Security researchers are eager to poke holes in the chip-embedded credit and debit cards that have arrived in Americans' mailboxes over the last year and a half. Although the cards have been in use for a decade around the world, more brains trying to break things are bound to come up with new and inventive hacks. And at last week's Black Hat security conference in Las Vegas, two presentations demonstrated potential threats to the security of chip cards. The first involved fooling point-of-sale (POS) systems into thinking that a chip card is a magnetic stripe card with no chip, and the second involved stealing the temporary, dynamic number generated by a chip card and using it in a very brief window of time to request money from a hacked ATM.
Double trouble
Chip card technology—often called EMV for EuroPay, MasterCard, and Visa for the three companies that developed the chip card standard—is supposed to offer significant security benefits over the old magnetic stripe card system. Magnetic stripe cards have a static card number written into their magnetic stripe, and if a POS system is infected with malware, as was the case in the infamous Target and Home Depot hacks, then a malicious actor can take those card numbers and make counterfeit purchases with them. An EMV card, by contrast, uses a chip to transmit a dynamic number that changes with each purchase. That makes it a lot harder to steal a card number and reuse it elsewhere.But that doesn’t mean it’s impossible. Late last year, security researcher Samy Kamkar demonstrated that he could calculate a replacement American Express card number based on the previous card number, replicate the credit card’s magnetic stripe information on a programmable chip, and use it to make purchases around town, much like the now-defunct Coin card. Kamkar was even able to do this with chip cards—the magnetic stripe on the back of every card has two tracks of data that tell card readers information like cardholder name, the card’s number, its expiration date, etc. Track 2 data will tell a card reader if the card has a chip and needs to be dipped—otherwise it can be swiped. Kamkar’s solution was to alter the Track 2 data and spoof the card reader to tell it that the card only has a magnetic stripe, no chip, thus bypassing the entry of a dynamic number.
Last week at BlackHat, two researchers from NCR Corporation, which makes ATM and card reader hardware, performed a similar hack (PDF) that allowed an EMV card to be read as a magnetic stripe card with a static number. The researchers, Nir Valtman and Patrick Watson, showed that if a malicious actor can take control of the information flowing from an external PIN pad (i.e., a card reader not connected to an ATM), then that person can present a duplicate card with altered Track 2 data telling the POS system that the PIN pad has received a card that doesn’t have a chip in it, even if it does.
Aaron Gould, a spokesperson for NCR, told Ars via e-mail, “There are only a few scenarios in which the altered copy [of the chip card] would work.” If the transaction happens online, which most in the US do these days (PDF), the issuer will know if its card should be a chip card or not and could deny a transaction from a mag stripe card. But if the transaction happens offline—which does still occur, leaving the POS to queue transactions until they can be transferred to the issuer—then this hack has the potential to work.
Valtman and Watson have clarified that altering Track 2 data to spoof a PIN pad and POS to think that they’re receiving information from a mag stripe card instead of a chip card isn’t really breaking how EMV works as much as it’s relying on an already-broken mag stripe system and an inconsistent rollout of EMV.
A spokesperson for EMVCo, the member-owned consortium that manages EMV specifications and their rollout, said in a statement that Valtman and Watson’s attack “relies on magstripe information and not the EMV chip. It is EMVCo’s view that when the full payment process is taken into account, suitable protection exists to mitigate against this type of attack, such as ensuring that information read from a chip card is not sufficient to create a valid magstripe card.”
In other words, to make and use a duplicate EMV card for fraud, hackers would have to find a way to get magnetic stripe information corresponding to that card in the first place, because just scraping dynamic numbers from EMV chips won’t be enough to reconstruct magnetic stripe data.
Valtman and Watson also demoed other ways that they could take advantage of card holders at a checkout terminal. They showed that if the security between the PIN pad and the POS is weak, they could compromise the traffic passing between them to prompt card holders to reenter their PINs so that man-in-the-middle attackers could snap them up or even prompt unsuspecting cardholders to enter their CVV (found on the back of the card and used for fraudulent purchases online) into the compromised PIN pad.
“At a high level, some PIN pads are not properly authenticating that it is receiving instructions from the real POS instead of from an attacker,” Gould said to Ars.
This takes advantage of the level of confusion that has been baked into the payment process since chip cards were introduced in the US. Customers are becoming accustomed to getting odd demands from the PIN pad—should I insert the card or swipe? Will I need to enter a PIN or will I be asked for a signature? If you complete any step wrong, the card reader will prompt you to try again. Imagine a card reader prompting you to re-enter a PIN. Would you think anything of it? Or if a card reader asked you for your CVV. Surely that would seem more suspicious, but if your kids are crying and the line behind you is growing and the new card reader is prompting you to input your CVV or you can’t pay with that card, would you just do it or would you ask to see a manager? For many people, the answer would likely be the former.
To remedy this, Valtman and Watson recommended that traffic from PIN pads to POS systems be encrypted (a self-serving if rational conclusion, as their company NCR develops hardware and software to address such issues. According to the blog PYMNTS, "Terminal makers Ingenico and Verifone both affirm that they offer point-to-point encryption, but also note that retailers and their partners must choose to turn it on." In some cases, retailers have to pay extra to encrypt traffic from the card reader to the POS.
Valtman and Watson also suggested that a more secure way to interact with card readers would be to use a mobile payment platform like Android Pay or Apple Pay, due to their reliance on tokenization (which disguises a true card number) and the fact that they can transmit a unique Track 2 code for each transaction.
A more difficult hack, a more dangerous hack
While the previous hacks don’t really break EMV as much as they fall back on the weaknesses of magnetic stripe technology, researchers at security firm Rapid7 demonstrated a hack that really does undermine the protections that EMV confers.
Much like Valtman and Watson’s hack, Rapid7 also exploited the card reader. It placed a shim between the card reader and a demo POS, reading the dynamic card number that the chip generates for that transaction and transmitting the number instantaneously to a hacker at a remote location. That stolen randomized chip card number expires quickly, so hackers have to work fast.
The Rapid7 researchers demonstrated their hack on a compromised ATM, although a hacker could use the stolen number to make a one-time purchase on a smartphone, for instance. On the ATM demo, the researchers broke open an ATM and fed it the skimmed number, programming it to request money with the number.
The hack is certainly more complicated than the malware that stole numbers from Target and Home Depot—it requires physical access to a card reader and, to recreate the ATM hack, unfettered access to an ATM (which is not always a huge limitation, especially in countries where ATM hacking is more prevalent, as this study on ATM hacks showed us). But the short window of time that hackers have to make any purchases or money requests also limits the amount of damage they could do.
In a statement, EMVCo’s spokesperson responded to this hack saying that “it is EMVCo’s view that an attack of this nature would be extremely difficult and risky to deploy in the real world and is not practically scalable. Even if such an attack were to occur, when the full payment process is taken into account, various countermeasures are available to mitigate against this type of attack.”
Still, demonstrating that such an attack could happen means a more creative and advanced way to carry out such an attack may still be out there. Certainly, we saw a similarly creative and successful EMV hack years ago in France, when a crime ring stole EMV cards and doctored them with custom chips that accepted any PIN at a register. Here in the US, we may just be scraping the surface of possible ways to break EMV.
Listing image by eBay
reader comments
111