NDLI: Chip and Skim: Cloning EMV Cards with the Pre-play Attack

Content Provider	IEEE Xplore Digital Library
Author	Bond, M. Choudary, O. Murdoch, S.J. Skorobogatov, S. Anderson, R.
Copyright Year	2014
Description	Author affiliation: Comput. Lab., Univ. of Cambridge, Cambridge, UK (Bond, M.; Choudary, O.; Murdoch, S.J.; Skorobogatov, S.; Anderson, R.)
Abstract	EMV, also known as "Chip and PIN", is the leading system for card payments worldwide. It is used throughout Europe and much of Asia, and is starting to be introduced in North America too. Payment cards contain a chip so they can execute an authentication protocol. This protocol requires point-of-sale (POS) terminals or ATMs to generate a nonce, called the unpredictable number, for each transaction to ensure it is fresh. We have discovered two serious problems: a widespread implementation flaw and a deeper, more difficult to fix flaw with the EMV protocol itself. The first flaw is that some EMV implementers have merely used counters, timestamps or home-grown algorithms to supply this nonce. This exposes them to a "pre-play" attack which is indistinguishable from card cloning from the standpoint of the logs available to the card-issuing bank, and can be carried out even if it is impossible to clone a card physically. Card cloning is the very type of fraud that EMV was supposed to prevent. We describe how we detected the vulnerability, a survey methodology we developed to chart the scope of the weakness, evidence from ATM and terminal experiments in the field, and our implementation of proof-of-concept attacks. We found flaws in widely-used ATMs from the largest manufacturers. We can now explain at least some of the increasing number of frauds in which victims are refused refunds by banks which claim that EMV cards cannot be cloned and that a customer involved in a dispute must therefore be mistaken or complicit. The second problem was exposed by the above work. Independent of the random number quality, there is a protocol failure: the actual random number generated by the terminal can simply be replaced by one the attacker used earlier when capturing an authentication code from the card. This variant of the pre-play attack may be carried out by malware in an ATM or POS terminal, or by a man-in-the-middle between the terminal and the acquirer. We explore the design and implementation mistakes that enabled these flaws to evade detection until now: shortcomings of the EMV specification, of the EMV kernel certification process, of implementation testing, formal analysis, and monitoring customer complaints. Finally we discuss countermeasures. More than a year after our initial responsible disclosure of these flaws to the banks, action has only been taken to mitigate the first of them, while we have seen a likely case of the second in the wild, and the spread of ATM and POS malware is making it ever more of a threat.
Starting Page	49
Ending Page	64
File Size	3549022
Page Count	16
File Format	PDF
ISBN	9781479946860
ISSN	10816011
DOI	10.1109/SP.2014.11
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2014-05-18
Publisher Place	USA
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Online banking Protocols Cryptography Authentication Radiation detectors Cloning Authorization
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Chip and Skim: cloning EMV cards with the pre-play attack (2014)

Chip and skim: cloning emv cards with the pre-play attack, announced at ches 2012.

Chip and Skim: cloning EMV cards with the pre-play attack

R.: Chip and skim: cloning EMV cards with the pre-play attack (2012)

R.: Chip and skim: cloning EMV cards with the pre-play attack (2012)

and Skim: cloning EMV cards with the pre-play attack. Computing Research Repository (CoRR), arXiv:1209.2531 [cs.CY (2012)

and skim: Cloning EMV cards with the pre-play attack (2014)

The implementation of a full EMV smartcard for a point-of-sale transaction

Enhancing EMV Online PIN Verification

Chip and Skim: Cloning EMV Cards with the Pre-play Attack

Similar Documents

Chip and Skim: cloning EMV cards with the pre-play attack (2014)

Chip and skim: cloning emv cards with the pre-play attack, announced at ches 2012.

Chip and Skim: cloning EMV cards with the pre-play attack

R.: Chip and skim: cloning EMV cards with the pre-play attack (2012)

R.: Chip and skim: cloning EMV cards with the pre-play attack (2012)

and Skim: cloning EMV cards with the pre-play attack. Computing Research Repository (CoRR), arXiv:1209.2531 [cs.CY (2012)

and skim: Cloning EMV cards with the pre-play attack (2014)

The implementation of a full EMV smartcard for a point-of-sale transaction

Enhancing EMV Online PIN Verification

Chip and Skim: Cloning EMV Cards with the Pre-play Attack