT apis themselves. It's clearly one of the key reasons why Apple have not opened up the NFC hardware for outside developers.
pimterry 5y ago
This risk also applies to any card terminal where you pay contactlessly. In Europe, that effectively means every card terminal everywhere and a comfortable majority of card transactions (https://www.mastercard.com/news/europe/en-uk/newsroom/press-releases/en-gb/2020/march/mastercard-enables-contactless-limit-raise-across-29-countries-and-champions-permanent-increase/ https://www.mastercard.com/news/europe/en-uk/newsroom/press-... says 75% of mastercard transactions in Europe are contactless). The main protections against this are maximum limits for unverified contactless purchases (about €50, depending on the country) and banks outright guaranteeing customers against fraud (https://europa.eu/youreurope/citizens/consumers/financial-products-and-services/payments-transfers-cheques/index_en.htm#shortcut-2 https://europa.eu/youreurope/citizens/consumers/financial-pr...). No idea how that can translate directly onto phone-based terminals though. On cards, the extra-validation backup for suspicious/over the daily limit transactions is that the contactless machine asks you for your pin, but there's no way anybody should be typing their card pin into a random stranger's iPhone.