Flaws In EMV Chip And PIN Undercut Security

Weaknesses in the EMV protocol and implementations create vulnerabilities that could be exploited via POS malware and man-in-the-middle attacks.

onto millions of Target's point-of-sale (POS) systems and steal data pertaining to 40 million credit and debit cards, many card brands and retailers, including Target, announced that they will push for more widespread EMV adoption in the US. To be clear, however, EMV would not have prevented the Target breach.

Furthermore, a forthcoming liability shift -- scheduled to begin in October 2015, although not until October 2017 for gas station terminals -- by Visa seeks to drive more EMV uptake. "The liability shift encourages chip transactions because any chip-on-chip transaction -- i.e., a chip card read by a chip terminal -- provides dynamic authentication data, which helps to better protect all parties," Visa explained.

According to the new research, however, that dynamic authentication system is vulnerable to spoofing. Any related liability, however, would rest with the consumer, unless he or she can prove that attackers subverted the EMV security system.

In their paper, the researchers expressed frustration at the EMV alliance failing to address the flaws they exposed more than one year after receiving related security disclosures. "We are now publishing the results of our research so that customers whose claims for refund have been wrongly denied have the evidence to pursue them, and so that the crypto, security, and bank regulation communities can learn [related] lessons," the researchers said. They've also called on banking regulators in the United States and abroad to use their muscle to force merchants, banks, and vendors to put related fixes in place.

For any consumer who thinks he or she may have suffered fraud as a result of related attacks, the researchers recommended immediately requesting related logs from both the card acquirer and the ATM terminal operator to see if the unpredictable numbers used to verify the transaction match, as they should. All such logs, per Visa guidelines, are meant to be retained in case of any disputes. "Yet in recent cases we have dealt with, logs were routinely destroyed after 90 or 180 days regardless of whether a dispute was in progress," the researchers warned.

In the bigger picture, the researchers called on the payment card industry to take responsibility for keeping the EMV system secure. "Again and again, customers have complained of fraud and been told by the banks that as EMV is secure; they must be mistaken or lying when they dispute card transactions. Again and again, the banks have turned out to be wrong."

Next-gen intrusion-prevention systems have fuller visibility into applications and data. But do newer firewalls make IPS redundant? Also in the The IPS Makeover issue of Dark Reading Tech Digest: Find out what our 2013 Strategic Security Survey respondents have to say about IPS and firewalls. (Free registration required.)

Editors' Choice
Jai Vijayan, Contributing Writer, Dark Reading
Kelly Jackson Higgins 2, Editor-in-Chief, Dark Reading