Two widely deployed Pin entry devices fail to protect card details and Pins
Researchers warn of chip and Pin flaws
/v3-uk/news/1978528/researchers-warn-chip-pin-flaws
28 Feb 2008, Robert Jaques , V3
Researchers at the University of Cambridge have warned that chip and Pin machines are not as secure as the banking industry claims.
Saar Drimer, Steven Murdoch and Ross Anderson, from the Computer Laboratory at Cambridge, said that two widely deployed Pin entry devices, the Ingenico i3300 and Dione Xtreme (PDF), fail adequately to protect card details and Pins.
Fraudsters could easily attach a "tap" to the device that records Pin and account details as they are transmitted between the card and the Pin pad.
Armed with this information, fraudsters could create a counterfeit card and withdraw cash from ATMs abroad.
"We have successfully demonstrated this attack on a real terminal borrowed from a merchant," said Murdoch.
The technical sophistication required to carry out this attack is low, according to the researcher, and fraudsters have already shown that they have the necessary skills.
The tap would not normally be visible to customers and, in the case of the Ingenico i3300, could be totally enclosed in the device.
"The vulnerabilities we found were caused by a series of manufacturing design errors. They can be exploited because Britain's banks set up chip and Pin in an insecure way," said Drimer.
"These devices fail to protect the communication path that carries the data from the card to the Pin pad, and from the Pin pad back to the card. A villain who taps this gets all the information he needs to make a fake card and to use it."
The flaws call into question the system under which bank terminals are certified, according to the researchers, as Visa and Apacs have certified both devices as secure.
"The lessons we learned are not limited to banking. Voting machines and electronic medical record systems suffer from the same combination of stupid mistakes, sham evaluations and obstructive authorities," said Anderson.
"When the public is forced to rely on the security of a system, we need honest security evaluations that are published and subjected to peer review."
© Incisive Media Investments Limited 2010, Published by Incisive Financial Publishing Limited, Haymarket House, 28-29 Haymarket, London SW1Y 4RX, are companies registered in England and Wales with company registration numbers 04252091 & 04252093
Do you agree?
Too right - when is my bank going to keep my money secure!
I've been the subject of fraud twice now. I consider myself very careful when using chip and pin machines and still I get my card details stolen.
End of the day we have to get our cash paid into a bank to which we are led to believe is secure, but sadly this is not the case and with the introduction of chip and pin we are seeing a rise in fraud because they can easily get our PIN from the machines.
We are using dated technology that can be easily tampered with in regards to gaining our information, to which we then suffer as we have to then fill forms out and wait weeks to reclaim "our" money!
I agree that the machines should be tested better against fraud but I also believe the banks have a larger role to play in keeping our money safe and investing heavily (with money that we have helped them make) into more secure methods of paying over the counter and via ATMs.
Posted by Leon, 28 Feb 2008
people to careless
slight flaw in their research is that they were given a chip and pin terminal to tamper with, and the article sujests that such a tap in the connection between chip and pin device would require physical tampering with the device.
ney on impossible considering tills are staffed from open till close.
people are far more likely to get done for fraud due to internet hackers and people going though bins for statements
Posted by andrew ryan, 28 Feb 2008