NDLI: Harvesting High Value Foreign Currency Transactions from EMV Contactless Credit Cards Without the PIN

Please wait, while we are loading the content...

Founding Digital Currency on Secure Computation

Code Reuse Attacks in PHP: Automated POP Chain Generation

Rosemary: A Robust, Secure, and High-performance Network Operating System

Private-by-Design Advertising Meets the Real World

DeTrust: Defeating Hardware Trust Verification with Stealthy Implicitly-Triggered Hardware Trojans

SCORAM: Oblivious RAM for Secure Computation

A Systematic Approach to Developing and Evaluating Website Fingerprinting Defenses

Optimal Average-Complexity Ideal-Security Order-Preserving Encryption

Routing Bottlenecks in the Internet: Causes, Exploits, and Countermeasures

Multi-Ciphersuite Security of the Secure Shell (SSH) Protocol

Watching the Watchers: Automatically Inferring TV Content From Outdoor Light Effusions

Dialing Back Abuse on Phone Verified Accounts

(Nothing else) MATor(s): Monitoring the Anonymity of Tor's Path Selection

Breaking Integrated Circuit Device Security through Test Mode Silicon Reverse Engineering

Reuse It Or Lose It: More Efficient Secure Computation Through Reuse of Encrypted Values

Detection of On-Road Vehicles Emanating GPS Interference

Optimizing Obfuscation: Avoiding Barrington's Theorem

The Web Never Forgets: Persistent Tracking Mechanisms in the Wild

Exciting Security Research Opportunity: Next-generation Internet

Security Analysis of the Estonian Internet Voting System

Increasing Security Sensitivity With Social Proof: A Large-Scale Experimental Confirmation

Vulnerability and Protection of Channel State Information in Multiuser MIMO Networks

Taking Authenticated Range Queries to Arbitrary Dimensions

Wiretapping via Mimicry: Short Voice Imitation Man-in-the-Middle Attacks on Crypto Phones

Clubbing Seals: Exploring the Ecosystem of Third-party Security Seals

Quantifying Web-Search Privacy

Characterization of Real-Life PRNGs under Partial State Corruption

Structural Data De-anonymization: Quantification, Practice, and Implications

Automating Information Flow Analysis of Low Level Code

Semantics-Aware Android Malware Classification Using Weighted Contextual API Dependency Graphs

PixelVault: Using GPUs for Securing Cryptographic Operations

Privacy Beyond Confidentiality

Fail-Secure Access Control

Multi-Stage Key Exchange and the Case of Google's QUIC Protocol

S3: A Symbolic String Solver for Vulnerability Detection in Web Applications

System-level Non-interference for Constant-time Cryptography

RockJIT: Securing Just-In-Time Compilation Using Modular Control-Flow Integrity

A Tale of Two Kernels: Towards Ending Kernel Hardening Wars with Split Kernel

POSTER: When and How to Implicitly Authenticate Smartphone Users

Integrity, Consistency, and Verification of Remote Computation

Summary Abstract for the 7th ACM International Workshop on Cyber Security Analytics, Intelligence and Automation

Deanonymisation of Clients in Bitcoin P2P Network

Information Leaks Without Memory Disclosures: Remote Side Channel Attacks on Diversified Code

Hypervision Across Worlds: Real-time Kernel Protection from the ARM TrustZone Secure World

Your Online Interests: Pwned! A Pollution Attack Against Targeted Advertising

ATRA: Address Translation Redirection Attack against Hardware-based External Monitors

Toward Robust Hidden Volumes Using Write-Only Oblivious RAM

Location Privacy Protection for Smartphone Users

A New Additive Homomorphic Encryption based on the co-ACD Problem

VoIP Fraud: Identifying a Wolf in Sheep's Clothing

ARPKI: Attack Resilient Public-Key Infrastructure

Acoustic Fingerprinting Revisited: Generate Stable Device ID Stealthily with Inaudible Sound

Uncovering Large Groups of Active Malicious Accounts in Online Social Networks

Deniable Liaisons

ARMlock: Hardware-based Fault Isolation for ARM

Practical UC security with a Global Random Oracle

On The Security of Mobile Cockpit Information Systems

Fully Secure and Fast Signing from Obfuscation

MACE: Detecting Privilege Escalation Vulnerabilities in Web Applications

Harvesting High Value Foreign Currency Transactions from EMV Contactless Credit Cards Without the PIN

Are You Ready to Lock?

Blind Transmitter Authentication for Spectrum Security and Enforcement

Outsourced Proofs of Retrievability

Context-Based Zero-Interaction Pairing and Key Evolution for Advanced Personal Devices

A Nearly Four-Year Longitudinal Study of Search-Engine Poisoning

Mayhem in the Push Clouds: Understanding and Mitigating Security Hazards in Mobile Push-Messaging Services

Synthesis of Fault Attacks on Cryptographic Implementations

RAPPOR: Randomized Aggregatable Privacy-Preserving Ordinal Response

Collaborative Verification of Information Flow for a High-Assurance App Store

An Epidemiological Study of Malware Encounters in a Large Enterprise

Hey, NSA: Stay Away from my Market! Future Proofing App Markets against Powerful Attackers

World-Driven Access Control for Continuous Sensing

Algebraic MACs and Keyed-Verification Anonymous Credentials

ClickMiner: Towards Forensic Reconstruction of User-Browser Interactions from Network Traces

Controlled Functional Encryption

Amandroid: A Precise and General Inter-component Data Flow Analysis Framework for Security Vetting of Android Apps

Beyond Pattern Matching: A Concurrency Model for Stateful Deep Packet Inspection

POSTER: Password Entering and Transmission Security

Tutorial: Text Analytics for Security

WPES 2014: 13th Workshop on Privacy in the Electronic Society

How to Use Bitcoin to Incentivize Correct Computations

Code Injection Attacks on HTML5-based Mobile Apps: Characterization, Detection and Mitigation

A11y Attacks: Exploiting Accessibility in Operating Systems

Characterizing Large-Scale Click Fraud in ZeroAccess

AUTOPROBE: Towards Automatic Active Malicious Server Probing Using Dynamic Binary Analysis

Oblivious Data Structures

Optimal Geo-Indistinguishable Mechanisms for Location Privacy

Verifying Curve25519 Software

Mechanized Network Origin and Path Authenticity Proofs

Securing SSL Certificate Verification through Dynamic Linking

Do You Hear What I Hear?: Fingerprinting Smart Devices Through Embedded Acoustic Components

Consequences of Connectivity: Characterizing Account Hijacking on Twitter

Community-Enhanced De-anonymization of Online Social Networks

The Last Mile: An Empirical Study of Timing Channels on seL4

A Computationally Complete Symbolic Attacker for Equivalence Properties

Real Threats to Your Data Bills: Security Loopholes and Defenses in Mobile Data Charging

ALETHEIA: Improving the Usability of Static Security Analysis

RevCast: Fast, Private Certificate Revocation over FM Radio

Efficiently Verifiable Computation on Encrypted Data

OAuth Demystified for Mobile Application Developers

From Patches to Honey-Patches: Lightweight Attacker Misdirection, Deception, and Disinformation

Cross-Tenant Side-Channel Attacks in PaaS Clouds

ShadowCrypt: Encrypted Web Applications for Everyone

PrivEx: Private Collection of Traffic Statistics for Anonymous Communication Networks

Decide Now or Decide Later?: Quantifying the Tradeoff between Prospective and Retrospective Access Decisions

Security Analyses of Click-based Graphical Passwords via Image Point Memorability

Moving Targets: Security and Rapid-Release in Firefox

Formatted Encryption Beyond Regular Languages

You Can Run but You Can't Read: Preventing Disclosure Exploits in Executable Code

The UNIX Process Identity Crisis: A Standards-Driven Approach to Setuid

POSTER: A Hybrid Botnet Ecological Environment

Client-Controlled Cloud Encryption

Fourth International Workshop on Trustworthy Embedded Devices (TrustED 2014)

A Critical Evaluation of Website Fingerprinting Attacks

Searchable Encryption with Secure and Efficient Updates

Security Vulnerability in Processor-Interconnect Router Design

PoliCert: Secure and Flexible TLS Certificate Management

Context-free Attacks Using Keyboard Acoustic Emanations

Faces in the Distorting Mirror: Revisiting Photo-based Social Authentication

ALITHEIA: Towards Practical Verifiable Graph Processing

Beware, Your Hands Reveal Your Secrets!

A Threat for Tablet PCs in Public Space: Remote Visualization of Screen Images Using EM Emanation

VerSum: Verifiable Computations over Large Public Logs

AutoCog: Measuring the Description-to-permission Fidelity in Android Applications

Blind Recognition of Touched Keys on Mobile Devices

POSTER: Analysis and Comparison of Secure Localization Schemes for Intelligent Transportation Systems

MTD 2014: First ACM Workshop on Moving Target Defense

POSTER: Positioning Attack on Proximity-Based People Discovery

WISCS 2014: The First ACM Workshop on Information Sharing & Collaborative Security

POSTER: Euclidean Distance Based Encryption: How to Embed Fuzziness in Biometric Based Encryption

SIW 2014: First Workshop on Security Information Workers

POSTER: Seven Years in MWS: Experiences of Sharing Datasets with Anti-malware Research Community in Japan

Workshop Summary of AISec'14: 2014 Workshop on Artificial Intelligent and Security

POSTER: Scanning-free Personalized Malware Warning System by Learning Implicit Feedback from Detection Logs

Second Smart Energy Grid Security Workshop (SEGS 2014)

POSTER: Compromising Cloaking-based Location Privacy Preserving Mechanisms with Location Injection Attacks

CCS'14 Co-Located Workshop Summary for SPSM 2014

POSTER: Security Control System Enabling to Keep an Intra-LAN in a Secure State Using Security-and-Performance Ratio Control Policies

CCSW 2014: Sixth ACM Cloud Computing Security Workshop

POSTER: Enhancing Security and Privacy with Google Glass

POSTER: Proactive Blacklist Update for Anti-Phishing

POSTER: Abusing URL Shortening Services for Stealthy and Resilient Message Transmitting

POSTER: A Lightweight Unknown HTTP Botnets Detecting and Characterizing System

POSTER: Arranging the Layout of Alphanumeric Buttons--the Role of Passwords

POSTER: Using Chinese Characters for Authentication--Algorithmic Framework and Empirical Results

POSTER: Study of Software Plugin-based Malware

POSTER: TraceVirt: A Framework for Detecting the Non-tampering Attacks in the Virtual Machine

POSTER: Fingerprinting the Publicly Available Sandboxes

POSTER: Recommendation-based Third-Party Tracking Monitor to Balance Privacy with Personalization

POSTER: A Proactive Cloud-Based Cross-Reference Forensic Framework

POSTER: Blind Separation of Benign and Malicious Events to Enable Accurate Malware Family Classification

Demo Overview: Privacy-Enhancing Features of IdentiDroid

POSTER: Android System Broadcast Actions Broadcasts Your Privacy

POSTER: TLS Proxies: Friend or Foe?

POSTER: Efficient Ciphertext Policy Attribute Based Encryption Under Decisional Linear Assumption

POSTER: Protecting Against Data Exfiltration Insider Attacks Through Application Programs

POSTER: Misuseablity Analysis for IT Infrastructure

POSTER: On the Resilience of DNS Infrastructure

POSTER: Quasi-ID: In fact, I am a human

POSTER: A Measurement Framework to Quantify Software Protections

POSTER: Analyzing Access Control Policies with SMT

POSTER: How Distributed Are Today's DDoS Attacks?

POSTER: AdHoneyDroid -- Capture Malicious Android Advertisements

POSTER: An E2E Trusted Cloud Infrastructure

POSTER: T-IP: A Self-Trustworthy and Secure Internet Protocol with Full Compliance to TCP/IP

POSTER: On the Capability of DNS Cache Poisoning Attacks

POSTER: LocMask: A Location Privacy Protection Framework in Android System

POSTER: UAFChecker: Scalable Static Detection of Use-After-Free Vulnerabilities

POSTER: Mining Elephant Applications in Unknown Traffic by Service Clustering

POSTER: Efficient Method for Disjunctive and Conjunctive Keyword Search over Encrypted Data

Harvesting High Value Foreign Currency Transactions from EMV Contactless Credit Cards Without the PIN

Content Provider	ACM Digital Library
Author	Arief, Budi Hannon, Joseph Freitas, Leo Emms, Martin van Moorsel, Aad
Abstract	In this paper we present an attack, which allows fraudulent transactions to be collected from EMV contactless credit and debit cards without the knowledge of the cardholder. The attack exploits a previously unreported vulnerability in EMV protocol, which allows EMV contactless cards to approve unlimited value transactions without the cardholder's PIN when the transaction is carried out in a foreign currency. For example, we have found that Visa credit cards will approve foreign currency transactions for any amount up to ∈999,999.99 without the cardholder's PIN, this side-steps the £20 contactless transaction limit in the UK. This paper outlines our analysis methodology that identified the flaw in the EMV protocol, and presents a scenario in which fraudulent transaction details are transmitted over the Internet to a "rogue merchant" who then uses the transaction data to take money from the victim's account. In reality, the criminals would choose a value between ∈100 and ∈200, which is low enough to be within the victim's balance and not to raise suspicion, but high enough to make each attack worthwhile. The attack is novel in that it could be operated on a large scale with multiple attackers collecting fraudulent transactions for a central rogue merchant which can be located anywhere in the world where EMV payments are accepted.
Starting Page	716
Ending Page	726
Page Count	11
File Format	PDF
ISBN	9781450329576
DOI	10.1145/2660267.2660312
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2014-11-03
Publisher Place	New York
Access Restriction	Subscribed
Subject Keyword	Foreign currency transaction limits Fraudulent transaction Contactless cards Rogue merchant Emv
Content Type	Text
Resource Type	Article

Central Library (ISO-9001:2015 Certified)
Indian Institute of Technology Kharagpur
Kharagpur, West Bengal, India | PIN - 721302

See location in the Map
03222 282435
Mail: support@ndl.gov.in

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in