Harvesting high value foreign currency transactions from EMV contactless credit cards without the PIN

Proceedings of the ACM Conference on Computer and Communications Security

Volumn , Issue , 2014, Pages 716-726

  Emms, Martin ^a   Arief, Budi ^a   Freitas, Leo ^a   Hannon, Joseph ^a   Van Moorsel, Aad ^a  

^a NEWCASTLE UNIVERSITY   (United Kingdom)

Author keywords

Contactless cards; EMV; Foreign currency transaction limits; Fraudulent transaction; Rogue merchant

Indexed keywords

DATA PRIVACY;

CONTACT LESS; CONTACTLESS CARDS; CONTACTLESS CREDIT CARD; CREDIT CARDS; FOREIGN CURRENCY; FRAUDULENT TRANSACTIONS; ROGUE MERCHANT; TRANSACTION DATA;

SECURITY OF DATA;

EID: 84910614937     PISSN: 15437221     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/2660267.2660312     Document Type: Conference Paper

References (13)

1. Bond, M., Choudary, O., Murdoch, S.J., Skorobogatov, S., Anderson, R. 2014. Chip and Skim: cloning EMV cards with the pre-play attack. 35th IEEE Symposium on Security and Privacy. http://arxiv.org/pdf/1209.2531.pdf
2. Cooper, D. and Barner, J. 2008. Tokeneer ID station EAL5 demonstrator. Technical Report S.P1229.81.1, Altran Praxis.
3. Drimer, S. and Murdoch, S.J. 2007. Keep Your Enemies Close: Distance Bounding Against Smartcard Relay Attacks. 16th USENIX Security Symposium, Boston, MA, USA. http://www.cl.cam.ac.uk/~sjm217/papers/usenix07bounding. pdf
4. EMVCo. 2011. EMV Integrated Circuit Card Specifications for Payment Systems - Version 4.3. http://www.emvco.com/specifications.aspx?id=223 [Accessed: 22 August 2014]
5. EMVCo. 2014. EMV Contactless Specifications for Payment Systems - Version 2.4. http://www.emvco.com/specifications.aspx?id=21 [Accessed: 22 August 2014]
6. Francis, L., Hancke, G., Mayes, K., Markantonakis, K. 2012. Practical Relay Attack on Contactless Transactions by Using NFC Mobile Phones. The 2012 Workshop on RFID and IoT Security (RFIDsec 2012 Asia), Nai-Wei, L., Yingjiu, L. (editors). Vol. 8, IOS Press (Cryptology and Information Security Series), pp. 21-32. http://eprint.iacr.org/2011/618.pdf
7. Freitas, L. and Emms, M. 2014. Formal specification of EMV protocol. School of Computing Science Technical Report Series 1429, Newcastle University.
8. International Organization for Standardization. 1995. ISO 8583:1995 - Financial transaction card originated messages - Interchange message specifications.
9. Murdoch, S.J., Drimer, S., Anderson, R., Bond, M. 2010. Chip and PIN is Broken. IEEE Symposium on Security and Privacy, pp. 433-446. http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=5504801&isnumber=5504699
10. Reason, J. 1990. Human Error. Cambridge University Press.
11. Smans, J., Jacobs, B., and Piessens, F. 2013. VeriFast for Java: A Tutorial. In: Clarke, D., Noble, J., Wrigstad, T. (eds.) Aliasing in Object-Oriented Programming. LNCS, vol. 7850, pp. 407- 442. Springer, Heidelberg.
12. The UK Cards Association Limited. 2013. Standard 70 - Card Acceptor to Acquirer Interface Standards.
13. Woodcock, J. and Davies, J. 1998. Using Z. Prentice Hall.