New flaws in chip and PIN system revealed

Most of us do not think twice about paying for something in a high street shop by keying in our pin. It is easy, fast and in most cases it works.
But scratch a little under the surface and there are persistent reports of people who say they have been the subject of fraud of one kind or another on their credit or debit card.
Now a team of computer scientists at Cambridge University has found a flaw in chip and pin so serious they think it shows that the whole system needs a re-write.

Category:

Education

Tags:

• chip & PIN
• security
• banking
• cards
• EMV
• Cambridge

[managerofwealth]

Oh my God...

[MrCcmaster]

CC SELLER 2011 Fresh Cheap Cv Always in stock Us , EU , UK , CN database of COB's, Full Info, CVV's - include original track1/track2, also have some with card holder info CVVs - include CC#, CVV2, EXP.DATE, full name, full address. y service is well-known, and verified at carding forums. 1 Visa card 2$ 1 master card 2$ 1 amex card 4$ 1 Dicover card 4$ 1 Company card 8$ 1 Uk Card Nornal CC 10 $ 1 Uk Card With DOB 20$ 1 Track 1& 2 CC 30$ MASTER and VISA BIN contact me at ccmasterseller@yahoo.com

[138NProgress]

@vitalgroup711 hey message me

[lennieb78]

I really like how the laptop had a OpenBSD/OpenSSH sticker on it. :-)

[mankinPT]

These guys only managed to cheat a half strength OFFLINE (low value purchase) implementation of EMV. ARQC is for online transactions, if memory serves me right.

[Oliprof]

@mankinPT even then the bank themselves can check the ARQC and will know the cryptogram was generated without successful PIN entry, I'd like to see these guys walk into a jewellers and try this trick out to see if the card issuer's backend systems will authorise a 3 or 4 figure PIN-bypass transaction, because I'm betting not.

[vitalgroup711]

I have Track2 of US and Euro skimmed for list My ICQ235591933

[mankinPT]

Also this flaws are documented by issuers (making the cambridge study a real joke).

NOW, you may ask that I said there were 3 implementations. YES, the stronger of the 3 solves the problem of this attack. Why then doesnt the card issuers implement this? Simple Cost vs Risk.

Conclusion Blame the banks not EMV!!

P.S. Lame Study, yes I have read it. Does not even mention that this flaw is intended on the design, again Cost vs Risk, EMV was designed to be flexible.

[mankinPT]

First let me say I work in the business.

This "flaw" I not really a flaw. Let me explain, EMV offers various degrees of security, more precisely 3 types. The 2 weakest types of security are easier to implement (cheaper), but offer holes, replay attacks in case of static certificates, and man in the middle for simple dynamic certificate (The case of the study of this guys).

This "flaws" are part of the design to exist,its a trade off between price vs security.