Comments on: Relay attack featured on Dutch TV http://www.lightbluetouchpaper.org/2009/12/17/relay-attack-featured-on-dutch-tv/ Security Research, Computer Laboratory, University of Cambridge Fri, 10 Feb 2012 17:31:40 +0000 http://wordpress.org/?v=2.9.2 hourly 1 By: Mike Bond http://www.lightbluetouchpaper.org/2009/12/17/relay-attack-featured-on-dutch-tv/comment-page-1/#comment-42247 Mike Bond Sat, 19 Dec 2009 22:55:59 +0000 http://www.lightbluetouchpaper.org/?p=1460#comment-42247 Well done chaps, looks like it was challenging to do all that working against the clock, and interesting to read this technical summary of the issues you encountered. It brings rather vividly to mind that when we were first considering relay attacks in 2006 that a chap from a POS vendor contacted us and told us we were talking nonsense and technically wrong... that the timing constraints were so tight that a relay attack that might sound good in theory just would be near impossible to pull off in practice without a really expensive custom radio link etc. At the time I just poo-pooed his private advice, and indeed a year or so later the demo was up and running and really did work. But maybe he knew something we didnt at the time... that some terminals were pretty sensitive to timing. His conclusion was still ultimately wrong, but this at least explains in my head why this chap so earnestly believed that it wouldnt work. Anyhow, thanks for posting the synopsis. Mike Well done chaps, looks like it was challenging to do all that working against the clock, and interesting to read this technical summary of the issues you encountered.

It brings rather vividly to mind that when we were first considering relay attacks in 2006 that a chap from a POS vendor contacted us and told us we were talking nonsense and technically wrong… that the timing constraints were so tight that a relay attack that might sound good in theory just would be near impossible to pull off in practice without a really expensive custom radio link etc.

At the time I just poo-pooed his private advice, and indeed a year or so later the demo was up and running and really did work. But maybe he knew something we didnt at the time… that some terminals were pretty sensitive to timing. His conclusion was still ultimately wrong, but this at least explains in my head why this chap so earnestly believed that it wouldnt work.

Anyhow, thanks for posting the synopsis.

Mike

]]>