Forgot your password?
typodupeerror
Security Puzzle Games (Games) Hardware

Chip & PIN terminal playing Tetris 228

Posted by Hemos
from the the-joy-of-subversion dept.
Fearful Bank Customer writes "When British banks introduced the Chip-and-Pin smartcard-based debit and credit card system three years ago, they assured the public it was impervious to fraud. However, the EMV protocol it's based on requires customers to type their bank account pin number into store terminals in order to make any purchase. Security researchers at the University of Cambridge Computer Laboratory derided the system as insecure at the time, as it gave access to customer's bank account pin numbers to every store they bought from. Despite these objections, the system was deployed, so researchers Steven Murdoch and Saar Drimer recently modified a straight-off-e-bay chip-and-pin terminal to play Tetris, with a video on YouTube, demonstrating that devices are neither tamper-resistant nor tamper-evident, and that even students with a spare weekend can take control of them. The banks are claiming that this can be reproduced only "in the laboratory" but seem to have missed the point: if customers have to type their bank account pin into every device they see, then the bad guys can capture both critical card information *and* the pin number for the bank account, leaving customers even more vulnerable than they were under the old system."
This discussion has been archived. No new comments can be posted.

Chip & PIN Terminal Playing Tetris

Comments Filter:
  • by PresidentEnder (849024) <wyvernender@NOSPAm.gmail.com> on Monday January 08, 2007 @12:09PM (#17509128) Journal
    Those who would exchange security for convinience deserve Tetris!
    • Re: (Score:3, Informative)

      by shaneh0 (624603)
      Misquote indeed. Especially considering Franklin wasn't actually the source of that nugget of wisdom.

      http://en.wikiquote.org/wiki/Benjamin_Franklin
  • by Shoten (260439) on Monday January 08, 2007 @12:11PM (#17509160)
    They got it to play tetris by replacing the majority of the electronics inside it. It's not exactly like they got the actual terminal to play tetris...it's more like "They put a tetris game console inside the empty terminal shell, and used the terminal's keypad and screen for control and display." It'd be like skinning a copy of Windows 95 to look like Xwindows, and then saying "Look at all the vulnerabilities I found in linux!"
    • by crossword.bob (918209) on Monday January 08, 2007 @12:16PM (#17509208)
      But if someone can put custom electronics in what is supposed to be a tamper-proof shell, people will blindly insert their cards and type their PINs. The issue is not one of terminal software security, but of hardware integrity.
      • Re: (Score:2, Insightful)

        by jimicus (737525)
        Tell you what. Why don't you go away and build me a 100% tamper proof Chip & PIN which cannot be easily replicated (eg. with casting resin and alginate), doesn't cost a small fortune to produce and provides some easy, immediately visible means of differentiating it from any possible fakes? Then persuade Tescos (and anyone else with similar systems) to use that rather than their existing system (which is "all cards, regardless of type, are swiped through the card reader on the checkout"), because if yo
        • The point being... (Score:5, Interesting)

          by Junta (36770) on Monday January 08, 2007 @12:52PM (#17509718)
          That the whole point of this is to demonstrate that if you use the merchant's hardware to enter any personal data, it is *impossible* to be tamper-proof or tamper-evident for sure.

          My vision has always been a smart device with a crypto engine, that provides it's own display and entry. It would plug into POS equipment, and tell the POS equipment at first, only enough to identify itself and tell the POS which financial institution to contact.

          The financial institution would receive from the merchant the account holders ID number and some info about the transaction (i.e. the amount, maybe an interval if a service, maybe a tolerance if a repeating service charge). The financial institute would look up the customer's public encryption key, and use it to encrypt all that data together with a challenge string, and send that back to merchant.

          Merchant relays the encrypted package to the customer smart device. The device then (maybe using a passphrase to decode private key like a pin, but not linked to anything outside the device) uses the private key to decode the data, and display to user what the financial institution thinks the merchant is asking for with a confirmation. If user confirms details, the decrypted challenge is sent to POS and the merchant relays it to Financial institute.

          Financial institute upon receipt of a correctly decoded challenge, authorizes the transaction, and gives the merchant an affirmative response with an authorization code that is *only* valid for that specific transaction.

          Here, the financial institute *only* has the customer private key, so ripping off that database won't give anyone access to the account. The merchant knows they are getting the money, but isn't left with anything they *could* use to get more money than the customer authorizes directly. The only place that has the private key is the customers smart card, which should *never* allow it to be transferred out (probably should be generated by the card and only the public part uploaded when issued). If using a passphrase for storage of the private key, it even has resistance to physical theft.

          For bonus points (actually, I would pretty much demand it), have it somehow able to plug into usb ports for online transactions. Of course, online, the customer and financial institute can talk directly, simplifying some of it, but the model need not be changed much for online stuff). Again, the PC would never get the private key, so you would have to use the device.

          I would *pay* an upfront charge to help cover the cost of the device in exchange for such security. If it's half-assed and uses merchant display/entry, or shares the private key *ever* theoretically, I wouldn't.
          • by Junta (36770)

            Here, the financial institute *only* has the customer private key
            I meant public key, whoops....
          • My idea.... (Score:3, Insightful)

            by shaneh0 (624603)
            While your idea seems very well thought out, it still wouldn't gaurantee it couldn't be a dummy terminal that's designed to collect swipe data and pin codes.

            My thoughts are that after you swipe your card, the terminal should give YOU a PIN number that should match a PIN that the bank sends you with your card. At this point, once you verify that it is indeed legit, you provide your counterpart PIN.

            And since it doesn't have to be entered, it could be a word, or with LCDs, even an image.

            Hell, for that matter,
            • by Junta (36770)

              While your idea seems very well thought out, it still wouldn't gaurantee it couldn't be a dummy terminal that's designed to collect swipe data and pin codes.

              The idea was that all input and display was on the device the customer always carried *with* them. They never touch a button or trust anything displayed by the merchant's equipment. The POS half would be a plug with basic data I/O lines and power. The device is expected not to be tampered with because the customer always has it. In order for it to be compromised as described it would have to be physically stolen and swapped. Even then, it would be unable to complete a transaction. I.e. you plug it in

        • You've really missed the point here - as explained in the article, in the summary and in the post that you're replying to. The researchers pointed out when Chip'n'pin was introduced that what you've described is impossible. What you've posted is exactly their gripe with the system. The only difference is that they've sensibly suggested that this is a reason that we shouldn't use an authentication system where we give away information, whereas you've concluded that we're just stuffed and people should quit b
          • If we accept the response by the manufactures at face value what they say is that while the doctored machine can intercept some information it still cannot be used to counterfeit a chip-and-pin card or forge a chip-and-pin transaction. Thus they are still correct in saying it's impossible to beat--for now at least.

            Any system can trick users by social engineering. But techincally this chip-and-pin system is still secure in the face of that. Their weak point is that because the overseas transactions are ro
            • by jimicus (737525)
              There's only one minor flaw to all of this.

              While it is possible to build a 100% guaranteed nobody-will-ever-beat-this-and-I-don't-care-how-de termined-they-are system in theory, nobody in the whole of history has built one in practise.

              Or at least, not without some undesirable side effects. For instance, I can make my car 100% guaranteed impossible for a potential thief, no matter how determined, to drive away, but it's a mite inconvenient for me because I'd have to have it crushed.

              What instead you have to
            • All it needs to do is to clone the magnetic strip (easy). You've kindly given it the pin.

              Go to your local ATM and draw out $$$. Most ATMs still use the mag. strip and haven't been upgraded to chip/pin yet.

              btw. up until *very* recently (last month or so) you could walk into tescos and buy groceries with a clone magnetic strip without even access to the pin - their software wasn't geared up to read it so it just assumed the card was legit... and since this was the 'self checkout' nobody even looked at it.
      • by martyros (588782)

        But you haven't completed the social engineering scenario. Here's the problem -- after they put their card in & type in their pin to the fake machine, the money won't be paid to the store. Because the system is really just a mock-up designed to /look/ like a chip-and-pin system, it won't actually talk to the bank to get the store its money.

        So to collect anybody's pin, the store basically needs to eat the money they would have gotten for the transaction. Not a cheap thing to do.

        I suppose they coul

    • by pdawson (89236) on Monday January 08, 2007 @12:28PM (#17509402)
      The point is if they can do that, bypassing the 'tamperproof' systems, they can open a unit in the field and piggyback a chip in to record account# and pins with the with the user being none the wiser.
      • The real point is that the system by design encourages (or in fact requires) users to give up their bank pin in order to make purchases. Let's hope they don't actually try to band-aid the problem by making tamper-evident casings.

        Question: what role does the 'chip' have? Does it have any way of securely authenticating the transaction with the merchant, and thus in some way verifying that the merchant trusts the terminal? The article summary suggests that the same old information is on the mag strip.
        • by dsanfte (443781)
          The Interac system in Canada has been running since at least 1997 and involves swiping your normal bank card at the store and entering your pin on a keypad for via-telephone authentication of the purchase.

          There are some fraud problems. Mostly, people hook up card cloners to ATMs and have a small camera set up to record pin numbers. Then again, they also do that in the US, as well.

          If entering your PIN at the store is a significant vulnerability, it's one that has existed here for 10 years without significant
          • by Nursie (632944)
            Chip cards are impossible* to clone in that way, and if someone clones the strip part of it under EMV then the PIN is not used and the transaction is flagged for attention as a possible fraud.

            (*yeah, ok, very difficult!)
        • by Nursie (632944) on Monday January 08, 2007 @12:57PM (#17509810)
          Sorry for the pompous post heading, but the first part is true, I wrote a large part of Tesco's system including about half of the EMV processing component. It's a customised version of what was the world's first integrated EMV system (ie card reader + PC + store level auth servers + central connection to VISAnet, LINK etc).

          Whether you should listen to me or not is another matter.

          The chip controls the transaction. That's how it goes. The chip decides if it can trust the terminal or the bank based on cryptographic signing operations. The terminal is verified by a process in which it concatenates various pieces of data, performs a crypto op on them and presents the result to the card. The card compares this to its own result (depending on the card it either has one precalculated and uses the same one each time (low security) or does the same calculation itself on a set of data including some session data (better security)).
          PIN is encrypted as soon as it is entered and should never leave the device it's entered on in plaintext form, it is presented to the card as a cryptogram for validation.
          When a transactioon is presented to the bank for authorisation it is presented with yet another cryptogram so that the bank can validate the card. The response also comes in the form of a cryptogram so that the card can validate the bank.

          However, I'll agree, all this is pretty useless if someone can get inside the terminal and intercept the PIN at hardware level. Other than that and the looking-over-shoulder social security hole problem, EMV's pretty bullet proof. Your PIN doesn't ever even get to the PC that's running the transaction.

          If you want to know more then the actual standards are available at EMVco [emvco.com], but they're the nearest thing to legalese I've ever encountered as a software Dev. I'm out of the payments game now, but my knowledge should still be pretty relevant, I hope.
          • Thanks for that explanation. However, doesn't this presuppose that you are slotting your card into a bona fide machine? Couldn't someone do what the team in TFA have done and replace the innards of a chip and pin machine with new electronics? Then this machine could fake the entire process of entering your pin, the whole "Checking card, not not remove", "Please remove card" thing, spit out a receipt from the cash register and away you go, innocently believing that you have just completed a purchase when in

            • by crosbie (446285)
              Yup. This all comes from a highly entrenched "We own the hardware, therefore the only authentication required is to authenticate the client".

              Same syndrome with websites being vulnerable to phishing.

              Authentication has to be TWO-WAY.

              The punter has to authenticate themselves to the bank - AND the bank has to authenticate themselves to the punter.

              The punter is an incredibly intelligent being and yet they're being deliberately treated as a 4 digit number (not even a dumb terminal). Such a colossal waste of CPU p
              • The bank sends a cryptogram which the card decodes and verifies. This is the two way auth. Actually it's three way because the terminal is cryptographically verified too. There's just no tamper resistance built into the spec.

                I know a 4 digit number isn't the height of security, but what would you suggest that cardholders do to identify themselves?

                Remember that old people and idiots have to use the system.

                Also it is futureproofed to allow for Fingerprint/Iris recognition or other methods in coming years.
            • I'm not as familiar with the hardware requirements of EMV certification but yes, it rather does assume hardware integrity and retailer integrity.

              Chip and PIN is designed to card cloning and to some degree theft. Now card cloning was rife with magnetic strip cards because they were extremely easy to clone. A shop assistant or a waiter could easily pass your card through an extra reader and take the details, pass them on to someone else and then the card could be used all over town. This is eliminated as card
              • by Tony Hoyle (11698)
                He couldn't use it in an ATM as they are chip enabled more often than not (in Chip'n'PIN) countries. I know this as I was involved in the design and implementation of an ATM auth system too a couple of years ago.

                Not true, at least around here... I have a debit card with a broken chip (long story) & can use it to withdraw cash at ATMs - just not pay for groceries (although I can use it at NPC car parks as they're not chip/pin enabled yet).
                • Though try buying anything major with it and you ought to get refused or phonecalls from your bank.

                  They likely haven't got around to replacing a large part of the ATM estate, banks are good like that. Everyone has to jump to theiur tune but they don't always follow it themselves.
          • If that's the case, then isn't the PIN alone rather useless to a crooked merchant? From what I understand, the chip on the card is supposed to be difficult or impossible to duplicate (especially in a tiny form factor card reader device). So even if you have the PIN, it's of no use to you unless you either mug the person for their card or hope they've used it elsewhere.
          • Was it your idea to allow swiping of the card without a requirement to enter the pin? I'd guess it was upper management, since you sound relatively clued up..
            • by Nursie (632944)
              It's a handover thing, until all cards are EMV and all merchants are EMV enabled then cards require a magnetic stripe so that the customer can still use them everywhere. This is a bit of a security hole.

              I don't know which country you're in but the legacy magnetic stripe behaviour differs by country. In the UK we never had a system of Stripe + PIN, it was Stripe + Signature, whereas I noticed in the US that PIN was prevalent.
              • by Tony Hoyle (11698)
                This was in the UK, Tescos in fact :p

                The self checkout devices for a long time didn't check the pin at all.. you just swiped the cards with the magnetic stripe (which could easily be cloned.. nobody checked) and walked out. This was long after the rollout of chip/pin as well.. it was still doing it in early december then they added an extra stage - now you swipe your card and have to put your card in a device (and enter pin).. so they've gone for the overkill.
    • by Megane (129182)

      They got it to play tetris by replacing the majority of the electronics inside it.

      That really can't be mentioned enough. Link to The Register's article [theregister.co.uk]

      It'd be like skinning a copy of Windows 95 to look like Xwindows, and then saying "Look at all the vulnerabilities I found in linux!"

      Except that a better analogy is those card skimmer devices that get stuck on ATMs that can record the card stripes and button presses. While the blame is misplaced ("oh noes! teh phish n chipz n pinz r haxx0r3d!"), it's still important as a reminder that sometimes you don't need to hack the security, if simply wearing a sheep's skin is good enough to get your wolf into the flock.

    • Very good analogy. I'm most interested in what terminal they hax0red, and I can't really tell. I'm pretty certain of this though: any program that would be able to read the key presses will not authorize transactions - ever. If you can replace the electronics with something that can read the keypad, then you'll lose the benefit of the (tamper-resistant) electronics that actually encrypt the PIN block. Show me a proof-of-concept that can actually record keypresses while still authorizing transactions, then I
      • by Tony Hoyle (11698)
        Oh come on that would be trivial to arrange.

        Keypad in front of the customer, little LCD display etc. and a simple control circuit instead of being connected directly to the till goes to another device that mirrors the keypresses on a real device.

        It used to be secure when you had to put your card in the chip/pin device - but most retailers decided they wanted their control and you don't do that.. now that keypad could be *anything*. There's not even a standard 'look' - they all look different.. the only thi
    • by Shoten (260439)
      Okay, a few people have responded by saying something along the lines of, "Yes, but the issue is one of being able to tamper with the device this way." Yeah, true...so what? That's an issue for anything. Hell, ATM's are being tampered with like that, and they're both more mature (the bloody things have been evolving for decades) and secure. Add to that the fact that, unlike an ATM, chip and pin devices need to be cheap to be practical, and I don't see how this can be avoided, no matter what. Leave a de
  • by swillden (191260) * <shawn-ds@willden.org> on Monday January 08, 2007 @12:14PM (#17509184) Homepage Journal

    The potential security problem here is caused by the use of the same PIN for two purposes. You know how you should never use the same password for multiple security-critical systems? Well, that's exactly what some of the UK banks did.

    See, EMV security is designed around the assumption that only the card and cardholder know the card PIN. The bank doesn't know it. The merchant terminals see it, but it has no value without the card. In particular, it should be of no use with the bank machine/ATM network.

    How then, do you use a bank machine? Well, ideally, you insert your card, enter your PIN to unlock the card, and then the card performs a cryptographic authentication with the bank over the ATM network to identify and authenticate you so you can proceed to perform your transaction. But that requires the ATMs and network to be updated to support the chip card and to use the new authentication protocol.

    The other method, of course, is just to use an account number and a PIN, just as you always have, but that PIN *must* be known by the bank's systems, which leads to the banks' dilemma when deploying the system. Their options were:

    1. Make customers remember two PINs for the same account, a card PIN and a "bank machine PIN". This is good for security, but bad for customer acceptance.
    2. Upgrade the ATMs and network to do the card-based cryptograhic authentication. Good for security, but, in the short term very bad for customer acceptance, because it means that the cards can't be used with non-UK ATMs that don't implement the new technology.
    3. Use a "shared" PIN, ensuring that every time a cardholder changes either the card PIN or the bank PIN, the other gets updated to match. This is called "PIN synchronization" and is actually not all that cheap to do either, but it's the only option that means customers only have to remember one PIN and can use their card in ATMs around the world. It's bad for security, though.

    So, the banks mostly took option 3. I think some of them allow customers to request that their card and ATM PINs be "decoupled".

    In theory, this means a malicious merchant can modify their PIN pad to capture the PINs and account numbers, and can then use the information to drain the accounts through the ATM network. In practice, this form of fraud hasn't happened, and it would be fairly easy to track unless the fraudster didn't steal very much -- a pattern of fraud on accounts whose cards have all been used at a particular merchant would be pretty easy to detect.

    It could happen, of course, and probably will someday. If it becomes sufficiently serious, then maybe banks will have to abandon PIN synchronization. Hopefully, by then the rest of the world will have caught up and the ATM PIN can be discarded entirely.

    • by rapiddescent (572442) on Monday January 08, 2007 @12:32PM (#17509450)
      actually, with regard to point 3 above:

      EMV cards have two data items for the PIN usually called online PIN and offline PIN but pretty much all banks have the same value for each.

      The key worry about this 'attack' is that the electronics could be changed easily:

      • get the mag strip by asking the customer to swipe
      • gets the PIN value
      • completes the transaction using the EMV chip
      • stores the mag stripe and PIN value
      • reuse the card in an ATM/Store that does not require chip

      This fraud has already been perpetrated at a Shell garage in the UK [bbc.co.uk] when a bloke in overalls came into the Shell store to say he was the engineer to check the Chip n PIN device. The Trintech unit had a fault so that it would not self destruct when opened and a simple memory chip was added to the device. The bloke in overalls went back a few weeks later to 'check everything was OK' and took back the memory chip and had the card details and PINs - resultant fraud loss was GBP 1m; although not sure how much was recovered.

      I'm very wary of Tesco stores (UK) that swipe the mag stripe before inserting the card into a chip reader then ask the customer for the PIN - they effectively have the strip and the PIN which is enough to make a new card. The problem is that the chip cards have the legacy mag stripe to work in foreign ATMs and non-chip compliant stores.

      The way things are going with APACS CAP - punters will be inserting their PIN into any old keypad, so it'll be getting worse before it gets better.

      rd

      • by crosbie (446285)
        At least the card reader should have been required to say "Hello Mr A Person" plus a detail only obtainable via the EMV chip (a favourite colour). Then people would have a tadette of confidence that the machine could read their card properly.

        But, yes, you're absolutely right. Tons of punters are being trained to pay absolutely no regard to the nature of the device into which their card is placed, nor whether the device and/or card is removed from sight.

        Even once the mag strip is discontinued there's still a
    • by KillerBob (217953)

      In theory, this means a malicious merchant can modify their PIN pad to capture the PINs and account numbers, and can then use the information to drain the accounts through the ATM network. In practice, this form of fraud hasn't happened, and it would be fairly easy to track unless the fraudster didn't steal very much -- a pattern of fraud on accounts whose cards have all been used at a particular merchant would be pretty easy to detect.

      Yes it does. It happened to my brother and to his wife. The experiences

      • by swillden (191260) *

        Interesting. I hadn't heard of any actual cases, but I haven't been doing EMV stuff for the last couple of years, so it's not surprising that I've missed it.

        Even with a little of this going on, the net effect is still to tremendously reduce overall credit card fraud. The bad part is that because this fraud is rare, the suspicion tends to fall more heavily on the card holder, especially card holders that don't have a solid reputation.

    • The real solution here is that both the chipcard and the PIN device should belong to the payer. Each account should be issued their own slim 10-key PIN pad with the smartcard integrated. When paying, the transaction would be transmitted to the smartcard (by contact or wirelessly) and then the user enters their PIN. The transaction is signed and sent back to the cash register or point of sale system.

      This way, the payer is reasonable certain that the PIN device has not been modified.
      • by swillden (191260) *

        Yes, there are various implementations of cards with built-in PIN pads, and even other authentication technologies like fingerprint scanners, but none of them have been deployed because of the costs and questions about reliability.

        What may be the "next big thing" is called Near Field Communications and involves embedding a contactless smart card chip in a cellphone. With that architecture, the phone's keypad can be used as the PIN pad.

        • There is already a smartcard in your phone, and a radio (sometimes two), and a keypad. So the problem is entirely in the software domain at this point.
          • by swillden (191260) *

            NFC adds a contactless (ISO 14443) chip in addition to the phone SIM, and and RFID reader as well. Both the contactless chip and RFID reader use frequencies and protocols the phone doesn't already support.

        • Oh by the way, I dispute your statement that none have been deployed. The Bloomberg Anywhere service uses a chipcard with integrated fingerprint reader and even an integrated camera.
          • by swillden (191260) *
            Never heard of Bloomberg Anywhere. I'd be interested in reading about it if you have a link.
            • Google for Bloomberg B-Unit if you are interested. It's not a total solution (because it has no radio, and because fingerprints are not as good as PINs) but it's close.
    • by pilgrim23 (716938)
      Might I suggest a proven and workable security system that for many years served quite well, worked flawlessly, and besides serving the customer, provided a unique customer experience which enhanced the transaction with good feelings all around and a willingness on the customer's part to bring more business to the bank?

      This system involved the use of a key security feature we will call a "Human Teller". The Teller would smile and say "Good Morning Mr. Thomas", verifying Mr. Thomas' identity both visually an
  • by reverseengineer (580922) on Monday January 08, 2007 @12:16PM (#17509202)
    ...will be a modification to Tetris to make that damn straight-line block appear more often.
  • The Payment Card Industry (PCI) POS Pin Entry Device standards set by Visa/MC/JCB specifically require that a device used for credit card transactions NOT store the PIN and be resistant to tampering (such that a card holder would be able to see that something is wrong with the device if it had been tampered with). Merchants are required to use devices that have received PCI certification through a certified testing lab. It would be interesting if these devices have received that certification. Visa standar
    • by crosbie (446285)
      This is irrelevant. These standards only apply to bonafide card readers.

      Fraudsters may observe standards, but they gleefully ignore them if it suits their purposes.

      How is any member of a merchant's staff trained to inspect their black box and determine whether it complies with standards?

      And remind me where I can read a bank's guidelines to its customers as to how they should refuse to use a card reader if it looks like it may have been opened recently? Moreover, is there a photo gallery of all the known leg
  • researchers [...] recently modified a straight-off-e-bay chip-and-pin terminal to play Tetris, with a video on YouTube, demonstrating that devices are neither tamper-resistant nor tamper-evident [...]

    I think putting Tetris on the machine makes it pretty obvious that it has been tampered with.

  • Being an American living in Britian, Chip & PIN makes a lot of sense. Any sort of technology is available for fraud, but this is 100x better then the signature security as well as the PIN is not transmitted past the terminal because it is all handled through the card. Basically the CHIP on the card is asked if the entered PIN is valid and the chip is responsible for authorizing it, not some remote system that needs to be verified with.

    While retailers could hack their terminal to swipe PINs, they would
    • Re: (Score:2, Informative)

      by oliverthered (187439)
      the card never leaves the direct control of the card holder

      Try shopping in sainsburys, they swipe the card in their own machine then get you to enter the pin number in the chip and pin thingy.
      • by badfish99 (826052)
        Actually that's true of Tesco: they have a policy of "the cashier always takes the card from the customer and swipes it", and they've actually crippled the pin-pads that they present to the customer so that if you insert you card into them, it doesn't work.
        Sainsburys have the same policy, but haven't crippled their pin-pads, so if you just ignore the cashier trying to grab your card, and put into the pin-pad instead, it works fine.
      • They used to do that at my local Sainsbury's, but they stopped a few months ago. Now they always get the customer to swipe/insert the card (into the appropriate slot on the keypad terminal). Even Nectar cards too.
      • by Tony Hoyle (11698)
        Nearly every retailer does this.

        There's pretty much no security when that's happening, because all communication must be going from the till to the chip/pin device, and we only have the banks word for it that there's any security there, that it's not vulnerable to replay attacks, etc.

        The system was designed and promoted to have single unit that both read the card and the pin. That wasn't what was deployed.
    • by _damnit_ (1143)
      I was in Newcastle-upon-Tyne for three weeks last year for work and found the "Chip-and-Pin" to be a pain in the ass when you don't have a Chip-and-Pin card. I found quite a few places with new rules which forbade using cards without Chip-and-Pin! If you come in from another country which does not have Chip-and-Pin, you are screwed. Credit Cards have become the new international currency (backed by various government species). They should be very careful about changes that make some countries incompatib
    • Re: (Score:2, Funny)

      by breckinshire (891764)
      Being an American living in Britian, Chip & PIN makes a lot of sense.
      It's true what they say. British food really IS terrible.
      • I was in Madrid for the IWP [escet.urjc.es] and while we were out in an international group looking for somewhere nice to eat I asked our native resident "if there were any good English restaurants in town?". Much to the guffawing of the others and myself.

        Though that did get me thinking about what would that even be serving if such a thing existed.

        As Naomi Campbell said [plainenglish.co.uk] "I love England, especially the food. There's nothing I like more than a lovely bowl of pasta."
    • This isn't that impressive of a hack. Basically they made their own machine and put it in a Magic 6000 box. They don't even show PIN or CC# capture in the video. Even if they did show that, they aren't able to dupe a chip and PIN card. The worst they might be able to do it create a magstripe card, which isn't nearly as useful.

      Basically all this shows is that you can rip the guts out of a Magic 6000 without making significant changes to the top surface of the machine.
  • The real problem (Score:3, Interesting)

    by Generic Guy (678542) on Monday January 08, 2007 @12:20PM (#17509282)

    The real problem I see here is that new technology is presented as "unbreakable" then allows the business interests to ignore victims of fraud. In the U.S. we've already seen this happen with the special chipped keys for new vehicles. The auto makers insisted the technology was unbreakable, and the insurance companies responded in kind by denying theft claims from those victims unfortunate enough to have purchased a vehicle with one of these chipped keys.

    I'm sure the banks are ready to further punish any victims of this broken "unbreakable" bank card system. I'm not British, so I don't know how applicable this is in the UK, but I imagine it is still a problem.

  • liability shifty (Score:5, Insightful)

    by apodyopsis (1048476) on Monday January 08, 2007 @12:21PM (#17509304)
    What annoyed me was the shift in liability. The old fashioned "swipe and sign" cards, if they were compromised and somebody nicked your cash then the banks could be held liable and some remittance sought. However - with the new system there is an automatic assumption that you have given your PIN away and hence its your fault and you can he held liable. So if somebody stands behind you, watches you type in your PIN and then follows you outside, mugs you and steals your card - then you can be held liable for not taking care of your PIN number. Also the system seems quite unreliable even now.
    • Re: (Score:2, Informative)

      by iamdjsamba (1024979)
      Actually, I think quite wrong.

      With the original swipe system, the liability was with the bank; If you got frauded, then the bank had to re-emburse you. With the introduction of chip and pin, this remained the same; If you're chip and pin is frauded then the bank is still liable. FYI, if your swipe is frauded, it is now the place the fraud happened (e.g. the shop) that is liable, something that was introduced to basically force most companies to change over.

      I can verify that the bank take liability, as

    • Re: (Score:3, Interesting)

      by kebes (861706)
      As another poster pointed out, this concept is widespread in Canada. It's called INTERAC and it's so widespread that you can almost not even carry cash.

      In my experience the fraud protection has been really good. If your PIN or card details are stolen, any money lost is reimbursed by the bank. Moreover, when they detect that a retailer is stealing card numbers somehow (which they detect using a program to analyze log files and look for inconsistencies, etc.), they immediately cancel the cards of anyone who u
      • by sholden (12227)

        In my experience the fraud protection has been really good. If your PIN or card details are stolen, any money lost is reimbursed by the bank. Moreover, when they detect that a retailer is stealing card numbers somehow (which they detect using a program to analyze log files and look for inconsistencies, etc.), they immediately cancel the cards of anyone who used that retailer, and contact the customers to let them know a new card is in the mail.

        And you just hope you aren't on vacation on the other side of th

  • by boa13 (548222)
    First, we've been using chip-and-pin smartcard-based credit and debit cards for years in France, without significant problems. Of course, there's been a few researchers here and there claiming to have broken part of the cards security, sometimes rightly so. However, the system has remained quite sturdy considering the huge amount of transactions done every day.

    I type my PIN almost every time I use my card, and I use my card a lot. Cheques are an almost exctinct species here. It's money or card, mostly. The
    • by 56ker (566853)
      this bank account pin number? Does this mean that in England they have some kind of all-powerful PIN that unlocks whole bank accounts? In France the PIN is specific to the card, the bank wouldn't know w

      For internet and telephone banking there is a 6-10 digit number (at least with HSBC) chosen by the account holder for verification.

      Once you have someone's DOB, bank security number you can basically do anything with the account (eg wire the money anywhere else in the world). They usually ask for three digits
  • by creimer (824291) on Monday January 08, 2007 @12:28PM (#17509410) Homepage
    Anyone tampering with one of these machines will be caught by one of Britain's numerous public security cameras, promptly arrested and beaten senseless before being throw into the drunk tank with an American dick named Sue. The banks are correct that tampering can only happen in an controlled environment.
  • http://www.etv.tudelft.nl/vereeniging/archief/lus t rum/90/english.html [tudelft.nl] was the Guiness book of records attempt by the faculty of Electrical Engineering at Delft University of Technology in the Netherlands.

    I was there and it was absolutely hilarious :) Although walking through the corridors was a slight bit of a problem with all the cables lying there.

    Great stuff for those interested in Tetris :)
  • I'm 24, live in the UK, and I have no credit or debit cards. All I have is a savings account card for the classic 'hole in the wall' money system. Shell (the petrol station) removed their Chip and Pin facilities for 3 months because of security concerns. Think I'll stick with cash for my purchases in the future.
  • PIN Number? (Score:2, Funny)

    by Tau Neutrino (76206)
    Yeah, that's what I use at the ATM machine when I want to drive my SUV vehicle to the store and buy some DIMM modules. I'm working on a device to detect the HIV virus, but a I need a good TLA acronym to call it.
  • There have been cases in the US where thieves have gone as far as setting up real ATM's in places like shopping malls in order to con people out of their bank cards & PIN's. They just buy/steal a machine like you see in a convenience store, rig it so that it looks like it's working but displays an error message instead of dispensing cash, then wait for people to try to use it. It records the bank card info & PIN's that are entered, so when the crooks come and retrieve the machine they have a bunch
    • Re: (Score:2, Informative)

      by apodyopsis (1048476)
      Its not actually that easy.

      Yes, you can get the PIN that method, but unless you can actaully handshake with the EMV chip you have absolutly zero chance of getting the bank details. In the UK certainly the chip readers do now actually have the option to confiscate the card so a fake mini-EPOS terminal is not going to work.

      Your idea about using a real EMV EPOS terminal is a non starter as most of them are not allowed to do offline transactions - so you'd need an account and access codes to be able to us
  • "Steven Murdoch and myself took the chassis of a real terminal and replaced much of the internal electronics such that it allows us to control the screen, keypad and card-reader"

    Umm , how exactly does that prove the actual terminal is vulnerable? Other than if you get hold of one and have some tools at hand and lots of time then yes you can open the lid and get to the electronics inside. But I think we all knew that already.

    This is a non-event.
  • Personal Identification Number Number?

    Why not PINN number, or PINNN Number?

    I'm sure they enter their "PIN Number" into the "ATM Machine".
  • Debit Cards (Score:5, Informative)

    by Lodragandraoidh (639696) on Monday January 08, 2007 @12:46PM (#17509634) Journal
    In the US we have debit cards that operate as both an ATM card, and equivalent to a credit card - only drawing the cash from the bank account instead of a line of credit.

    So - the only time I have to enter my pin number is at the ATM. For all other purchases I use it like a credit card (and save the ATM surcharge as well).

    • I live in the UK. Even though I enter my PIN at loads of terminals every day, I'd argue that we're better off with Chip + Pin. There are a number of great posts about the technical details of why Chip + Pin is more secure, but it's easy to see the advantages with an example from just a few weeks ago...

      My sister (in the US) had her purse stolen recently and the thieves racked up a few thousand dollars of purchases in under an hour (she reported the loss just 40 minutes after she left her bag behind). With
  • Forget about the PIN (Score:2, Informative)

    by carvalhao (774969)

    In Portugal we had an attempt on a similar technology back in the middle 90's, called PMB ("Porta Moedas Multibanco", which translates roughly into "ATM Wallet").

    It was basically a smart-card you could load with a certain amount on any ATM and make payments anywhere a terminal existed (many vending machines, for instance, accepted PMB) without inserting any code whatsoever. So it basically replaced your wallet, if someone stole it the money still loaded in the card would be lost.

    This wasn't much of a pr

  • Meh... If replacing the electronics inside a device counts as a demonstration that
    the device is "unsafe", then can never be a "safe" device.

    Its like taking a Volvo, swapping the accelerator with the brake, and then declaring
    that Volvo's are inherently unsafe.

    I still haven't seen evidence of the tamperer's acquiring possesion of credit
    card info -- which is really the issue at hand.

  • there are multiple reasons why this exercise is meaningless:

    1: they cannot authorise the transaction using this method so the customer wouldn't be able to pay for what they intended to buy. The second a chip and pin card reader is opened and modification is attempted, it bricks itself. This would mean it's impossible to modify the internals and still enable the reader to contact a bank. Shops would notice pretty fast if lots of people were stealing goods and getting someone to swipe the card in two differ

  • I visited UK this past Summer and had two different incidences where the (admittedly) very young waitresses didn't know how to handle my old fashioned American credit card. They kept sticking it into the chip and pin terminal and telling me it wouldn't work.

    Amazing it's only three years old and already so integrated into society there.

    Can someone with a chip and pin card from UK use it like a regular credit card in the US (where there are no chip and pin terminals)? Seems a bit ridiculous to me to be

It's time to boot, do your boot ROMs know where your disk controllers are?

Working...