25C3 - 1.4.2.3
25th Chaos Communication Congress
Nothing to hide
| Speakers | |
|---|---|
|
Steven J. Murdoch |
| Schedule | |
|---|---|
| Day | Day 1 (2008-12-27) |
| Room | Saal 3 |
| Start time | 14:00 |
| Duration | 01:00 |
| Info | |
| ID | 2953 |
| Event type | lecture |
| Track | Hacking |
| Language used for presentation | en |
| Feedback | |
|---|---|
|
Did you attend this event? Give Feedback |
Security Failures in Smart Card Payment Systems
Tampering the Tamper-Proof
PIN entry devices (PED) are used in the Chip & PIN (EMV) system to process customers' card details and PINs in stores world-wide. Because of the highly sensitive information they handle, PEDs are subject to an extensive security evaluation procedure. We have demonstrated that the tamper protection of two popular PEDs can be easily circumvented with a paperclip, some basic technical skills, and off-the-shelf electronics.
PIN entry devices (PEDs) are critical security components in Chip & PIN (EMV) smartcard payment systems as they receive a customer's card and PIN. Their approval is subject to an extensive suite of evaluation and certification procedures. We have demonstrated that the tamper proofing of PEDs is unsatisfactory, as is the certification process.
This talk will discuss practical low-cost attacks on two certified, widely-deployed PEDs – the Ingenico i3300 and the Dione Xtreme. By tapping inadequately protected smartcard communications, an attacker with basic technical skills can expose card details and PINs, leaving cardholders open to fraud. The talk will describe the anti-tampering mechanisms of the two PEDs and show that, while the specific protection measures mostly work as intended, critical vulnerabilities arise because of the poor integration of cryptographic, physical and procedural protection.
These failures are important not only because they allow fraud to be committed, but also because of their affect on customer liability. As Chip & PIN was claimed to be foolproof, victims of fraud often find themselves accused of being negligent, or even complicit in the crime. The results of this work will help customers in this position argue that their losses should be refunded.