Chip and PIN: The technology is no longer secure





Chip and PIN Security

Chip and PIN systems were created to prevent skimming. Replacing the magnetic strip with an embedded microchip supposedly eliminates that possibility. In fact, many consider chip and PIN security a strong two-factor authentication. Here's what a card with an embedded chip looks like (courtesy of Wikipedia):


How it works


  2. The PED accesses the chip on the card.

So, what's the problem? Quite simply, it's the cost. The article mentions that:


Not quite perfect

I have been studying chip and PIN technology for awhile now. It obviously makes it more difficult to obtain a person's financial information. But, it's not perfect. My first inkling of this came from watching the BBC news report Chip and PIN ‘security risk'.

Basically, the PED hardware is compromised, allowing the criminal to obtain the card's financial information and PIN digitally. For whatever reason, the transaction traffic to and from the PED was not encrypted. Still the PED has to be physically altered for this attack to work, making it a risky endeavor.

New flaw

The same University of Cambridge research team that uncovered the PED hardware flaw recently discovered a new problem with chip and PIN technology. Professor Ross Anderson, a member of the team points out the seriousness:


Susan Watts of the BBC, presented a documentary about the research called New flaws in chip and PIN systems revealed. Unbelievably, a transaction can be completed without knowing the PIN. To explain, let's step through the attack process:

  1. The attacker obtains a stolen credit/debit card.
  2. Next, the stolen card is inserted into the attacker's card reader which is connected to a notebook.
  4. The criminal starts the payment process by inserting the fake card into the store's PED.
  5. The PED accesses the chip to verify the card's authenticity.
  6. Next, the PED asks the attacker for the PIN via the display screen.
  7. The criminal enters any 4 numbers, it doesn't matter.
  8. The software/hardware developed by the researchers then somehow fools the PED into believing the correct PIN was entered and a signature authorized the purchase.


If I understand correctly, the PIN exchange only involves the card's chip and the PED. That information was leveraged by the researchers to create a Man-in-the-Middle attack. The research team's paper Chip and PIN is broken (pdf) mentions:

"A man-in-the-middle device, which can intercept and modify the communications between card and terminal (PED), can trick the terminal into believing that PIN verification succeeded without actually sending the PIN to the card.


What's next


"I'll be talking about EMV (chip and PIN standard) at the Federal Reserve Bank's conference in New York on April 1st. I'll be arguing the Fed should insist that the EMV specification be fixed before they allow its introduction in the United States.


One other area of concern that I found interesting is the transition credit/debit card. If the chip and PIN system gains traction, not every merchant will have the correct PED immediately. According to the researcher team's report, this opens another attack avenue.


Final thoughts

I am not sure where I read this, but it has a lot of "street cred":

"The whole purpose behind security is to make it more difficult so thieves will go somewhere else as well as eliminating amateurs. Still no matter what you develop, there's going to be someone who's going to find a way around it."

I would like to thank Professor Anderson for taking the time to make a complex subject less so.

Update: A member was kind enough to point me to where I found the above quote. Here is the link to the Claes Bell article. I also edited the post, changing PEN to the correct acronym PED, my apologies.


About Michael Kassner


Editor's Picks