Man-in-the-Middle Attack Against Chip and PIN

Nice attack against the EMV—Eurocard Mastercard Visa—the “chip and PIN” credit card payment system. The attack allows a criminal to use a stolen card without knowing the PIN.

The flaw is that when you put a card into a terminal, a negotiation takes place about how the cardholder should be authenticated: using a PIN, using a signature or not at all. This particular subprotocol is not authenticated, so you can trick the card into thinking it’s doing a chip-and-signature transaction while the terminal thinks it’s chip-and-PIN. The upshot is that you can buy stuff using a stolen card and a PIN of 0000 (or anything you want). We did so, on camera, using various journalists’ cards. The transactions went through fine and the receipts say “Verified by PIN”.

[…]

So what went wrong? In essence, there is a gaping hole in the specifications which together create the “Chip and PIN” system. These specs consist of the EMV protocol framework, the card scheme individual rules (Visa, MasterCard standards), the national payment association rules (UK Payments Association aka APACS, in the UK), and documents produced by each individual issuer describing their own customisations of the scheme. Each spec defines security criteria, tweaks options and sets rules—but none take responsibility for listing what back-end checks are needed. As a result, hundreds of issuers independently get it wrong, and gain false assurance that all bases are covered from the common specifications. The EMV specification stack is broken, and needs fixing.

Read Ross Anderson’s entire blog post for both details and context. Here’s the paper, the press release, and a FAQ. And one news article.

This is big. There are about a gazillion of these in circulation.

EDITED TO ADD (2/12): BBC video of the attack in action.

Tags: , , , , , , , , ,

Posted on February 11, 2010 at 4:18 PM • 46 Comments

Comments

moo • February 11, 2010 4:53 PM

Of course its been known for a long time that Chip and Pin does not provide any real security, and is all about shifting the liability onto the customers — but its nice to see these researchers demonstrate it so blatantly.

When criminals can steal your money without even knowing the pin, surely the banks will be forced to acknowledge that its not secure and to accept back the liability that they would much rather foist off on their customers?

It seems rather dangerous to me to keep your money in a bank, these days. (Too bad its almost impossible to get by in modern society without a bank account.)

George James • February 11, 2010 5:33 PM

I love that the BBC video begins with the words “We obviously don’t want to give out too much detail…”

Didn’t anyone explain to them that Ross’s report is full disclosure.

Brian • February 11, 2010 5:41 PM

Well, I take back everything I have ever said about Chip and Pin cards. I hate banks. I’m keeping my money is a sock drawer and lording over it with military weaponry. Yay.

Chris Raser • February 11, 2010 6:00 PM

So, the bank’s records and security measures don’t protect customers; they protect the banks by providing a way to blame customers for security breaches.

What can we do as customers to protect ourselves from our banks?

Laurens Holst • February 11, 2010 6:36 PM

Ha, and the Dutch banks are going to switch in the coming years to this system, which is supposedly ‘safer’ and would better protect us from skimmers. Ha!

Garrett • February 11, 2010 8:31 PM

It strikes me that there are two separate issues here that people keep trying to confuse. The first is the technical security issue, and the second is the liability issue.

It seems to me that even if it is flawed, the EMV system provides better security than the straight signature model used in the US. At the very least, it cuts down on the ability of a typical passer-by to use a found card.

The problem seems to be the change in the legal framework which considers any claim of fraud by the customer not merely presumptively, but conclusively, to be an attempt at fraud against the merchant or bank. Even with no attempt at fraud and no software bugs, gamma ray bursts do happen.

My view is that we should keep trying to implement better security systems as practicable, but to always keep in mind that fraud happens, security flaws do occur, and software bugs are common. The people who have the most control over this are the credit card companies, and I’d suggest that the liability laws stay as they are now.

Leigh Hunt • February 11, 2010 8:34 PM

When I lived in the UK, I remember learning of the vulnerability whereby chip and pin cards could have their magnetic stripe cloned (and PIN recorded on video), and then the cloned card would be used in Europe where the chip wasn’t checked ( http://en.wikipedia.org/wiki/Chip_and_PIN ). This vulnerability was exploited quite effectively in a number of petrol stations in the South East and was investigated by Radio 4’s You and Yours in around 2006/07.

I was quite surprised that when I moved to NZ, the majority of cards here don’t even have chips, yet you still enter the PIN at supermarkets. I can’t help but wonder if the same is going on over here, but it’s just not public knowledge? Or maybe Kiwis are just really trustworthy!? 🙂

Re: the shifting of liability onto customers, I think Mitchell and Web summed it up very well here:

http://www.youtube.com/watch?v=CS9ptA3Ya9E

Daniel • February 11, 2010 9:06 PM

“But the banks trade body, the UK Cards Association, denied the discovery was serious.

‘We believe that this complicated method will never present a real threat to our customers cards,’ it said.”

OK. So who is telling the truth?

Nick P • February 11, 2010 9:59 PM

@ Daniel

Who’s telling the truth about flaws in supposedly “dependable distributed systems”? My money is on Ross. 😉

Patrick G. • February 12, 2010 3:07 AM

@Daniel

Complicated? They haven’t seen the sophistication of skimming gear attached to ATMs lately, haven’t they?

Compared to that, this attack seems rather easy

And the customer’s money is at stake, because if they register a VERIFIED BY PIN in their system, he pays.

If Banks want to bet on their security, it should be their money they are betting, not ours.

And your quote is pure gold:
“[…]will never present a real threat to our customers cards,”

Yes, the cards keep intact, just like a Wall Safe that opens when you knock 3 times on the door. Problem: your account/the Safe will be empty nonetheless…

Babak Memari • February 12, 2010 5:11 AM

This email below is the response of Joanna Rutkowska.
She says that Keystroke Encryption softwares is a total stupidity.

What is your idea?

Thanks
Babak Memari

— On Fri, 2/12/10, Babak wrote:

From: Babak
Subject: Re: What is your idea about these Keystroke Encryption softwares.
To: “Joanna Rutkowska”
Date: Friday, February 12, 2010, 5:57 AM
Whyyyyyyyyyyyy?

Babak

— On Fri, 2/12/10, Joanna Rutkowska
wrote:

From: Joanna Rutkowska
Subject: Re: What is your idea about these Keystroke
Encryption softwares.
To: “Babak Memari”
Cc: joanna invisiblethings org
Date: Friday, February 12, 2010, 4:12 AM
On 2/12/10 1:51 AM, Babak Memari
wrote:

Hi
I could not add a message in your blog so I ask
my
question by email.

What is your idea about these Keystroke
Encryption
softwares.

It’s a total stupidity.

Cheers,
joanna.

greg • February 12, 2010 6:17 AM

I am not liable for these unauthorized transactions from my bank. I even just reread the fine print. Why is everyone going on about banks pushing liability on to customers with chip and pin? That only happens with verified by visa, hence the reason i don’t have that.

BF Skinner • February 12, 2010 7:11 AM

Another article at the Register http://www.theregister.co.uk/2010/02/12/chip_pin_security_unpicked/

@greg “happens with verified by visa”

And are those consumers sufficiently warned that they are accepting the risk, the liability, with a system that doesn’t work. Sufficient in this context means “so they understand it.”

@Daniel “So who is telling the truth?”

You can tell by their behavior. If the banks do believe it’s not serious let them reassume the cost of any loss.

Clive Robinson • February 12, 2010 7:32 AM

@ Daniel,

“OK. So who is telling the truth?”

Well like Nick P I’d definatly go with Ross.

Why, well he is not only a well respected researcher but importantly he puts himself on the line.

That is he goes into a court on oath and gives his “opinion” as a mater of “fact” as expert witnesses should.

Which card industry “PR” “mouth piece” / “Spin Doctor” has done that?

As Bruce has noted on more than one occasion “Banks externalise risk” that means you the customer who is least able to defend yourself gets to swallow their 5h1t.

Bill Herdle • February 12, 2010 7:35 AM

The most troubling part of this paper for me was its implication that the authors apparently believe criminals discovered the vulnerability (or something equivalent) some time ago and have been exploiting it.

Naturally it is in the banks’ interest to deny any problem because their strategy of shifting liability to the consumer when the card is used fraudulently depends on convincing us that the card cannot be used without knowledge of the PIN. As Bruce has said for years, responsibility for security failures belongs in the hands of those who can actually improve security. In this case, the consumer is helpless. When the technology fails, the banks who own and can change it need to feel the pain.

Clive Robinson • February 12, 2010 7:42 AM

By the way this is not the only protocol error arround at the moment (admitadly it’s probably the bigest right now)

Have a trundle over to,

http://www.financialcryptography.com/

To see a bit on EV’s Green Cert being Busted.

Oh and when people are over at Camb Labs (lightbluetouchpaper) have a look at HMVQ and 3D Secure (Verified by Visa) protocol failings…

kangaroo • February 12, 2010 8:42 AM

“What can we do as customers to protect ourselves from our banks?”

There ain’t shit you can do as a “customer”.

It’s as a citizen that you should act — to legally guarantee that liability lies on the creditor to prove the debt, not on the debtor to “prove” the negative.

RaffaelVargas • February 12, 2010 11:28 AM

This activity is normal because some banks not have financial incentives to modify all Pinpads, POS, ATM and Cards to chip only and not accept magnetic stripe.
Although we hear a lot of fraud in this sense.
Patience and care …

jacob1898 • February 12, 2010 11:41 AM

Some quick points.
1. Banking as pointed out by Bruce is only marginally secure. The philosophy is to make it slightly less secure than it would cost the banks to implement otherwise. Customers would not like a “secure” system like iris scanners, etc. “It’s the mark of the Beast” (joking) Although I’m sure those could be bypassed.
2. Any card can be cloned with the right equipment. I could clone any smartid (driver’s license). I have access to the equipment. Even holograms are not that difficult with enough patience and determination. Hell, I can make a card reader with a tape player head.
3. If you have physical access you can do almost anything. This ranges from TPM to magnetic stripe. Oh, smart chips too.
4. Physical access–all bets are off. Access to electronic records–all bets are off. (Web, ISP, cell phone records)
5. Welcome to the modern age. It used to be you only had to worry about the town gossip. Now, there are millions are busybodies.
6. It’s enough to make me wave a chicken over my head, say a budhist prayer, perform an exorcism, and put a condom over my monitor. That should cover most religions.
😉

Mailman • February 12, 2010 11:47 AM

I expect EMV to soon throw law suits at people who disclose any information about this vulnerability and say that these people are the bad guys. It’s happened in the past.

Henry • February 12, 2010 1:48 PM

Under UK banking regulations: the banks have to prove that the consumer was negligent see http://www.bit.ly/cf4kDu for details

Extract: Unauthorised transactions – if you think a transaction on your account was not authorised by you, the bank or building society will need to prove either that you authorised it, or that you either deliberately or carelessly allowed someone else to get hold of your password or PIN. Just because your PIN was used will not necessarily be enough to prove that this is the case.

Matthew Carrick • February 12, 2010 7:33 PM

I have been walking around for years wearing a knapsack full of gold coins and diamonds – no PIN required because it’s analog old skool money, dig? But try buying a pack of gum . . .

lexdabear • February 13, 2010 3:33 AM

I see the same security flaw in the EMV specification and ICAO specification for ePassports. There is some information optional and it can be used to bypass the security measures. EMV: PIN, ICAO: signature over critical data. Workaround could be that the terminal signals the capabilities, e.g. PIN and signature verification, and this capability information is signed, and the card will enforce these. Then you need of course either an on-line transaction or a SAM in the terminal.

Rene Bastien • February 13, 2010 6:37 AM

I have been consulting with Financial Institutions worldwide on the implementation of EMV for 10 years now. My compliments to the team at the University of Cambridge Computer Laboratory for continuing to research potential weaknesses in the payment system. This is how to make a system better: peer review!

The proposed attack scenario is actually not new; I wrote about it 9 years ago. The attack seems to point to a weakness in the implementation choices made. Fortunately, there are very simple counter measures that are available to protect cardholders and all participants in the payment ecosystem from this type of attack. There are weaknesses in the system, but there are ways of protecting against them.

Henry • February 13, 2010 4:02 PM

Cybergibbons

The regulation that mandated Financial Institutions have to prove you are negligent came into force Nov 2009

Cybergibbons • February 14, 2010 4:01 AM

And it has made little to no difference to how it has played out.

If your card and pin are used by someone to make a purchase:
a) It was you that did it and you are trying to claim back something you didn’t buy
b) It was someone who got hold of your card and pin and you didn’t report it stolen, hence you are negligent.

Whenever it comes up the bank simply shows logs that the transaction was chip and pin, and you have to fall into one of the above categories.

About the only instance when this doesn’t happen is when there is CCTV evidence to the contrary. Good luck it getting hold of it though.

Adrian Challinor • February 14, 2010 5:41 PM

I have read the paper, several times now.

It sounds like the banks arrived at a security protocol based on “security through obscurity”. They deliberately tried to suppress publication of the security protocol (something I am sure that most of this list would agree is a poor measure of security). The protocol is then made available in a variety of documents.

The deliberate aim here is not to apply a trusted security protocol, it is to use the belief that such a protocol exists to shift the liability of the failure of protocol.

I suggest that we all save a copy of this paper. If anyone, unfortunately, is in a position of having to show that their stolen card was used in such a situation, they ask that the paper be accepted as evidential proof that the EMV security can be broken.

Earlier comments state that as customers we have virtually no rights against the card providers and banks. However as citizens, we have a right to be assumed to be innocent unless proved guilty. It is, at least in the UK, the responsibility of the banks to show that we have made our PIN public thus allowing the fraudulent transaction to proceed. By showing that this is not the case, that the protocol is unproven as secure because it has been demonstrably proven to be insecure, we have a chance of proving our innocence.

If sufficient people can prove this in court, precedence will be set, and then the card providers will be forced to act. Only then will we get a secure Chip and PIN solution. Hopefully, at that stage, the providers will come to their senses and ask that a proper analysis of the full, end-to-end, transaction is provided and a proven examination of the risks is made public.

Earth to banks: Security through obscurity is flawed.

Adam • February 15, 2010 1:01 AM

Could those who use this system clarify something for me. Can a thief opt to use a signature and just sign for it?

I find that very few places match signatures, and a few practice tries should fool those few cashiers who do.
Note Zug’s credit card prank where cashiers accept drawings of a whale and a game of tic tac toe as signatures.

Richard • February 15, 2010 8:37 AM

Adam,

A merchant generally wouldn’t accept a signature on a chipped card because they get to carry the risk of fraud.* They certainly wouldn’t do it without looking very carefully at the signature.

  • With a PIN the banks accept the liability, then pass it on to the customer.

mcab • February 16, 2010 2:15 PM

@greg
It may be in the small print, but that doesn’t seem to be stopping the banks refusing to refund customers. From the Telegraph article on the subject: “… around half did not get their money back from the bank, even though they insisted they did not use or authorise the “disputed withdrawal”. ”
Find the full article here: http://www.telegraph.co.uk/finance/personalfinance/consumertips/banking/7222798/Chip-and-pin-should-be-overhauled-to-protect-millions-of-bank-customers.html

Marcio Lima • February 17, 2010 7:57 AM

In 1997 the Brasilian Federal Police burst a gang specialized in cloning chip cards. The gang was able to clone 11.000 cards. The Federal Police arrested 15 people involved in the scheme. The head of the gang was a chinese which wanted to test the fraud in Brazil and sell the technology to an international gang.

There is no detail about the fraud but I suspect that they exploited the same vulnerability to get into the card and get the files inside so that they can rewrite it in a new card.

The good news is that the brasilian law put all the liability of frauds in the banks. The customer has not even to sue the bank. They have to refund the customer once a complaint is filled in the bank.

tony • February 23, 2010 2:12 AM

Backwards-compatibility (in this case with signature based authentication) is always an additional risk.

Wynand Vermeulen • September 14, 2010 6:02 AM

I wonder whether anyone here actually read the paper. Do you understand how this attack is performed?

Let me save you trouble of reading the paper.

It involves a genuine chip card, which will probably be stolen from someone’s mailbox… (seriously? who sends cards by unregistered mail?). Ok, so lets assume a fraudster picks your pocket and gets his hands on your card. Within 5 minutes you phone the bank and have your card blocked. But wait, our fraudster is not only a skilled pick pocked, but also knows about online and offline transactions, and know he can expend the offline limits on the card using the man in the middle attack without going online (or he is very fast and perform the attack within 5 minutes of the theft). He then attaches a few wires to the chip, runs a cable up his sleeve to a laptop on his back… our fraudster now walks up to a cashier (cant do this on ATMs) to pay with his card, and inserts the card at a terminal with these wires dangling down his arm. When the cashier hands him the receipt for the signature, and when she asks to see the card to compare the signature, he manages to show her the card without her noticing the dangling wires….

Our fast moving, pick pocketing, social engineering, fraudster has now managed to do a fraudulent transaction. These days, most cards in developed countries are online only, so our fraudster has the time in between theft and reporting the card to attach wires to the card, run into a store, select some goods, and pay for them. For offline cards, my guess is the limit is around GBP100 for the typical offline capable card; so there you go, our fraudster did all that work and risk being caught with wires running down their arms, all for GBP100.

Lets assume our resourceful and talented fraudster has managed to pull this stunt 5 times in one day without being detected. He decides to scale up, over the next few weeks he creates a fraud toolkit, and sell these to other pickpockets…. a legion of pickpockets will hit the streets, steal 100’000 cards and defraud a million pounds – big deal! This is nothing compared to the USD 6.8 billion of U.S. magnetic stripe card fraud in 2009. Any half backed fraudster will rather get some magstripe action, than risk their bacon doing this.

A google search on this subject will yield several forums and panels where this cambridge “attack” is acknowledged as a weakness, but discredited as a fraud risk.

At worst any crime related to this weakness should not be classified as card fraud, but rather the crime of pickpocketing!

David Griffiths • November 10, 2010 11:40 AM

Here we go again with the MITM attack. It works but it’s a bit of a nonsense, because the issuer can tell it’s happening, regardless of what the academics at Cambridge say. The check isn’t included as part of the EMV Common Core, but it is included in the card scheme docs that the prof can’t get hold of. On the whole Wynand is correct, a few factual errors, but the overall argument is sound, especially the one about the clever crim preferring to monkey about in EMV-land with wires hanging out of his sleeve looking like a bit of a div, rather than going to the US and sharing in the $6.5 billion easy-pickings ripe for the taking wit a simple magstripe clone.

Get real guys and stop monkeying around.

Mr. Chips • January 30, 2011 9:37 AM

December 2010 my mother in law had her RBC Visa card cloned. She was in New York and tried to use her credit card to pay for a taxi ride. It was rejected. It appears that the credit card security system notices someone had used a bank machine to withdraw money from the credit card in Montreal at or around the same period, so something was wrong, and it rejected the transaction in New York. She was later told by Visa that her credit card has been used 3 times successfully to withdraw funds directly from bank machines. Anyway, she didn’t have to pay back the money or anything, but what would have been the story if she had not been in NewYork at the time the theft had accurred? Also, how are these cards with new chips getting cloned, and if they are being cloned, why haven’t the public been told? The pin instead of a signature was a dumb idea. Both maybe but not just the pin. Video cameras can record people entering their pin easily. I’m sure a hacked credit card reader device can easily record the pin number entries aswell. The public has to be told about this stuff and the banks have to fess up.

Clive Robinson • September 30, 2015 2:28 AM

@ Mac,

…Thanks banks. Cash anyone?

Hey forget “Chip-n-Spin” the new kid on the block is “contactless” where no PIN is required just a “swipe”.

I’m thinking, how hard would it be to make a radio based “MiTM” device.

You have a fake “card” device in a wallet that you “swipe” at the till, which talks to a device in your buddies brief case that actually reads the contactless card in the purse of the woman who your buddy is standing behind in the que…

But the fraud is possibly even simpler… just yesterday I was buying groceries in my local store two guys in their twenties just ahead of me in the que were buying cheep beer. One of them said to the girl at the till “Can you put upto the limit on my card, and we’ll pay the difference in cash?”. She agreed, so the older guy swiped a contactless card and the other guy paid abou a UKP in coins. Most odd… and the thought occured to me that I had possibly just witnessed a stolen contactless card being used to the max…

John Gray • November 12, 2015 8:57 AM

For everybody who thinks this information amounted to nothing… These guys build a custom card with a custom intermediary chip with the stolen chip encased within. 680,000 US, and that is just a small group that was caught. The police had to go to University-based forensics to figure just what was going on as they didn’t have a clue. 20 Billion annually on this right now and being covered up by the banks.

http://www.tripwire.com/state-of-security/security-awareness/forged-module-hack-compromised-credit-cards-chip-and-pin-technology-say-researchers/

Leave a comment

Login

Allowed HTML <a href="URL"> • <em> <cite> <i> • <strong> <b> • <sub> <sup> • <ul> <ol> <li> • <blockquote> <pre> Markdown Extra syntax via https://michelf.ca/projects/php-markdown/extra/

Sidebar photo of Bruce Schneier by Joe MacInnis.