5 ms·

Chip and PIN

51 points by tombell93 12y ago

edwintorok 12y ago
It is worrying that there is a PIN try counter that can be reset so easily.
- achalkley 12y ago
  Great summary :)
- raverbashing 12y ago
  Yeah, I didn't read through the details The way this works in GSM SIM cards is the following: If an operation needs authentication you have to provide your PIN to the chip. This operation returns OK or not. There's no counter to be checked (IIRC) and it can't be reset. If you got the PIN right then operations will succeed (like listing SMSs, Phone book, or making a call) otherwise they'll return a "needs auth" error code GSM 11.11
- dfox 12y ago
  The article is hugely unclear about how the author actually managed to reset the pin counter. The command Cla=80 Ins=CA P1=9F P2=17 Lc=00 means GET DATA 9F17 (PIN try counter) and has nothing to do with overwriting whatever value is stored there (the command is defined in EMV Book 3 section 6.5.7). And also the discretionary data field on both magnetic stripe and track image data stored on chip is usually not used as "PIN Verification Value", but is either unused or used as CVC/CVV1. Even when these data were the real PVV, this information is mostly useless for deducing the PIN. (and the fact that the magstripe image stored on chip does not match the real magstripe is mostly to be expected)
- AlyssaRowan 12y ago
  I wish I could say something, but I'm still under embargo, 11 years later (the last time I agreed an embargo without an expiry, lesson learned!). Don't let someone get your card, and if you think they do, report it to your bank. At least since 2009 you won't be liable for any fraud.
Sanddancer 12y ago
The lack of security surrounding Chip and PIN doesn't surprise me. A friend of mine is dyslexic, and one of the symptoms is that she has a real hard time remembering arbitrary sequences of numbers, like PINs tend to be. As such, she's one of the few people on chip and sign, and has no PIN attached to her card. Even with that, she /still/ has to deal with fraud departments every few years saying that someone used her card and "PIN" in some obscure location, and this is obviously all her fault. It takes quite a bit of frustration for her before the fraud department finally comprehends that there is no pin to clone there. Of course, me being stateside, I still have to deal with antiquated magstrips and /their/ various faults. I've got cards with chips in them, but no one is taking them yet, and the bank I'm with (Wells Fargo) isn't even planning on rolling out chips on their debit card line until the end of the year, and even then, by request only. The whole financial security system is just ridiculous.
- JosephRedfern 12y ago
  Out of interest, how does Chip and Sign work at an ATM?
  - selectodude 12y ago
    For now, banks are only doing chip+sig on credit cards. I imagine chip+pin on debit cards for ATMs is a 2016 issue.
  - sliverstorm 12y ago
    I don't know for sure, but debit cards already follow the chip&pin model, except it's magstripe&pin. So I would imagine it would read the chip, and you would enter your ATM pin.
- pyre 12y ago
  On the other hand, with Chip & PIN, if someone uses the Chip and PIN they will claim that they don't have to protect you from fraud. I recall reading a few years ago about auto insurance companies denying claims on stolen cars because it was "impossible" for the car to be stolen due to the new key tech at the time. They were ignoring that the dealerships help the master keys, and car thieves would just attack that as the weak point (i.e. get an insider to cut the keys, and give you the address for the owner). The real reason that the insurers were denying claims is that they want to just push all of the risk onto the consumer, while still taking their money to 'insure' them.
blahpro 12y ago
Interesting article, but would greatly benefit from a "TL;DR" summary at the top.
gergles 12y ago
> This is the cardholder’s name and all of the track one and track two data7. These records provide all that’s needed to clone an EMV smart card. See appendix section 0 for complete records. It provides all that you need to create a magstripe card from the PAN stored in the Chip. That is ALL you can do. You can't clone the card and can't get cryptograms. Any sane issuer will decline transactions made with the magstripe at a chip-capable terminal, so this doesn't help much. In any event, a lot of the information you need to clone the magstripe is... on the magstripe. The rest of the attacks are on the offline functionality of the card which won't be used in almost any US implementations and is being phased out of most of the other places where it is in use.
- emptybits 12y ago
  You're right, obviously, about having everything needed to clone a magstripe on the magstripe itself. > Any sane issuer will decline transactions made with the magstripe at a chip-capable terminal, so this doesn't help much. Regarding this... Where I live and use Chip-and-PIN cards every day (Canada), it's extremely common for a chip-capable terminal to fail on a chip card for a variety of reasons and immediately instruct the cardholder and/or merchant to "please swipe card". Customer swipes and places a signature-resembling mark on paper. Merchant and issuer accept this. And so it goes. Anecdotal data: We've had Chip-and-PIN for years here. Currently, despite my Amex being Chip-and-PIN, more than 50% of terminals fail with the chip ("it's an Amex thing," we're told, years into this) and revert to swiping, and my Visa Chip-and-Pin still fails as a chip card and falls back to a swipe transaction approximately 10% of the time. So the easy fraud vector is still there with magstripes even in a mature Chip-and-PIN environment.
  - derefr 12y ago
    Actually, those "failures" are (here in Canada) caused by merchants who have upgraded their hardware to chip-and-pin, but haven't actually switched chip-and-pin processing on for their POS merchant account. Or, more commonly, they're with a POS provider that bought, and then rolled out, chip-and-pin terminals as part of its standard four-year-replacement cycle, but who don't even support chip-and-pin yet. Either way, usually the merchant knows ahead of time that their terminal won't accept your (or anyone's) chip, and could put up a sign to that effect.
gghh 12y ago
related to EMV security, Andrea Barisani gave a talk at 31C3 last December: "Practical EMV PIN interception and fraud detection" http://media.ccc.de/browse/congress/2014/31c3_-_6120_-_en_-_saal_1_-_201412271600_-_practical_emv_pin_interception_and_fraud_detection_-_andrea_barisani.html#video http://media.ccc.de/browse/congress/2014/31c3_-_6120_-_en_-_...
joshstrange 12y ago
IMHO Chip and Pin is a huge fucking joke. There have been multiple posts showing how to get around it or otherwise compromise these cards. That coupled with banks trying to move all liability to the user makes me sick. All of this coming at a time that I swipe my card (physically) way less than ever before. Chip and Pin seems to mean nothing for online purchases AFAICT, feels a lot like failing to solve a problem that is slowly going away and ignoring online purchases.....
- timthorn 12y ago
  At least in the UK, the banks moved liability to the merchants, not the cardholder.
  - organsnyder 12y ago
    Correct. In addition, in the US merchants are only liable if they haven't upgraded to chip-and-pin—i.e. the banks are making sure that retailers have an incentive to upgrade aging hardware.
- laurencerowe 12y ago
  There is plenty of scope for moving cash purchases to card in the US. When I lived in Norway it was normal for even small purchases to be made with Chip and Pin. Many people hardly used cash at all.
  - joshstrange 12y ago
    I already use my card for everything, I haven't used cash in quite some time (Even use Venmo to share paying for pizza and the like). I guess I'm vastly underestimating the amount of cash still being used. Because of that my original statement may be flawed
umsm 12y ago
> having the ability to verify a PIN and the ability to reset the ‘tries’ counter, one can trivially check every possible PIN automatically until the correct PIN is found. This is the key part for me. Being able to brute-force a pin is a huge vulnerability.
rogier_hofboer 12y ago
First beware this is already an old blog article from the 10th of August 2013. To me, the article seems (at least) incorrect at two points: 1. The number of PIN retries cannot be reset. The command described to perform this reset in the blog post is the same as for checking the tries. Checking the tries just doesn't reset the number of tries, only providing the correct PIN does. But please prove me wrong by supplying the correct command to reset the PIN tries... The original paper about this http://fc13.ifca.ai/proc/9-2.pdf http://fc13.ifca.ai/proc/9-2.pdf describes a way to have 2 'free' guesses, but after those 2 guesses, you'll need to try again with a correct PIN. On a hacked reader, you could eventually find out someones PIN if the person uses the reader enough. Once the retries are exhausted, the card is blocked. Beware you'll need up-to 10.000 guesses, so up-to 5000 usages of the card. (note it is actually a little bit less, because not all PIN codes are allowed on production cards) 2. With EMV cards issued the last few years, the Track2 equivalent data on the EMV chip does not contain correct, usable data to create a magstripe card from. The Pin Verification Value in the EMV Track2 Equivalent data record is set to all zeros instead of the original PVV on the magstripe, rendering it pretty useless. So in short, you cannot create a working magstripe card with PIN by using data from the EMV chip.
- lucaspiller 12y ago
  In the UK if you have blocked the PIN on the chip, you can unblock it at an ATM (usually only one belonging to your bank) if you know the correct PIN. ATMs will of course swallow the card after three failures, but the logic is there to reset the chip. I don't know if this is a different process from that the article describes mind.
  - rogier_hofboer 12y ago
    OK, via EMV commands it is not possible, but ATM's can run special (encrypted, signed and non-replayable) security scripts on the card to do card management. To be able to do this, you'll need keys only available to the card issuer. That is also the reason it only works at your own bank.
deadgrey19 12y ago
"Chip and PIN is broken" is old news: http://www.cl.cam.ac.uk/research/security/banking/nopin/oakland10chipbroken.pdf http://www.cl.cam.ac.uk/research/security/banking/nopin/oakl... Here's a video of them applying the exploit: https://www.youtube.com/watch?v=JPAX32lgkrw https://www.youtube.com/watch?v=JPAX32lgkrw

Chip and PIN

51 points by tombell93 12y ago

edwintorok 12y ago

It is worrying that there is a PIN try counter that can be reset so easily.

achalkley 12y ago
Great summary :)
raverbashing 12y ago
Yeah, I didn't read through the details The way this works in GSM SIM cards is the following: If an operation needs authentication you have to provide your PIN to the chip. This operation returns OK or not. There's no counter to be checked (IIRC) and it can't be reset. If you got the PIN right then operations will succeed (like listing SMSs, Phone book, or making a call) otherwise they'll return a "needs auth" error code GSM 11.11
dfox 12y ago
The article is hugely unclear about how the author actually managed to reset the pin counter. The command Cla=80 Ins=CA P1=9F P2=17 Lc=00 means GET DATA 9F17 (PIN try counter) and has nothing to do with overwriting whatever value is stored there (the command is defined in EMV Book 3 section 6.5.7). And also the discretionary data field on both magnetic stripe and track image data stored on chip is usually not used as "PIN Verification Value", but is either unused or used as CVC/CVV1. Even when these data were the real PVV, this information is mostly useless for deducing the PIN. (and the fact that the magstripe image stored on chip does not match the real magstripe is mostly to be expected)
AlyssaRowan 12y ago
I wish I could say something, but I'm still under embargo, 11 years later (the last time I agreed an embargo without an expiry, lesson learned!). Don't let someone get your card, and if you think they do, report it to your bank. At least since 2009 you won't be liable for any fraud.

Sanddancer 12y ago

The lack of security surrounding Chip and PIN doesn't surprise me. A friend of mine is dyslexic, and one of the symptoms is that she has a real hard time remembering arbitrary sequences of numbers, like PINs tend to be. As such, she's one of the few people on chip and sign, and has no PIN attached to her card. Even with that, she /still/ has to deal with fraud departments every few years saying that someone used her card and "PIN" in some obscure location, and this is obviously all her fault. It takes quite a bit of frustration for her before the fraud department finally comprehends that there is no pin to clone there. Of course, me being stateside, I still have to deal with antiquated magstrips and /their/ various faults. I've got cards with chips in them, but no one is taking them yet, and the bank I'm with (Wells Fargo) isn't even planning on rolling out chips on their debit card line until the end of the year, and even then, by request only. The whole financial security system is just ridiculous.

JosephRedfern 12y ago
Out of interest, how does Chip and Sign work at an ATM?
- selectodude 12y ago
  For now, banks are only doing chip+sig on credit cards. I imagine chip+pin on debit cards for ATMs is a 2016 issue.
- sliverstorm 12y ago
  I don't know for sure, but debit cards already follow the chip&pin model, except it's magstripe&pin. So I would imagine it would read the chip, and you would enter your ATM pin.
pyre 12y ago
On the other hand, with Chip & PIN, if someone uses the Chip and PIN they will claim that they don't have to protect you from fraud. I recall reading a few years ago about auto insurance companies denying claims on stolen cars because it was "impossible" for the car to be stolen due to the new key tech at the time. They were ignoring that the dealerships help the master keys, and car thieves would just attack that as the weak point (i.e. get an insider to cut the keys, and give you the address for the owner). The real reason that the insurers were denying claims is that they want to just push all of the risk onto the consumer, while still taking their money to 'insure' them.

blahpro 12y ago

Interesting article, but would greatly benefit from a "TL;DR" summary at the top.

gergles 12y ago

> This is the cardholder’s name and all of the track one and track two data7. These records provide all that’s needed to clone an EMV smart card. See appendix section 0 for complete records. It provides all that you need to create a magstripe card from the PAN stored in the Chip. That is ALL you can do. You can't clone the card and can't get cryptograms. Any sane issuer will decline transactions made with the magstripe at a chip-capable terminal, so this doesn't help much. In any event, a lot of the information you need to clone the magstripe is... on the magstripe. The rest of the attacks are on the offline functionality of the card which won't be used in almost any US implementations and is being phased out of most of the other places where it is in use.

emptybits 12y ago
You're right, obviously, about having everything needed to clone a magstripe on the magstripe itself. > Any sane issuer will decline transactions made with the magstripe at a chip-capable terminal, so this doesn't help much. Regarding this... Where I live and use Chip-and-PIN cards every day (Canada), it's extremely common for a chip-capable terminal to fail on a chip card for a variety of reasons and immediately instruct the cardholder and/or merchant to "please swipe card". Customer swipes and places a signature-resembling mark on paper. Merchant and issuer accept this. And so it goes. Anecdotal data: We've had Chip-and-PIN for years here. Currently, despite my Amex being Chip-and-PIN, more than 50% of terminals fail with the chip ("it's an Amex thing," we're told, years into this) and revert to swiping, and my Visa Chip-and-Pin still fails as a chip card and falls back to a swipe transaction approximately 10% of the time. So the easy fraud vector is still there with magstripes even in a mature Chip-and-PIN environment.
- derefr 12y ago
  Actually, those "failures" are (here in Canada) caused by merchants who have upgraded their hardware to chip-and-pin, but haven't actually switched chip-and-pin processing on for their POS merchant account. Or, more commonly, they're with a POS provider that bought, and then rolled out, chip-and-pin terminals as part of its standard four-year-replacement cycle, but who don't even support chip-and-pin yet. Either way, usually the merchant knows ahead of time that their terminal won't accept your (or anyone's) chip, and could put up a sign to that effect.

gghh 12y ago

related to EMV security, Andrea Barisani gave a talk at 31C3 last December: "Practical EMV PIN interception and fraud detection" http://media.ccc.de/browse/congress/2014/31c3_-_6120_-_en_-_saal_1_-_201412271600_-_practical_emv_pin_interception_and_fraud_detection_-_andrea_barisani.html#video http://media.ccc.de/browse/congress/2014/31c3_-_6120_-_en_-_...

joshstrange 12y ago

IMHO Chip and Pin is a huge fucking joke. There have been multiple posts showing how to get around it or otherwise compromise these cards. That coupled with banks trying to move all liability to the user makes me sick. All of this coming at a time that I swipe my card (physically) way less than ever before. Chip and Pin seems to mean nothing for online purchases AFAICT, feels a lot like failing to solve a problem that is slowly going away and ignoring online purchases.....

timthorn 12y ago
At least in the UK, the banks moved liability to the merchants, not the cardholder.
- organsnyder 12y ago
  Correct. In addition, in the US merchants are only liable if they haven't upgraded to chip-and-pin—i.e. the banks are making sure that retailers have an incentive to upgrade aging hardware.
laurencerowe 12y ago
There is plenty of scope for moving cash purchases to card in the US. When I lived in Norway it was normal for even small purchases to be made with Chip and Pin. Many people hardly used cash at all.
- joshstrange 12y ago
  I already use my card for everything, I haven't used cash in quite some time (Even use Venmo to share paying for pizza and the like). I guess I'm vastly underestimating the amount of cash still being used. Because of that my original statement may be flawed

umsm 12y ago

> having the ability to verify a PIN and the ability to reset the ‘tries’ counter, one can trivially check every possible PIN automatically until the correct PIN is found. This is the key part for me. Being able to brute-force a pin is a huge vulnerability.

rogier_hofboer 12y ago

First beware this is already an old blog article from the 10th of August 2013. To me, the article seems (at least) incorrect at two points: 1. The number of PIN retries cannot be reset. The command described to perform this reset in the blog post is the same as for checking the tries. Checking the tries just doesn't reset the number of tries, only providing the correct PIN does. But please prove me wrong by supplying the correct command to reset the PIN tries... The original paper about this http://fc13.ifca.ai/proc/9-2.pdf http://fc13.ifca.ai/proc/9-2.pdf describes a way to have 2 'free' guesses, but after those 2 guesses, you'll need to try again with a correct PIN. On a hacked reader, you could eventually find out someones PIN if the person uses the reader enough. Once the retries are exhausted, the card is blocked. Beware you'll need up-to 10.000 guesses, so up-to 5000 usages of the card. (note it is actually a little bit less, because not all PIN codes are allowed on production cards) 2. With EMV cards issued the last few years, the Track2 equivalent data on the EMV chip does not contain correct, usable data to create a magstripe card from. The Pin Verification Value in the EMV Track2 Equivalent data record is set to all zeros instead of the original PVV on the magstripe, rendering it pretty useless. So in short, you cannot create a working magstripe card with PIN by using data from the EMV chip.

lucaspiller 12y ago
In the UK if you have blocked the PIN on the chip, you can unblock it at an ATM (usually only one belonging to your bank) if you know the correct PIN. ATMs will of course swallow the card after three failures, but the logic is there to reset the chip. I don't know if this is a different process from that the article describes mind.
- rogier_hofboer 12y ago
  OK, via EMV commands it is not possible, but ATM's can run special (encrypted, signed and non-replayable) security scripts on the card to do card management. To be able to do this, you'll need keys only available to the card issuer. That is also the reason it only works at your own bank.

deadgrey19 12y ago

"Chip and PIN is broken" is old news: http://www.cl.cam.ac.uk/research/security/banking/nopin/oakland10chipbroken.pdf http://www.cl.cam.ac.uk/research/security/banking/nopin/oakl... Here's a video of them applying the exploit: https://www.youtube.com/watch?v=JPAX32lgkrw https://www.youtube.com/watch?v=JPAX32lgkrw