Researchers warn of chip and Pin flaws

Two widely deployed Pin entry devices fail to protect card details and Pins

Researchers at the University of Cambridge have warned that chip and Pin machines are not as secure as the banking industry claims.

Saar Drimer, Steven Murdoch and Ross Anderson, from the Computer Laboratory at Cambridge, said that two widely deployed Pin entry devices, the Ingenico i3300 and Dione Xtreme (PDF), fail adequately to protect card details and Pins.

Fraudsters could easily attach a "tap" to the device that records Pin and account details as they are transmitted between the card and the Pin pad.

Armed with this information, fraudsters could create a counterfeit card and withdraw cash from ATMs abroad.

"We have successfully demonstrated this attack on a real terminal borrowed from a merchant," said Murdoch.

The technical sophistication required to carry out this attack is low, according to the researcher, and fraudsters have already shown that they have the necessary skills.

The tap would not normally be visible to customers and, in the case of the Ingenico i3300, could be totally enclosed in the device.

"The vulnerabilities we found were caused by a series of manufacturing design errors. They can be exploited because Britain's banks set up chip and Pin in an insecure way," said Drimer.

"These devices fail to protect the communication path that carries the data from the card to the Pin pad, and from the Pin pad back to the card. A villain who taps this gets all the information he needs to make a fake card and to use it."

The flaws call into question the system under which bank terminals are certified, according to the researchers, as Visa and Apacs have certified both devices as secure.

"The lessons we learned are not limited to banking. Voting machines and electronic medical record systems suffer from the same combination of stupid mistakes, sham evaluations and obstructive authorities," said Anderson.

"When the public is forced to rely on the security of a system, we need honest security evaluations that are published and subjected to peer review."