3 ms·

Well in defence of Chip and PIN (and I can't believe I'm saying this), the exploits listed above take advantage of "No Signature" provided. This is where the ca

by bravo22 12y ago

Well in defence of Chip and PIN (and I can't believe I'm saying this), the exploits listed above take advantage of "No Signature" provided. This is where the card just gives the basic CC information -- same as what is on the front. The bank can see this and banks only allow small transactions to go through with no signature. In the demo they buy coffee, etc. with it. You couldn't buy something more expensive with it because the bank would deny the charge. NFC is similar. You can use it for small transactions, but not larger ones.

abritishguy 12y ago
That certainly isn't true of the Cambridge one.
- bravo22 12y ago
  From their paper: "We have observed variations between countries. While cards from Belgium and Estonia work like British cards, we have tested cards from Switzerland and Germany whose CVM lists specify either chip and signature or online PIN, at least while used abroad. The attack described here is not applicable to them. However, because UK point-of-sale terminals do not support online PIN, a stolen card of such a type could easily be used in the UK, by forging the cardholder’s signature." Their attack uses offline PIN mode. This is further expanded upon in section III. The simplified attack is such: Basically the PIN signed block doesn't get sent to the bank. Verification is only between the terminal and the card, and the card (or rather MITM hardware) returns a "all is well, transaction approved" message when in fact no such thing happened. The terminal doesn't go online and talk to the bank and verify the signed PIN block. This is essentially misconfiguration of the merchant terminal that ignores the result of the PIN verification. This is similar to when you tap a card to buy something. If the merchant system doesn't go online to verify it -- which it often doesn't for small transactions (<$10) then you can game the system.

by bravo22 12y ago

abritishguy 12y ago

That certainly isn't true of the Cambridge one.

bravo22 12y ago
From their paper: "We have observed variations between countries. While cards from Belgium and Estonia work like British cards, we have tested cards from Switzerland and Germany whose CVM lists specify either chip and signature or online PIN, at least while used abroad. The attack described here is not applicable to them. However, because UK point-of-sale terminals do not support online PIN, a stolen card of such a type could easily be used in the UK, by forging the cardholder’s signature." Their attack uses offline PIN mode. This is further expanded upon in section III. The simplified attack is such: Basically the PIN signed block doesn't get sent to the bank. Verification is only between the terminal and the card, and the card (or rather MITM hardware) returns a "all is well, transaction approved" message when in fact no such thing happened. The terminal doesn't go online and talk to the bank and verify the signed PIN block. This is essentially misconfiguration of the merchant terminal that ignores the result of the PIN verification. This is similar to when you tap a card to buy something. If the merchant system doesn't go online to verify it -- which it often doesn't for small transactions (<$10) then you can game the system.