Chip and PIN is broken

Proceedings - IEEE Symposium on Security and Privacy

Volumn , Issue , 2010, Pages 433-446

  Murdoch, Steven J ^a   Drimer, Saar ^a   Anderson, Ross ^a   Bond, Mike ^a  

^a UNIVERSITY OF CAMBRIDGE   (United Kingdom)

Author keywords

Authentication; Bank security; Card fraud; Chip and PIN; EMV; Protocol failure; Security economics

Indexed keywords

AUTHENTICATION CODES; CARD FRAUD; CARD FRAUDS; CHIP AND PIN; CORE FUNCTIONALITY; DEBIT CARDS; DIGITAL SIGNATURE; FRAUDSTERS; MAN IN THE MIDDLE ATTACKS; PAYMENT SYSTEMS; PROTOCOL DESIGN;

AUTHENTICATION; CRIME; CUSTOMER SATISFACTION; NETWORK PROTOCOLS; PUBLIC POLICY; SALES; SMART CARDS;

NETWORK SECURITY;

EID: 77955217681     PISSN: 10816011     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/SP.2010.33     Document Type: Conference Paper

References (22)

1. EMV - Integrated Circuit Card Specifications for Payment Systems, Book 1: Application Independent ICC to Terminal Interface Requirements, Version 4.2 ed., EMVCo, LLC, June 2008.
2. EMV - Integrated Circuit Card Specifications for Payment Systems, Book 2: Security and Key Management, Version 4.2 ed., EMVCo, LLC, June 2008.
3. EMV - Integrated Circuit Card Specifications for Payment Systems, Book 3: Application Specification, Version 4.2 ed., EMVCo, LLC, June 2008.
4. EMV - Integrated Circuit Card Specifications for Payment Systems, Book 4: Cardholder, Attendant, and Acquirer Interface Requirements, Version 4.2 ed., EMVCo, LLC, June 2008.
5. EMVCo, "About EMV," November 2009. [Online]. Available: http://www.emvco.com/about-emv.aspx
6. APACS, "2008 fraud figures announced by APACS," March 2009. [Online], Available: http://www.ukpayments.org.uk/ media-centre/press-releases/- /page/685/
7. Which?, "Fraud victims struggle to get money back," June 2009. [Online], Available: http://www.which.co.uk/news/2009/06/ fraud- victims- struggle-to- get- money- back-179150.jsp
8. Visa Integrated Circuit Card - Card Specification, Version 1.4.0 ed., Visa International, October 2001.
9. S. J. Murdoch, S. Drimer, R. Anderson, and M. Bond, "EMV PIN verification "wedge" vulnerability," February 2010. [Online], Available: http://www.cl.cam.ac.uk/research/ security/banking/nopin/
10. Maxim Integrated Products, Inc., MAX1740, MAX1741 SIM/smart-card level translators in μMAX, January 2001, http://datasheets.maxim-ic.com/ en/ds/MAX1740-MAX1741.pdf. [Online]. Available: http: //datasheets.maxim- ic.com/en/ds/MAX1740-MAX1741.pdf
11. Xilinx Inc., "Spartan-3E starter kit," November 2009. [Online], Available: http://www.xilinx.com/products/devkits/ HW- SPAR3E- SK- US- G.htm
12. "BLADOX Turbo SIM," March 2010. [Online]. Available: http://www.bladox.com/
13. Standard 70, Book 2 - Card Acceptor to Acquirer Interface Standards: Messages, Data Elements and Code Values for Real-time Systems, The UK Cards Association, October 2009.
14. L. Gong and P. Syverson, "Fail-stop protocols: An approach to designing secure protocols," in International Working Conference on Dependable Computing for Critical Applications, September 1995, pp. 44-55.
15. T. Dierks and C. Allen, "The TLS protocol," IETF, RFC 2246, January 1999.
16. "Job v Halifax PLC, case number 7BQ00307, commentary by Alistair Kelman," in Digital Evidence and Electronic Signature Law Review, vol. 6. Pario Communications, November 2009, ISBN 0-9543245-9-5; see also http://www. alikelman.com/jobhbos.pdf.
17. S. J. Murdoch, "Reliability of chip & PIN evidence in banking disputes," in Digital Evidence and Electronic Signature Law Review, vol. 6. Pario Communications, November 2009, pp. 98-115, ISBN 0-9543245-9-5.
18. E. V. Herreweghen and U. Wille, "Risks and potentials of using EMV for Internet payments," USENIX Workshop on Smartcard Technology, May 1999.
19. R. Anderson, M. Bond, and S. J. Murdoch, "Chip and spin," March 2005. [Online], Available: http://www.chipandspin.co. uk/spin.pdf
20. S. Drimer and S. J. Murdoch, "Keep your enemies close: Distance bounding against smartcard relay attacks," in USENIX Security Symposium, August 2007. [Online], Available: http://www.usenix.org/events/sec07/tech/ drimer/drimer.pdf
21. S. Drimer, S. J. Murdoch, and R. Anderson, "Thinking inside the box: system-level failures of tamper proofing," in IEEE Symposium on Security and Privacy (Oakland), May 2008, pp. 281-295. [Online]. Available: http://www.cl.cam. ac.uk/-sd410/papers/ped-attacks.pdf
22. R. Anderson, "Chip and PIN is broken," Light Blue Touchpaper, February 2010. [Online], Available: http://www. lightbluetouchpaper.org/2010/02/ 11/chip-and-pin-is-broken/