7 ms·

I sometimes wonder why the United States is lagging the rest of the world in rolling out a chip standard for their credit cards. These sort of exploits are sig

I sometimes wonder why the United States is lagging the rest of the world in rolling out a chip standard for their credit cards. These sort of exploits are significantly more difficult in other parts of the world that have switched over - the United States use of the outdated "magnetic stripe" for security is not only putting american consumers at risk (Yes, I know, you can always challenge a charge, IF you notice it sneak onto your card, AND if you got to the effort of getting it revoked. Go talk to someone who's been the victim of identity/credit card theft to see how much FUN that is) - it's also putting all the other countries that have to continue to support legacy card systems. At the very least, the credit card agencies in the United States could start rolling out the Card Machines to NEW businesses, in preparation for the eventual upgrade of consumers. My only guess is that they've done a RISK/REWARD assessment, and decided that the cost of upgrading all of these systems is more expensive than what they are losing to fraud.

gergles 14y ago
EMV has been trivially broken[1], and it unpopularly pushes the risk of fraud onto the customer. Customers in the US don't want that (especially since EMV is broken!). On top of that, there are a hell of a lot more merchants that would all need to purchase entirely new credit card terminals, which is a much larger undertaking in this country than it would be elsewhere. [1] http://www.cl.cam.ac.uk/research/security/banking/nopin/oakland10chipbroken.pdf http://www.cl.cam.ac.uk/research/security/banking/nopin/oakl...
- ZoFreX 14y ago
  That's not trivial compared to magnetic stripe. I created a credit card reader with £2 of electronics, my laptop, and a freely available open-source program. (And I'm pretty dumb, so it's really easy)
  - heywire 14y ago
    What about the most vulnerable part of credit cards, the fact that the card information is printed right on the front (and back) of the card? Someone in line at the grocery store with a pen camera in their pocket can catch a glimpse of the front and back of a card. That is generally enough information to use the card online.
    - stephengillie 14y ago
      http://dilbert.com/strips/comic/1996-01-11/ http://dilbert.com/strips/comic/1996-01-11/
    - mikeash 14y ago
      How will you use that card information, though? The printed information isn't sufficient to create a new magnetic stripe (the CVV1 code in the magstripe isn't printed on the card). Using the card info online requires knowing the cardholder's address. If you can find someone still using an imprinter, then that would work, but so would completely made-up data.
      - elithrar 14y ago
        > Using the card info online requires knowing the cardholder's address. US (and Canada, UK) issued cards are verified against the billing address (AVS), in most cases. In other countries (e.g. Australia), this is not the case. The card number and CVC are typically sufficient; you can put any other address you would like. My Amazon billing address is my work address, which is not the address my bank has (my home).
        mikeash 14y ago
        Interesting. Any idea why they don't verify the billing address there? Seems like it would be no harder than doing it in the US.
- isaacwaller 14y ago
  The paper you have linked describes an attack that is only possible if the attacker has stolen the victim's physical card. I think the real security of EMV lies in the fact that cards cannot be cloned - this attack does not change that fact.
- geal 14y ago
  That attack is far from trivial. There were other attacks against EMV in the past, but they're fixed as they come. Magnetic stripes stay vulnerable, and ATMs in the US are not that secure either (seriously, some of them can be stolen and taken home by one man alone). Securing chips is hard, but a lot of the process has already been figured out. What you should fear is the new RFID cards coming up soon. Those are even more vulnerable than magnetic stripes.
- ghshephard 14y ago
  " In this paper we describe and demonstrate a protocol flaw which allows criminals to use a genuine card to make a payment without knowing the card’s PIN, and to remain undetected even when the merchant has an online connection to the banking network." I wasn't even aware that the chipped cards _had_ PINs. I think we can all agree that a chipped card + PIN is more secure than a magnetic strip card with no PIN. But, perhaps the reduction in fraud isn't worth the cost of replacing all the old gear.
mikeash 14y ago
I've had credit cards compromised before. Takes a few minutes to resolve. Really not a big deal. Debit fraud is worse, because the money and incentives are all arranged differently, but credit cards are pretty simple. Credit card fraud should not in any way be lumped in with identity theft, which is a vastly different act that's far more difficult to deal with. Credit card fraud is simply not worth worrying about as a consumer.
- maxerickson 14y ago
  They should both be called fraud (the part where the financial institution inflicts damage on a third party doesn't change the fact that the impersonator is defrauding the financial institution). I think it is important to make the distinction because calling it fraud directs attention at a party that can actually do something about the overall problem.
- ghshephard 14y ago
  I had a friend of mine whose house was broken into, they got his credit card, and it took him close to six months to walk back all the charges they made on his card. He was relentless, and his basic posture was, "Any charge on this card made after the date of the police report is fraudulent." He had to challenge each separate charge though - he couldn't just do them all in bulk. Needless to say - not a pleasant experience, and probably cost him 10s of hours.
  - mikeash 14y ago
    That's odd, how did they manage to make so many purchases with the card? Did he not realize it had been taken for a while?
  - brigade 14y ago
    Out of curiosity, who was the card vendor? When my number was stolen my CU directed me to an online form with which I could dispute all fraudulent charges in bulk, and they were reversed two days later.
nosecreek 14y ago
About a year ago someone did something similar to this (debit cards though, not credit) at the Wal-Mart in the small Canadian city I was living in. Just about everyone in town had their cards frozen and had to get new ones. I'm not sure how the attacker was capturing card information, but I do wonder if it doesn't have to do with the fact that our Chip & Pin cards also have a magnetic stripe.
cynwoody 14y ago
Yes, I know, you can always challenge a charge, IF you notice it sneak onto your card A friend of mine has a system for that, at least at gas stations. Whenever he fills up, he tops it off such that the price ends in a 7. Then he scans his American Express statement for any gas station charges not ending in 7. Over the years, he's done several successful charge-backs.

gergles 14y ago

EMV has been trivially broken[1], and it unpopularly pushes the risk of fraud onto the customer. Customers in the US don't want that (especially since EMV is broken!). On top of that, there are a hell of a lot more merchants that would all need to purchase entirely new credit card terminals, which is a much larger undertaking in this country than it would be elsewhere. [1] http://www.cl.cam.ac.uk/research/security/banking/nopin/oakland10chipbroken.pdf http://www.cl.cam.ac.uk/research/security/banking/nopin/oakl...

ZoFreX 14y ago
That's not trivial compared to magnetic stripe. I created a credit card reader with £2 of electronics, my laptop, and a freely available open-source program. (And I'm pretty dumb, so it's really easy)
- heywire 14y ago
  What about the most vulnerable part of credit cards, the fact that the card information is printed right on the front (and back) of the card? Someone in line at the grocery store with a pen camera in their pocket can catch a glimpse of the front and back of a card. That is generally enough information to use the card online.
  - stephengillie 14y ago
    http://dilbert.com/strips/comic/1996-01-11/ http://dilbert.com/strips/comic/1996-01-11/
  - mikeash 14y ago
    How will you use that card information, though? The printed information isn't sufficient to create a new magnetic stripe (the CVV1 code in the magstripe isn't printed on the card). Using the card info online requires knowing the cardholder's address. If you can find someone still using an imprinter, then that would work, but so would completely made-up data.
    - elithrar 14y ago
      > Using the card info online requires knowing the cardholder's address. US (and Canada, UK) issued cards are verified against the billing address (AVS), in most cases. In other countries (e.g. Australia), this is not the case. The card number and CVC are typically sufficient; you can put any other address you would like. My Amazon billing address is my work address, which is not the address my bank has (my home).
      - mikeash 14y ago
        Interesting. Any idea why they don't verify the billing address there? Seems like it would be no harder than doing it in the US.
isaacwaller 14y ago
The paper you have linked describes an attack that is only possible if the attacker has stolen the victim's physical card. I think the real security of EMV lies in the fact that cards cannot be cloned - this attack does not change that fact.
geal 14y ago
That attack is far from trivial. There were other attacks against EMV in the past, but they're fixed as they come. Magnetic stripes stay vulnerable, and ATMs in the US are not that secure either (seriously, some of them can be stolen and taken home by one man alone). Securing chips is hard, but a lot of the process has already been figured out. What you should fear is the new RFID cards coming up soon. Those are even more vulnerable than magnetic stripes.
ghshephard 14y ago
" In this paper we describe and demonstrate a protocol flaw which allows criminals to use a genuine card to make a payment without knowing the card’s PIN, and to remain undetected even when the merchant has an online connection to the banking network." I wasn't even aware that the chipped cards _had_ PINs. I think we can all agree that a chipped card + PIN is more secure than a magnetic strip card with no PIN. But, perhaps the reduction in fraud isn't worth the cost of replacing all the old gear.

mikeash 14y ago

I've had credit cards compromised before. Takes a few minutes to resolve. Really not a big deal. Debit fraud is worse, because the money and incentives are all arranged differently, but credit cards are pretty simple. Credit card fraud should not in any way be lumped in with identity theft, which is a vastly different act that's far more difficult to deal with. Credit card fraud is simply not worth worrying about as a consumer.

maxerickson 14y ago
They should both be called fraud (the part where the financial institution inflicts damage on a third party doesn't change the fact that the impersonator is defrauding the financial institution). I think it is important to make the distinction because calling it fraud directs attention at a party that can actually do something about the overall problem.
ghshephard 14y ago
I had a friend of mine whose house was broken into, they got his credit card, and it took him close to six months to walk back all the charges they made on his card. He was relentless, and his basic posture was, "Any charge on this card made after the date of the police report is fraudulent." He had to challenge each separate charge though - he couldn't just do them all in bulk. Needless to say - not a pleasant experience, and probably cost him 10s of hours.
- mikeash 14y ago
  That's odd, how did they manage to make so many purchases with the card? Did he not realize it had been taken for a while?
- brigade 14y ago
  Out of curiosity, who was the card vendor? When my number was stolen my CU directed me to an online form with which I could dispute all fraudulent charges in bulk, and they were reversed two days later.

nosecreek 14y ago

About a year ago someone did something similar to this (debit cards though, not credit) at the Wal-Mart in the small Canadian city I was living in. Just about everyone in town had their cards frozen and had to get new ones. I'm not sure how the attacker was capturing card information, but I do wonder if it doesn't have to do with the fact that our Chip & Pin cards also have a magnetic stripe.

cynwoody 14y ago

Yes, I know, you can always challenge a charge, IF you notice it sneak onto your card A friend of mine has a system for that, at least at gas stations. Whenever he fills up, he tops it off such that the price ends in a 7. Then he scans his American Express statement for any gas station charges not ending in 7. Over the years, he's done several successful charge-backs.