The purported security of a Chip & PIN terminal system

Link: Light Blue Touchpaper » Blog Archive » Chip & PIN terminal playing Tetris.

"Many discussions over the security of Chip & PIN have focused on the tamper-resistance of terminals (for example in the aftermath of the Shell Chip & PIN fraud). It is important to remember, however, that even perfect tamper resistance only ensures that the terminal will no longer be able to communicate with the bank once opened. It does not prevent anyone from replacing most of the terminal’s hardware and presenting it to customers as legitimate, so freely collecting card details and PINs.

"Steven Murdoch and myself took the chassis of a real terminal and replaced much of the internal electronics such that it allows us to control the screen, keypad and card-reader. Steven suggested that in order to show that it is completely under our control, we should make it play Tetris..."

((Uh-oh:)))

(((Even more uh-oh:)))

http://www.guardian.co.uk/technology/2008/jan/03/hitechcrime.news

http://www.guardian.co.uk/technology/2008/jan/03/hitechcrime.news

"... Barclaycard's case against pensioner Donald Reddell, who lost £3,000 in phantom withdrawals from UK ATMs. His wife has a card on the same account, but Reddell says they don't use them for anything other than emergency transactions while on holiday.

"The disputed transactions were made using the chip in the issued card received by Mr Reddell and not a counterfeit card," says Barclaycard, adding that the Ombudsman had upheld its decision to dismiss Mr Reddell's claim.

"That couldn't have happened, because it was kept in my safe," contends Reddell. He only ever used it in an ATM to change the pin on the card, which was new, two weeks before the frauds occurred.

If skimmed, Reddell's card would have been open to fraud in the thousands of overseas ATM machines that don't have chip-and-pin capability, or using "card not present" transactions such as those made via websites....