TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

X-Ray Scans Expose Chip-And-Pin Card Hack

185 点作者 miralabs超过 9 年前

14 条评论

ajross超过 9 年前
FTA: <i>A fraudulent chip can listen for that query and pre-empt the real chip with its own answer: a “yes” signal regardless of whatever random PIN the fraudster has entered. “The attacker intercepts the PIN query and replies that it’s correct, whatever the code is,”</i><p>Wait, what? How is that the protocol? There&#x27;s no two way validation at all? The chip just says &quot;yes&quot;?!<p>Can anyone with knowledge of details confirm? This seems isomorphic to my ears with &quot;the PIN is just security theater&quot;.
评论 #10414928 未加载
评论 #10414924 未加载
评论 #10415025 未加载
评论 #10415365 未加载
评论 #10415112 未加载
评论 #10414980 未加载
评论 #10414953 未加载
评论 #10414934 未加载
评论 #10414873 未加载
评论 #10416571 未加载
JimmaDaRustla超过 9 年前
This is technically old news - as the article states, it has since been resolved. Edit: I guess they&#x27;re shedding new light on how they performed the hack.<p>Another thing, in context of USA, is that the authentication being done isn&#x27;t much of a vulnerability as this only applies to offline chip transactions. In the USA (I believe) and here in Canada, all transactions are online, which means the pin will be rejected by your financial institute&#x27;s back end systems in these scenarios.<p>These types of hacks have since been corrected using what is called CDA (Combined Data Authentication). Blurb on SDA&#x2F;DDA&#x2F;CDA here: <a href="http:&#x2F;&#x2F;www.cryptomathic.com&#x2F;hubfs&#x2F;docs&#x2F;cryptomathic_white_paper-emv_key_management.pdf" rel="nofollow">http:&#x2F;&#x2F;www.cryptomathic.com&#x2F;hubfs&#x2F;docs&#x2F;cryptomathic_white_pa...</a><p>Edit: Many Canadian financial institutes still use the weakest data authentication (SDA) because all transactions go online - spoofing a card PIN verification response doesn&#x27;t fool the back-end system. Visa and Mastercard both have mandates to have newly issued cards be provisioned on chips with CDA (I believe, could be DDA which would still be susceptible to this attack).<p>Edit 2: When I say &quot;offline&quot;, I mean at a point of sale machine - the POS does not reach out to the payment network to perform an &quot;online&quot; transaction where the PIN and card are validated by the back-end systems.<p>Edit 3: The article doesn&#x27;t give EMVCo any credit for actually solving the issue before any real world hack was known to exist.
评论 #10416156 未加载
评论 #10415068 未加载
评论 #10415058 未加载
kbenson超过 9 年前
That&#x27;s amazing. They were able to MITM the chip-and-pin chip by taking it out and attaching it to another hobbyist chip that&#x27;s capable of spoofing the response, and the whole thing when put back in the card was only a slight bulge bigger than the original.<p>They say nearly 600k Euros were charged, but given the sophistication of the attack, I wouldn&#x27;t be surprised if we hear later that it was in use at different locations as well, and we just aren&#x27;t hearing about it because they haven&#x27;t caught those people yet. They only caught these ones because they kept going back to the same locations.
评论 #10414794 未加载
评论 #10414774 未加载
评论 #10415090 未加载
Sleaker超过 9 年前
I&#x27;m dealing with development on some of this right now for US based POS customers and so far everything I&#x27;ve been told is that the US isn&#x27;t even going to attempt to utilize the PIN entry capabilities, so we&#x27;re still using signature validation in case of fraud. I&#x27;m not sure how this is any better than MSRs. The whole spoofing PIN validation thing doesn&#x27;t even come into play because it&#x27;s not even going to be checked.
评论 #10414866 未加载
评论 #10415054 未加载
评论 #10415051 未加载
评论 #10414926 未加载
评论 #10415763 未加载
893helios超过 9 年前
What&#x27;s this (Chip and Pin) being crap already disclosed here? <a href="https:&#x2F;&#x2F;media.blackhat.com&#x2F;bh-us-11&#x2F;Laurie&#x2F;BH_US_11_Laurie_Chip_Pin-Slides.pdf" rel="nofollow">https:&#x2F;&#x2F;media.blackhat.com&#x2F;bh-us-11&#x2F;Laurie&#x2F;BH_US_11_Laurie_C...</a>
klagermkii超过 9 年前
Watched this a couple of days ago and found it quite interesting talking about C&amp;P flaws <a href="https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=Ks0SOn8hjG8" rel="nofollow">https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=Ks0SOn8hjG8</a>
评论 #10414995 未加载
akavel超过 9 年前
Noteworthy: <i>For the Cambridge researchers, the French attack is an “I-told-you-so” moment. Five years ago, EMVCo and the UK Cards Association both dismissed their attack as improbable or impossible.</i>
bmsleight_超过 9 年前
Found some details of the cards<p><a href="http:&#x2F;&#x2F;www.infinityusb.com&#x2F;default.asp?show=store&amp;ProductGrp=8" rel="nofollow">http:&#x2F;&#x2F;www.infinityusb.com&#x2F;default.asp?show=store&amp;ProductGrp...</a>
评论 #10415106 未加载
nathanb超过 9 年前
Let&#x27;s not lose sight of one thing -- this doesn&#x27;t make chip-and-pin <i>less</i> secure than swipe-and-sign, it just makes it <i>no more</i> secure, in the worst case.
评论 #10415662 未加载
derekp7超过 9 年前
I was under the impression that the card created a cryptographic signature on the transaction, and the card had to receive the correct pin before it would sign it. Which is why you have to leave the card in the reader until the total is completed. Is this really not the case? Or does the card still cryptographically sign the transaction, but doesn&#x27;t process the PIN first (other than answering valid&#x2F;invalid)?
coleca超过 9 年前
&gt; &quot;They also note that other protections have been added to the system at the network level, which they decline to detail for fear of tipping off criminals.&quot;<p>Security by obscurity. That&#x27;s always a good plan. I&#x27;m sure that folks who went through all this trouble to design this hack wouldn&#x27;t ever be able to find that information. &lt;&#x2F;sarcasm&gt;
jgalt212超过 9 年前
pretty lame if the card can just say &quot;yes&quot; no matter what PIN is entered.<p>Away from being a proprietary tech, I&#x27;m not sure why fingerprinting the magnetic stripe never took off. It seems so much simpler, and if you cannot rearrange iron at the molecular level impossible to replicate.<p><a href="http:&#x2F;&#x2F;www.magtek.com&#x2F;V2&#x2F;media&#x2F;whitePapers&#x2F;2012&#x2F;MagTek-WP-An-Introduction-to-Dynamic-Authentication-To-Launch.pdf" rel="nofollow">http:&#x2F;&#x2F;www.magtek.com&#x2F;V2&#x2F;media&#x2F;whitePapers&#x2F;2012&#x2F;MagTek-WP-An...</a>
评论 #10417159 未加载
ck2超过 9 年前
So those millions spent replacing everyone&#x27;s card and all the vendors merchant machines was a waste.<p>Besides you can just use the chipped card online without the chip or pin?
ljk超过 9 年前
So is the safest way just to use cash?