Steven Murdoch

Chip and Skim: cloning EMV cards with the pre-play attack

11 Sep, 2012 15:04

The EMV (Chip & PIN) protocol requires ATMs and point-of-sale terminals to generate a random number. If this number (known in EMV terminology as the "unpredictable number") isn't random, Chip & PIN is left vulnerable to the "pre-play" attack, which is indistinguishable from card cloning to the bank which issued the card. In the course of investigating a fraudulent transaction, for which the bank had refused to reimburse the victim, we discovered that ATM random number generators, across some of the biggest brands, have serious flaws.

By modifying a Chip & PIN card, and by reverse engineering ATM firmware, we analysed random number generators, finding a variety of different types of failures. The results of the survey can be found in our blog post and academic paper, announced at CHES 2012 today.

See also coverage in the FT and Information Age.

Adapted smart card for collecting random numbers from ATMs

Comments

Added: 12 September, 2012 - 14:04 | Finextra member says:

Wow. Waiting for the defence of EMV. As you say - has far reaching legal implications for non-repudiation. One thing - you still have to steal the card/chip, yes? You can only (possibly) clone a valid transaction, not the chip itself?

0 thumb ups! (Log in to thumb up)

Added: 12 September, 2012 - 14:35 | Steven Murdoch - University of Cambridge - Cambridge

You don't have to steal the card, just have temporary access to it. This could be achieved by asking the customer to use the card in a tampered Chip and PIN terminal. The cryptograms could be collected either instead of the legitimate transaction, or in addition to it. Then the cryptograms could be pre-played to a vulnerable ATM or point of sale terminal.

The attack could alternatively be done by stealing the card. For example, someone could take the card, collect cryptograms, then return it. In some situations this might work better, because the customer will take longer to notice the fraud and cancel the card.

If the criminal doesn't plan to return the card, then he might as well just use the genuine one rather than a pre-play clone.

0 thumb ups! (Log in to thumb up)

Added: 12 September, 2012 - 23:14 | Alexander Peschkoff - TEDIPAY - London

That Cambridge group are great at penetration testing (and they keep their legal department busy too - their work upsets many players in the industry, but that's a separate can of worms...) Add Contactless EMV to that equation and the picture gets even more serious. As Square clearly explained (to Verione) - consumers cannot (and should not be asked to!) tell whether a POS terminal is secure. Hence, they will happily present their cards to any terminal that sits on the counter. Possible solution, at least for ATMs - UNs must be generated by the issuers direct. The "rails" are already in place for that, in most cases (amending EMV protocol is a totally different story, though).

0 thumb ups! (Log in to thumb up)

Added: 13 September, 2012 - 15:58 | Nick Collin - Collin Consulting Ltd - London

Let's put this in perspective. Number of successful EMV chip transactions worldwide - about 150 billion per year. Number of proven instances of this type of pre-play attack - zero. Realistic liklihood of this type of attack - close to zero. Reduction in card fraud due to EMV chip - about £1 billion per year in the UK alone. The positives somewhat outweigh the negatives I think! But yes, it's a theoretical implementation weakness which can be easily fixed, so a useful addition to EMV deployment best practice.

1 thumb up! (Log in to thumb up)

Comment on this blog Report abuse Recommend this blog post

Facebook

LinkedIn Digg Send story

Next blog from Steven Murdoch UK Cards Association attempt to supress Cambridge research

Next from the Information Security group is from Uri Rivner The Tricia Bennett Mystery