Industry News

Bank Cards Vulnerable to Undetectable “Pre-Play” Attacks

New Vulnerabilities to Chip and PIN bank cards Revealed

New Vulnerabilities to Chip and PIN bank cards Revealed

Popular Chip and PIN bank cards are vulnerable to “pre-play” attacks, a type of card cloning fraud which can’t be detected by regular banking procedures, a new study by University of Cambridge researchers reveals.

It seems the EMV “Chip and PIN” standard, widely-implemented for 1.62 billion payment cards, can be exploited to empty people’s accounts. A cryptographic weakness allows the hacker to perform a man-in-the-middle attack and intercept the unique authentication code required by an ATM to complete a transaction. The 32-bit number can be easily predicted as half of the ATMs and merchant terminals analyzed generate them through counters or timestamps.

A second protocol flaw gives the attacker the opportunity to replace the otherwise random number with the intercepted code.

To carry out the attack, after gaining temporary access to the card, the attacker requests authentication codes corresponding to the so-called random number. He then intercepts a second terminal’s communication with the bank and loads the known authentication code on to the cloned card to empty the victim’s account.

Since the authentication codes on clone card match those the real card would have provided, the bank can’t recognize the fraudulent transaction, the study says.

Cambridge researchers said they have proven the EMV system is not hacker-proof. “We are now publishing the results of our research so that customers whose claims for refunds have been wrongly denied have the evidence to pursue them, and so that the crypto, security and bank regulation communities can learn the lessons,” they said.

During their experiment, the researchers found flaws in widely-used ATMs from most manufacturers.

About the author

Alexandra GHEORGHE

Alexandra started writing about IT at the dawn of the decade - when an iPad was an eye-injury patch, we were minus Google+ and we all had Jobs. She has since wielded her background in PR and marketing communications to translate binary code to colorful stories that have been known to wear out readers' mouse scrolls. Alexandra is also a social media enthusiast who 'likes' only what she likes and LOLs only when she laughs out loud.