Comments on: Chip & PIN relay attacks http://www.lightbluetouchpaper.org/2007/02/06/chip-pin-relay-attacks/ Security Research, Computer Laboratory, University of Cambridge Sun, 06 Jul 2008 12:16:15 +0000 http://wordpress.org/?v=2.5.1 By: James http://www.lightbluetouchpaper.org/2007/02/06/chip-pin-relay-attacks/#comment-19925 James Tue, 20 Mar 2007 14:10:22 +0000 http://www.lightbluetouchpaper.org/2007/02/06/chip-pin-relay-attacks/#comment-19925 I've been using my 'Thumbprint' in lieu of my signature with my Chip & Signature Cards for over a year now. I've used this method of cardholder verification at over 120 retailers thoroughout the country and once abroad. Retailers have welcomed this, saying it's safer than using a PIN. It is easier to visually check my print against that on the cards signature strip, than it would be a written signature. In a face to face scenario you can't forge, forget, loose or compromise your print. This method acts as a deterrent, while unlike a PIN if there ever was a disputed transaction on my account, not only could I prove it wasn't my print, but the offenders print can be given to the law enforcement agencies. The system can easily be adapted for deterring theft when purchasing goods via the Internet, mail order, fax or by phone. Together we can beat fraud, well we certainly can reduce it. I’ve been using my ‘Thumbprint’ in lieu of my signature with my Chip & Signature Cards for over a year now. I’ve used this method of cardholder verification at over 120 retailers thoroughout the country and once abroad. Retailers have welcomed this, saying it’s safer than using a PIN. It is easier to visually check my print against that on the cards signature strip, than it would be a written signature. In a face to face scenario you can’t forge, forget, loose or compromise your print. This method acts as a deterrent, while unlike a PIN if there ever was a disputed transaction on my account, not only could I prove it wasn’t my print, but the offenders print can be given to the law enforcement agencies.

The system can easily be adapted for deterring theft when purchasing goods via the Internet, mail order, fax or by phone.

Together we can beat fraud, well we certainly can reduce it.

]]> By: Maggie Brown http://www.lightbluetouchpaper.org/2007/02/06/chip-pin-relay-attacks/#comment-17401 Maggie Brown Sun, 04 Mar 2007 10:06:08 +0000 http://www.lightbluetouchpaper.org/2007/02/06/chip-pin-relay-attacks/#comment-17401 The Royal Bank of Scotland had a good system for all it's cards, including visa, for a few years. Your photo was on the back and this, as well as your signature, was excellent proof of your ownership. However, many shop staff did not seem aware of this at all and I found myself training them to check the back of the card for the photo as well as the signature. Sometimes they didn't even check the back of the card for the signature. If all banks had had the photo system then shop assistants would have remembered to check. My concern now is the extra 3 digits on the back of the card. Why are these of any use? If a criminal has the card then they will have the three digits as well! Chip and pin is the worst system for so-called security I have ever come across. Who invented it? Margaret The Royal Bank of Scotland had a good system for all it’s cards, including visa, for a few years. Your photo was on the back and this, as well as your signature, was excellent proof of your ownership. However, many shop staff did not seem aware of this at all and I found myself training them to check the back of the card for the photo as well as the signature. Sometimes they didn’t even check the back of the card for the signature. If all banks had had the photo system then shop assistants would have remembered to check.

My concern now is the extra 3 digits on the back of the card. Why are these of any use? If a criminal has the card then they will have the three digits as well!

Chip and pin is the worst system for so-called security I have ever come across. Who invented it? Margaret

]]> By: Cards are OK, but is Chip & PIN OK ? at On the road to Bandol http://www.lightbluetouchpaper.org/2007/02/06/chip-pin-relay-attacks/#comment-15366 Cards are OK, but is Chip & PIN OK ? at On the road to Bandol Sun, 11 Feb 2007 21:04:55 +0000 http://www.lightbluetouchpaper.org/2007/02/06/chip-pin-relay-attacks/#comment-15366 [...] good, and getting a PIN out of a banking smart card remains a very difficult task. Nevertheless, the latest paper of Cambridge’s research lab describes a nice attack on Chip & PIN. Their attack does [...] [...] good, and getting a PIN out of a banking smart card remains a very difficult task. Nevertheless, the latest paper of Cambridge’s research lab describes a nice attack on Chip & PIN. Their attack does [...]

]]> By: Light Blue Touchpaper » Financial Ombudsman on Chip & PIN infallibility http://www.lightbluetouchpaper.org/2007/02/06/chip-pin-relay-attacks/#comment-15140 Light Blue Touchpaper » Financial Ombudsman on Chip & PIN infallibility Thu, 08 Feb 2007 18:26:00 +0000 http://www.lightbluetouchpaper.org/2007/02/06/chip-pin-relay-attacks/#comment-15140 [...] the scenarios mentioned above, our demonstration for Watchdog showed how, even without cloning a card, a Chip & PIN terminal could be fooled into accepting a [...] [...] the scenarios mentioned above, our demonstration for Watchdog showed how, even without cloning a card, a Chip & PIN terminal could be fooled into accepting a [...]

]]> By: Tom Coyle http://www.lightbluetouchpaper.org/2007/02/06/chip-pin-relay-attacks/#comment-14896 Tom Coyle Tue, 06 Feb 2007 23:37:10 +0000 http://www.lightbluetouchpaper.org/2007/02/06/chip-pin-relay-attacks/#comment-14896 Guys, you do excellent work and the piece for Watchdog was a great public service. I have visited your site many times since retiring (early) from a bank. I'm sure you can check my visits from this comment. I might be grey and balding but I've stayed current. 12 years with a PC and 9 of those with an online connection have made me aware of the nasties "computers" bring with them. Sadly, Government and commerce only see what they want to and need to. The world is changing. Banking is changing. Challenging business values is not a popular concept in sales cultures. My closing 18 months or so involved me in more contact with electronic fraud and identity theft than the entire preceeding 32 years. Your knowledge, expertise and integrity is to be highly commended. Guys, you do excellent work and the piece for Watchdog was a great public service.

I have visited your site many times since retiring (early) from a bank. I’m sure you can check my visits from this comment. I might be grey and balding but I’ve stayed current. 12 years with a PC and 9 of those with an online connection have made me aware of the nasties “computers” bring with them. Sadly, Government and commerce only see what they want to and need to.

The world is changing. Banking is changing.

Challenging business values is not a popular concept in sales cultures. My closing 18 months or so involved me in more contact with electronic fraud and identity theft than the entire preceeding 32 years.

Your knowledge, expertise and integrity is to be highly commended.

]]> By: Steven J. Murdoch http://www.lightbluetouchpaper.org/2007/02/06/chip-pin-relay-attacks/#comment-14886 Steven J. Murdoch Tue, 06 Feb 2007 21:34:23 +0000 http://www.lightbluetouchpaper.org/2007/02/06/chip-pin-relay-attacks/#comment-14886 @Rich <blockquote>How does the challenge/response get from the hacked card to Carol’s laptop?</blockquote> We used a wire (see the photo), but it would be plausible for an attacker to create a wireless version. As we only wanted a proof of concept, doing it wired was adequate. Still, in the run up to the programme, we tried holding onto our card during normal transactions, as if there was a wire, and nobody was bothered. @Rich

How does the challenge/response get from the hacked card to Carol’s laptop?

We used a wire (see the photo), but it would be plausible for an attacker to create a wireless version. As we only wanted a proof of concept, doing it wired was adequate. Still, in the run up to the programme, we tried holding onto our card during normal transactions, as if there was a wire, and nobody was bothered.

]]> By: Steven J. Murdoch http://www.lightbluetouchpaper.org/2007/02/06/chip-pin-relay-attacks/#comment-14885 Steven J. Murdoch Tue, 06 Feb 2007 21:28:56 +0000 http://www.lightbluetouchpaper.org/2007/02/06/chip-pin-relay-attacks/#comment-14885 @Surreptitious Evil <blockquote>How many takes? </blockquote> We were on location for about 7 hours on Friday, but they didn't get all the shots they needed so came back on Monday for about 5 hours. The problem was that they only had one camera, so on Friday, they had the real terminal on the same table as the fake one. This meant they could film it all in one shot, but after talking to their editorial policy folks, they realised they weren't able to show the restaurant scenario. So on Monday they came back, but by that time Saar had left for Germany so I had to rope <a href="http://www.cl.cam.ac.uk/~rnw24/" rel="nofollow">Robert</a> into letting me borrow his laptop and help me set everything up. This was especially problematic since Saar built pretty much all of the hardware, and I didn't have much experience in using it. However, we successfully performed the relay attack, through two shops, so they could use the footage of the restaurant. <blockquote>How many of those were due to the tech and how many to the luvvies?</blockquote> Actually our kit successfully performed the transaction first time, on both occasions, which is a credit to Saar's engineering. It took a bit of tweaking for it to pass the self test, but once it did, the real transaction went through smoothly. What took most of the time was the working through the explanation of what happened, as each shot had to be done several different times, for each of several different camera angles. The street outside the shop is pretty busy, so it was also hard to find a time when there were no people doing anything too silly in the shot (the crew took a while to get rid of a drunk who was fascinated with the proceedings). @Surreptitious Evil

How many takes?

We were on location for about 7 hours on Friday, but they didn’t get all the shots they needed so came back on Monday for about 5 hours. The problem was that they only had one camera, so on Friday, they had the real terminal on the same table as the fake one. This meant they could film it all in one shot, but after talking to their editorial policy folks, they realised they weren’t able to show the restaurant scenario.

So on Monday they came back, but by that time Saar had left for Germany so I had to rope Robert into letting me borrow his laptop and help me set everything up. This was especially problematic since Saar built pretty much all of the hardware, and I didn’t have much experience in using it. However, we successfully performed the relay attack, through two shops, so they could use the footage of the restaurant.

How many of those were due to the tech and how many to the luvvies?

Actually our kit successfully performed the transaction first time, on both occasions, which is a credit to Saar’s engineering. It took a bit of tweaking for it to pass the self test, but once it did, the real transaction went through smoothly.

What took most of the time was the working through the explanation of what happened, as each shot had to be done several different times, for each of several different camera angles. The street outside the shop is pretty busy, so it was also hard to find a time when there were no people doing anything too silly in the shot (the crew took a while to get rid of a drunk who was fascinated with the proceedings).

]]> By: Rich http://www.lightbluetouchpaper.org/2007/02/06/chip-pin-relay-attacks/#comment-14878 Rich Tue, 06 Feb 2007 20:50:32 +0000 http://www.lightbluetouchpaper.org/2007/02/06/chip-pin-relay-attacks/#comment-14878 How does the challenge/response get from the hacked card to Carol's laptop? Are wireless & programmable smart cards readily available, or is there a wire up her sleeve (a bit obvious I would have thought?) How does the challenge/response get from the hacked card to Carol’s laptop? Are wireless & programmable smart cards readily available, or is there a wire up her sleeve (a bit obvious I would have thought?)

]]> By: Surreptitious Evil http://www.lightbluetouchpaper.org/2007/02/06/chip-pin-relay-attacks/#comment-14873 Surreptitious Evil Tue, 06 Feb 2007 20:23:32 +0000 http://www.lightbluetouchpaper.org/2007/02/06/chip-pin-relay-attacks/#comment-14873 Guys, Great and you don't seem to be nearly ugly enough to keep in infosec as a profession (ask Richard :). Just two questions, which I will understand if you don't or can't answer ... 1. How many takes? 2. How many of those were due to the tech and how many to the luvvies? S-E Guys,

Great and you don’t seem to be nearly ugly enough to keep in infosec as a profession (ask Richard :).

Just two questions, which I will understand if you don’t or can’t answer …

1. How many takes?

2. How many of those were due to the tech and how many to the luvvies?

S-E

]]> By: Mike Whittaker http://www.lightbluetouchpaper.org/2007/02/06/chip-pin-relay-attacks/#comment-14870 Mike Whittaker Tue, 06 Feb 2007 19:06:45 +0000 http://www.lightbluetouchpaper.org/2007/02/06/chip-pin-relay-attacks/#comment-14870 I have long complained that the 'swipe' C&P tills as used Marks&Spencer and Tesco among others, present a security risk, in that the customer's card is swiped on one terminal next to the screen (and hence the magstripe can be read) while the actual PIN is entered on the small numeric terminal. This then potentially allows the shop to have read the card magstripe (cloneable and useable in an ATM) and the PIN from the keypad. The Chip and PIN initiative should have emphasised that the card reader and PIN entry *must be on the same physical device* . These composite tills undermine customer safeguards. When are bank ATMs going to go all-chipcard ?! I have long complained that the ’swipe’ C&P tills as used Marks&Spencer and Tesco among others, present a security risk, in that the customer’s card is swiped on one terminal next to the screen (and hence the magstripe can be read) while the actual PIN is entered on the small numeric terminal.

This then potentially allows the shop to have read the card magstripe (cloneable and useable in an ATM) and the PIN from the keypad.

The Chip and PIN initiative should have emphasised that the card reader and PIN entry *must be on the same physical device* . These composite tills undermine customer safeguards.

When are bank ATMs going to go all-chipcard ?!

]]>