Further to an earlier blog about the "broken" Chip & PIN credit card security system (strictly speaking, the primary problem described is with EMV), it's noticeable that, as John Leyden puts it, "Industry groups [have] leap[t] to Chip and PIN's defence."
In fact, the response has been a bit more mixed than that. But there have certainly been cries of "alarmist" and "not proven." Well, I don't think the Cambridge group ever said that chip & PIN is so broken that those of us who are using the system should stop using our credit cards right now until it's fixed. The attack described is a very specific physical attack, and it's generally conceded that in general, chip & PIN has reduced the impact of physical attacks where it's been employed.
It's not a matter of proven fact that such attacks have been employed, either.
I have yet to see proof that they're not possible, though, and that is where the banks are, as Jay Abbott is quoted as saying, on shakier ground.
Steven J. Murdoch is quoted at some length in the article, and the following extract is worth repeating:
There is a message authentication code (MAC) calculated over various transaction-related data items, including the result of PIN verification. This cannot be checked by the terminal, but can be checked by the bank which issued the card. However, it seems that banks do not detect the inconsistency. The settlement logs, which come from the terminal, will show that the PIN has been verified successfully, when the attack we proposed is used. These logs are used for dispute resolution, so I think it is quite reasonable to conclude that the bank will have evidence which shows that the correct PIN was used, even if this is wrong.
In another disputed withdrawal case I dealt with, the bank presented the merchant receipts as evidence against the customer. Again, these will (incorrectly) show that the correct PIN was used, if our attack was used.
Unfortunately, the fact that the attack seems to be possible seems to me to deserve a better response than "we know what we're doing and it isn't possible."
David Harley CISSP FBCS CITP
Director of Malware Intelligence
ESET Threatblog (TinyURL with preview enabled): http://preview.tinyurl.com/esetblog
ESET Threatblog notifications on Twitter:
http://twitter.com/esetresearch http://twitter.com/ESETblog
ESET White Papers Page: http://www.eset.com/download/whitepapers.php
Securing Our eCity community initiative: http://www.securingourecity.org/
Also blogging at:
http://smallbluegreenblog.wordpress.com/
http://avien.net/blog
http://blogs.securiteam.com
http://blog.isc2.org/
http://macvirus.com/
