European Credit and Debit Card Security Broken 245
Posted
by
timothy
from the pounding-marks-for-euros dept.
from the pounding-marks-for-euros dept.
Jack Spine writes "With nearly a billion users dependent on smart banking credit and debit cards, banks have refused liability for losses where an idenification number has been provided. But now, the process behind the majority of European credit and debit card transactions is fundamentally broken, according to researchers from Cambridge University. The researchers have demonstrated a man-in-the-middle attack which fooled a card reader into accepting a number of point-of-sale transactions, even though the cards were not properly authenticated. The researchers used off-the-shelf components (PDF), and a laptop running a Python script, to undermine the two-factor authentication process on European credit and debit cards, which is called Chip and PIN."
Man in the middle is Greece! (Score:2, Funny)
Ambiguous data as vali (Score:3, Funny)
FTA: "The central problem with the EMV protocol is that it allows the card and the terminal to generate ambiguous data about the verification process, which the bank will accept as valid... while a PIN must be entered, any PIN code would be accepted by the terminal."
That's a serious flaw. You've got to insist on data being valid if you are going to record it as valid.
It's a good thing that we don't rely on ambiguous data in any other part of life.
Sigh! Go ahead, (Score:5, Funny)
Strike at the heart of the problem (Score:5, Funny)
The researchers used off-the-shelf components (PDF), and a laptop running a Python script...
It is long past time for governments to criminalize the use of Python.
Figures... (Score:5, Funny)
Leave it to an English university to focus on phish and chips...
Re:Chip and Chip security... wait a second! (Score:3, Funny)
Re:Sigh! Go ahead, (Score:3, Funny)
You know, they say a lot of things about Python, but at least it doesn't name two of the most basic and important language operations after the contents of address register and contents of decrement register like some (otherwise-spiffy (if you overlook the (numerous) parentheses)) languages out there.
(Just the contents of cash register, apparently.)
Re:Strike at the heart of the problem (Score:4, Funny)
The researchers used off-the-shelf components (PDF), and a laptop running a Python script...
It is long past time for governments to criminalize the use of Python.
Or at least criminalize its use... on a plane.
There's a work-around! (Score:3, Funny)
Re:There's a work-around! (Score:3, Funny)
Re:Sigh! Go ahead, (Score:1, Funny)
Re:Chip and Chip security... wait a second! (Score:3, Funny)
Re:There's a work-around! (Score:1, Funny)
Use Cash.
OK, but what is the going exchange rate for L2 to RAM?