Security researchers are eager to poke holes in the chip-embedded credit and debit cards that have arrived in Americans' mailboxes over the last year and a half. Although the cards have been in use for a decade around the world, more brains trying to break things are bound to come up with new and inventive hacks. And at last week's Black Hat security conference in Las Vegas, two presentations demonstrated potential threats to the security of chip cards. The first involved fooling point-of-sale (POS) systems into thinking that a chip card is a magnetic stripe card with no chip, and the second involved stealing the temporary, dynamic number generated by a chip card and using it in a very brief window of time to request money from a hacked ATM.
Double trouble Chip card technology―often called EMV for EuroPay, MasterCard, and Visa for the three companies that developed the chip card standard―is supposed to offer significant security benefits over the old magnetic stripe card system. Magnetic stripe cards have a static card number written into their magnetic stripe, and if a POS system is infected with malware, as was the case in theinfamous Target and Home Depot hacks, then a malicious actor can take those card numbers and make counterfeit purchases with them. An EMV card, by contrast, uses a chip to transmit a dynamic number that changes with each purchase. That makes it a lot harder to steal a card number and reuse it elsewhere.
But that doesn’t mean it’s impossible. Late last year, security researcher Samy Kamkar demonstrated that he could calculate a replacement American Express card number based on the previous card number,replicate the credit card’s magnetic stripe information on a programmable chip, and use it to make purchases around town, much like the now-defunct Coin card . Kamkar was even able to do this with chip cards―the magnetic stripe on the back of every card has two tracks of data that tell card readers information like cardholder name, the card’s number, its expiration date, etc. Track 2 data will tell a card reader if the card has a chip and needs to be dipped―otherwise it can be swiped. Kamkar’s solution was to alter the Track 2 data and spoof the card reader to tell it that the card only has a magnetic stripe, no chip, thus bypassing the entry of a dynamic number.
Last week at BlackHat, two researchers from NCR Corporation, which makes ATM and card reader hardware, performed a similar hack (PDF) that allowed an EMV card to be read as a magnetic stripe card with a static number. The researchers, Nir Valtman and Patrick Watson, showed that if a malicious actor can take control of the information flowing from an external PIN pad (i.e., a card reader not connected to an ATM), then that person can present a duplicate card with altered Track 2 data telling the POS system that the PIN pad has received a card that doesn’t have a chip in it, even if it does.
Aaron Gould, a spokesperson for NCR, told Ars via e-mail, “There are only a few scenarios in which the altered copy [of the chip card] would work.” Ifthe transaction happens online, which most in the US do these days (PDF), the issuer will know if its card should be a chip card or not and could deny a transaction from a mag stripe card. But if the transaction happens offline ―which does still occur, leaving the POS to queue transactions until they can be transferred to the issuer―then this hack has the potential to work.Valtman and Watson have clarified that altering Track 2 data to spoof a PIN pad and POS to think that they’re receiving information from a mag stripe card instead of a chip card isn’t really breaking how EMV works as much as it’s relying on an already-broken mag stripe system and an inconsistent rollout of EMV.
A spokesperson for EMVCo, the member-owned consortium that manages EMV specifications and their rollout, said in a statement that Valtman and Watson’s attack “relies on magstripe information and not the EMV chip. It is EMVCo’s view that when the full payment process is taken into account, suitable protection exists to mitigate against this type of attack, such as ensuring that information read from a chip card is not sufficient to create a valid magstripe card.”
In other words, to make and use a duplicate EMV card for fraud, hackers would have to find a way to get magnetic stripe information corresponding to that card in the first place, because just scraping dynamic numbers from EMV chips won’t be enough to reconstruct magnetic stripe data.
Valtman and Watson also demoed other ways that they could take advantage of card holders at a checkout terminal. They showed that if the security between the PIN pad and the POS is weak, they could compromise the traffic passing between them to prompt card holders to reenter their PINs so that man-in-the-middle attackers could snap them up or even prompt unsuspecting cardholders to enter their CVV (found on the back of the card and used for fraudulent purchases online) into the compromised PIN pad.
“At a high level, some PIN pads are not properly authenticating that it is receiving instructions from the real POS instead of from an attacker,” Gould said to Ars.
This takes advantage of the level of confusion that has been bakedinto the payment process since chip cards were introduced in the US. Customers are becoming accustomed to getting odd demands from the PIN pad―should I insert the card or swipe? Will I need to enter a PIN or will I be asked for a signature? If you complete any step wrong, the card reader will prompt you to try again. Imagine a card reader prompting you to re-enter a PIN. Would you think anything of it? Or if a card reader asked you for your CVV. Surely that would seem more suspicious, but if your kids are crying and the line behind you is growing and the new card reader is prompting you to input your CVV or you can’t pay with that card, would you just do it or would you ask to see a manager? For many people, the answer would likely be the former.
To remedy this, Valtman and Watson recommended that traffic from PIN pads to POS systems be encrypted (a self-serving if rational conclusion, as their company NCR develops hardware and software to address such issues. According to the blog PYMNTS , "Terminal makers Ingenico and Verifone both affirm that they offer point-to-point encryption, but also note that retailers and their partners must choose to turn it on." In some cases, retailers have to pay extra to encrypt traffic from the card reader to the POS.
Valtman and Watson also suggested that a more secure way to interact with card readers would be to use a mobile payment platform like Android Pay or Apple Pay, due to their reliance on tokenization (which disguises a true card number) and the fact that they can transmit a unique Track 2 code for each transaction.
A more difficult hack, a more dangerous hack While the previous h
