Noted security researcher Ross Anderson and colleagues have published a paper showing how "Chip-and-PIN" (the European system for verifying credit- and debit-card transactions) has been thoroughly broken and cannot be considered secure any longer. I remember hearing rumbles that this attack was possible even as Chip-and-PIN was being rolled out across Europe, but that didn't stop the banks from pushing ahead with it, spending a fortune in the process.
The flaw is that when you put a card into a terminal, a negotiation takes place about how the cardholder should be authenticated: using a PIN, using a signature or not at all. This particular subprotocol is not authenticated, so you can trick the card into thinking it's doing a chip-and-signature transaction while the terminal thinks it's chip-and-PIN. The upshot is that you can buy stuff using a stolen card and a PIN of 0000 (or anything you want). We did so, on camera, using various journalists' cards. The transactions went through fine and the receipts say "Verified by PIN".
Chip and PIN is broken
It's no surprise to us or bankers that this attack works offline (when the merchant cannot contact the bank) -- in fact Steven blogged about it here last August.
But the real shocker is that it works online too: even when the bank authorisation system has all the transaction data sent back to it for verification. The reason why it works can be quite subtle and convoluted: bank authorisation systems are complex beasts, including cryptographic checks, account checks, database checks, and interfaces with fraud detection systems which might apply a points-scoring system to the output of all the above. In theory all the data you need to spot the wedge attack will be present, but in practice? And most of all, how can you spot it if you're not even looking? The banks didn't even realise they needed to check.
(Image: Smartcard3.png, Wikimedia Commons)
Fascinating, now gimme a double latte. (AsapSCIENCE)
Since its publication in late 2015, science writer Oliver Morton’s The Planet Remade: How Geoengineering Could Change the World has swept many “best book” (best science book, best business book, best nonfiction book) and with good reason: though it weighs in at a hefty 440 pages and covers a broad scientific, political and technological territory, few science books are more important, timely and beautifully written.
After years of speculation and wrangling over his remains, Kennewick Man turns out to be closely related to contemporary, local Native Americans after all. Discovered near Kennewick, Wash., in 1996, the skeleton ended up in a tug of war between tribes in the pacific northwest who wanted to bury the remains, and scientists who wanted […]
White hat hackers get paid to find holes in their own employers’ online systems, and plug those holes before they become serious security risks. It’s a job that pays handsomely…mostly because few job candidates, even experienced IT professionals, have the skills to scamper over firewalls and infiltrate the deepest recesses of a battle-tested network. But […]
Why buy one of those expensive and confusing universal remotes, clogged with enough buttons to launch a space shuttle, when you could accomplish the same electronic control right on your favorite mobile device? The Blumoo Universal Remote, now just $52.99 in the Boing Boing Store, harnesses the audio power of all your household equipment right […]
You may not love Microsoft Word, but you’ve definitely used it. Other than being one of the most ubiquitous programs on the planet, it’s been the go-to word processing system for more than a quarter-century because it’s as basic as it gets. But occasionally, you’ve got assignments that beg for a lot more options than simple […]