In the old days cards from the 1960's had a magnetic strip right so that when
you did a transaction the terminal would read the data on the card's magnetic strip
but from 2003 in the UK you started to get chips as well. So the information is
kept in this semiconductor chip and that makes it significantly more difficult to counterfeit.
. To counterfeit a mag stripe card all you gotta do is copy it onto a new card
but to counterfeit a chip you've got a drill into it with lasers and probing stations
and other expensive fiddly equipment and get the keys out, and that
is a pain and it only works some of the time and you just don't want to go there.
But don't worry if you're a criminal 'cause there are lots and lots of easier ways of
cheating chip and pin systems.
Chip & PIN is fun. It was designed in the late
nineteen nineties on the basis of some earlier experiments in the earlier
nineteen nineties in which we were privileged to have some small role and
it was introduced first in Britain from 2003 to 2005 so we started off with an
idea of what the frauds would likely be. For example if you have got some means of
intercepting the transaction flow between a card and a terminal. Say you've got a false card
and you can wire it up to a false terminal elsewhere then when a sucker
puts his card into your terminal you can teleport that to a dodgy card that
you then present at a jewelers shop - and we demonstrated this as a proof of concept
and these relay attacks work in theory but you don't see them in practice then
once Chip and PIN got fielded we began to see how things change in the real
world and fraud didn't in fact go down but it went up because first of all the bad guys
went online and although fraud initially fell a little bit in shops, it
more than caught up for that by increasing online. Second although fraud from
counterfeit cards initially went down, when they introduced chip and PIN
what happened was that after a period of six months or so it shot up and what the
bad guys had realized is that now you've got these chip and PIN devices
everywhere you could use them to harvest chip and PIN details, card details and
you could then make up mag stripe card forgeries and use them in ATMs that would
still accept mag stripe transactions. So we found for example that there was a
dodgy chip and PIN terminal in the BP garage (gas/petrol station) in Girton (Cambs) which caused a couple
of hundred people locally to have money taken from their cash machines in
Thailand of all places and there was a gang that got various people that
garages around the country to install dodgy equipment that would capture
people's chip and PIN details so that was one of the things that went wrong. It
was possible for example to remove part of the back of a chip and pin terminal
and put electronics in there and drill in so that you got into the serial link which
goes between the PIN-pad and the card and that gets the current details going one
direction and the PIN going in the other direction and that's all that you need
to do mag stripe forgeries. After we demonstrated this on TV the banks said
"Well you know that's a difficult attack Cambridge students could do it but real
criminals couldn't" but only a few months later they arrested a couple of guys in
Manchester what they've done was get access to the warehouse in Dubai
where the chip and pin terminals stopped to catch breath on route from the factory in
China to the retail trade in Britain and the Netherlands and in the back of
them they put little mobile phones so that whenever you used this terminal it
would text your card and PIN details to somebody in Karachi - and those guys
eventually got off because the banks weren't prepared to offer evidence
against them it was just too embarrassing more recently what we
discovered is that we got a number of people came to us and they said look my
card was stolen it was then used in a shop - the bank says it must be my fault
because the PIN was used and so I must have been negligent but it couldn't
have happened I didn't use the card with the PIN. We went and we looked and we found that
it's actually easy to cheat because what you can do, is you can put a device
between the card and the terminal
which tells the terminal that the pin was accepted by the card but tells the card
that it was a chip and signature transaction and this is an example of
the electronics that you can use you put the stolen card into the device like
this and you then use the 'tame' card in the chip and PIN device like this and
this means that the electronics can modify the transaction as it flows from
your stolen smart card to the chip and PIN terminal. The chip and PIN machine
is told that you entered the correct PIN even although you didn't but the card
is told that a signature verified the transaction and it's this kind of
sleight-of-hand this enables no-PIN fraud to be carried out and we've seen
that in the wild since, gosh, about 2010 2011
there're people in France who've been sent to jail for it
there're number of variants of it and now we're starting to see it in China because in
China you can buy tiny little two-sided SIM cards that will go between your
phone and your SIM card to enable you to do roaming more cheaply right, so that you
can roam among China's different provinces and the problem with these
slim shims is that they're just what you need to replace all this electronics
[Sorry, slim SIM is it?] or a SIM shim
['Shim' is it? Oh so it's like, shimmies inbetween] ...exactly so and so these devices can enable you to replace all this
electronics with one tiny little chip that you can just slip in between the stolen card
and the chip & PIN terminal. What we're doing is getting a man in the middle as
we call it in between the card and the chip and PIN machine so we can
manipulate those parts of the transaction that aren't properly
cryptographically authenticated. So that's the latest fraud technology.
The latest fraud methodology is simpler because what you do is you take a chip
and PIN machine and you re-program it and we're now seeing 'evil' chip and pin machines
coming on the market in Europe in Spain, in Britain, in Portugal and in the Baltics
and elsewhere
and what these chip and PIN machines will do - is they'll display a small amount on the
screen, say your transaction is thirty pounds for a meal or whatever
while putting a big transaction into the card - 3,000 pounds OK - and these are typically
used in places like night clubs and strip clubs and so on. So there's various guys from
Britain have gone on stag nights in Poland or in Lithuania or whatever and
they come back and find those a five thousand-pound transaction on the chip
and PIN card. How did it happen? Well you used your chip and PIN card in a strip club
in Vilnius what do you expect? Or in Barcelona, or now even in Bournemouth
this is now happening in Britain as well and it's very very difficult for people
who go into a bad place and use a card because if, if you complain to your bank
then the strip club owner will just say "He was with four girls all night and four...
...thousand pounds is what that costs at our place!" So you really are on a hiding to
nothing when it comes to complaining. The thing about this is that the
average person just doesn't think that, you know, if you pull your wallet out
of your pocket you've got what, two or three cards in there? If each of these cards
is good for five or ten thousand pounds, you know, with your overdraft limit and the
extra undocumented overdraft that the bank will give you and charge you extra for...
There's a total spending power in your pocket of maybe twenty thousand pounds.
Now, you wouldn't dream of walking into a whore-house on a Saturday night with 20,000
pounds in cash in your pocket would you? But that's what people do when they walk
into dodgy businesses just carrying a normal wallet with normal chip and PIN
cards in them and that's a new hazard that people just aren't aware of yet
There's a classic example of the middle person attack which is John Conway's famous idea of how
to beat a Grandmaster at chess. Well it's easy just play two grand masters at chess
simultaneously by postal chess and you relay the moves backwards and forwards from one to the other
playing games like this is what security engineers are really really into when
it comes to designing protocols and protocols are hard to design right
people usually get them wrong and again and again we find protocol flaws with
EMV which can be exploited and are being exploited. EMV is the Sunday
afternoon name for chip & PIN it's Europay / Mastercard / Visa protocol