Black Hat talk will show that security and backwards compatibility are at odds in popular authentication technology.
Vulnerabilities in the increasingly popular chip-and-PIN authentication technology used in credit cards could make it easy for attackers to steal data at the point of sale, a researcher said.
At the Black Hat USA conference, a UBM TechWeb event, in Las Vegas this week, Andrea Barisani, chief security engineer for secure design consultancy Inverse Path, will join with colleagues to show how flaws in chip-and-PIN--which is becoming a standard in Europe and Asia--can be easily exploited.
Chip-and-PIN systems are designed to support legacy transactions--including the transmission of the card's password or PIN in plain text, Barisani observed. As a result, it can be a trivial matter for an attacker to install a skimmer on a point-of-sale terminal and steal the credit card data.
Barisani says these flaws can be found in current and emerging credit card systems, including the EuroPay-Mastercard-Visa (EMV) system that is being implemented worldwide. While EMV supports three types of cards--older magnetic stripe cards, current chip cards, and more secure chip cards--skimmers can force transactions to use the least secure transaction method, he warned.
"EMV is broken," Barisani said. "In order to fix the problem, they will have to change the standard and break compatibility with older cards."
EMV currently supports three different standards: static data authentication, an upgrade from older magstripe cards; dynamic data authentication, a more secure implementation that uses an encryption key to scramble transaction information; and combined data authentication, which implements more stringent security measures.
Attackers who can attach a skimming device to the point-of-sale (POS) terminal can control the security negotiation between the terminal and the consumer's credit card, Barisani explained. In order to support the older POS technologies, credit and debit cards will transmit a user's PIN in the clear if required by the terminal. A skimmer attacked to the device can then scoop up the details of the credit card.
Tampering with point-of-sale terminals has been a popular exploit among cybercriminals for years. In May, craft-supply chain Michaels notified customers that their credit- and debit-account details may have been leaked after finding more than 70 compromised POS terminals in its stores nationwide.
The chip-and-PIN flaws could be problematic for banks, which previously blamed users when a PIN was stolen or misused, clearing themselves of liability for the theft. But if the new vulnerabilities are exploited, the source of the PIN theft--and the liability for the loss--could be in question.
The vendors, contractors, and other outside parties with which you do business can create a serious security risk. Here's how to keep this threat in check. Also in the new, all-digital issue of Dark Reading: Why focusing solely on your own company's security ignores the bigger picture. Download it now. (Free registration required.)
Published: 2015-04-24 Multiple cross-site request forgery (CSRF) vulnerabilities in Zen Cart 1.3.9h allow remote attackers to hijack the authentication of administrators for requests that (1) delete a product via a delete_product_confirm action to product.php or (2) disable a product via a setflag action to categories.ph...
Published: 2015-04-24 Multiple cross-site request forgery (CSRF) vulnerabilities in TinyWebGallery (TWG) before 1.8.8 allow remote attackers to hijack the authentication of administrators for requests that (1) add a user via an adduser action to admin/index.php or (2) conduct static PHP code injection attacks in .htusers...
Published: 2015-04-24 Multiple cross-site scripting (XSS) vulnerabilities in TinyWebGallery (TWG) before 1.8.8 allow remote attackers to inject arbitrary web script or HTML via the (1) selitems parameter in a copy, (2) chmod, or (3) arch action to admin/index.php or (4) searchitem parameter in a search action to admin/...
Published: 2015-04-24 Multiple stack-based buffer overflows in HttpUtils.dll in TVMOBiLi before 220.127.116.1174 allow remote attackers to cause a denial of service (tvMobiliService service crash) via a long string in a (1) GET or (2) HEAD request to TCP port 30888.
Published: 2015-04-24 Red Hat JBoss Operations Network 3.3.1 does not properly restrict access to certain APIs, which allows remote attackers to execute arbitrary Java methos via the (1) ServerInvokerServlet or (2) SchedulerService or (3) cause a denial of service (disk consumption) via the ContentManager.
Join security and risk expert John Pironti and Dark Reading Editor-in-Chief Tim Wilson for a live online discussion of the sea-changing shift in security strategy and the many ways it is affecting IT and business.