There have been several articles written in the last few days questioning the value of EMV given there are known exploits that have hacked EMV transactions. This article from PC World sums the key points up nicely.
According to the PC World article, “however, the EMV specification suffers from both regulatory and security issues, some of which have already been exploited in real-world attacks, according to Ross Anderson, a security engineering professor at Cambridge University with 25 years of experience in payment systems security.
During a talk on Thursday at the Black Hat security conference in Las Vegas, Anderson highlighted some of the attacks that are possible against existing EMV implementations. Banks have tried to downplay these as impractical or too complex for cybercriminals to launch, he said.
The “preplay” and “no PIN” attacks are two examples. In a “preplay,” a card inserted into a rogue payment terminal can be charged for a transaction that’s done with a fraudulent card at a terminal somewhere else in the world. In the “no PIN” attack, a criminal uses a stolen card that’s wired to a portable device with a rogue card inserted into it. That lets the attacker bypass PIN verification at POS (point-of-sale) terminals in order to authorize rogue transactions.”
It strikes me that the exploits identified above would not be easily accomplished and that research may also identify how the POS software can be updated to prevent these hacks. The third example of a hack is clearly due to botched software. The failure to implement a true random number when seeding cryptography algorithms was the same issue that the Netscape browser had back in 1995.
More recently, Anderson’s team at Cambridge discovered that many EMV-capable ATMs and payment terminals generate random numbers in a predictable manner. This allows someone with temporary access to a credit card, such as a waiter, to calculate authentication codes that then can be used for transactions in the future. Worse, a rogue or compromised POS terminal can generate authentication codes for a card inserted into it, and those codes can later be used to authorize additional rogue transactions, according to the PC World article.
The article does not indicate any faith that banks will fix the problems discovered, which most people in payments will recognize is incorrect.
Some of these attacks don’t stem from issues in the EMV standard itself, but rather from the poor implementation of it by payment terminal vendors, according to Anderson. Banks don’t have enough incentive to act, because liability for fraud shifts to the merchants if EMV is not used in a transaction and to consumers if EMV is used with the correct PIN number, he said.
That tendency to blame the card owner is based on the premise that since EMV cards—or rather their chips—cannot be cloned, if a fraudulent transaction is done with such a card and the correct PIN, the card owner has been negligent.
Whether U.S. banks will try to shift liability to consumers for PIN-authorized EMV transactions remains to be seen, as consumer protection in the U.S. is better than in Europe, Anderson said. EMV adoption in the U.S. will be an interesting experiment because some banks want to implement chip-and-PIN cards, while others favor a chip-and-signature model, Anderson said.
Merchants are not technologically challenged and if they discover losses that are driven by the payments network they will work with their merchant acquirers to determine how the losses are occurring. At that point the losses will be felt by one of the players in the value chain, the merchant acquiring bank, the network, or the issuing bank; and all three will be proactive in fixing these problems as they are identified.
Adding a POS certification step to vet the random key generation algorithm will be simple, although re-certifying existing POS devices will take some time.
“The sophisticated EMV attacks that Anderson and his team at Cambridge identified aren’t widely used yet, partly because criminals have easier ways to abuse EMV cards today. That’s because they’re currently designed to also work with ATMs and payment terminals in countries where the system is not deployed, such as the U.S. Information captured from the magnetic stripe of a chip-equipped card can be used to create a counterfeit copy that doesn’t have a chip. That cloned card cannot be used in Europe but works in the U.S., where the chip isn’t needed anyway,” according to the article.
At this point, the article switches gears from how bogus EMV transactions can be generated with a card in hand, to identify how card data can be protected in transit using end-to-end encryption. Security experts have recommended point to point, or end to end, encryption for card-present payments for years. Adoption has been slow because it requires replacing card readers and PIN pads with new ones that support the technology, a significant investment that most merchants weren’t prepared to make.
Merchants should indeed consider adding encryption as they roll out new terminals, however, this is most often going to be enabled between the merchant and the merchant acquirer. This article, and others like it, will raise the public’s concern for the safety of their money, while failing to point out that EMV is more secure than mag stripe, even with the described issues.
Overview by Tim Sloane, Vice-President, Payments Innovation
To read the full story, go to PC World.