Chip-and-PIN flaw to be investigated by industry body  Tom Espiner ZDNet UK

The specification body, EMVCo, said it will analyze a paper by researchers from Cambridge University, who demonstrated an attack with a valid payment card that did not require a valid PIN to be entered to complete a transaction.



EMVCo, owned by American Express, JCB, MasterCard and Visa, said those debit- and credit-card payment companies will also scrutinize the paper.



"EMVCo will conduct its own analysis and draw its own conclusions," said the organisation on Wednesday. "The payment systems will do the same."



Last week researchers from Cambridge University said they had found a fundamental flaw in EMV, the protocol behind chip-and-PIN payments. The flaw had allowed them to build a device that modified and intercepted communications between a card and a point-of-sale terminal, and fool the terminal into accepting that a PIN verification had succeeded.



MasterCard confirmed that it would be working with the other card-payment providers to review security around chip-and-PIN, but said this was part of an ongoing process.



"The EMV standard is under constant review by MasterCard and many other major industry players to make sure it evolves to meet emerging product needs," said MasterCard. "These efforts include a frequent and regular review of security to make sure the latest, practical mechanisms are used."



Professor Ross Anderson of Cambridge University, who led the chip-and-PIN research, said there would be no easy fix for the protocol.



"There is much disagreement about [effective] industry measures to fix the vulnerability," said Anderson. "If you look at our blog post [publicising the vulnerability], a significant number of people who claim to be industry experts disagree."



One of the researchers' assertions in their paper, Chip and PIN is Broken, was that the consumer would bear the cost of a fraudulent card transaction if records showed a PIN had been entered into a terminal.



Continue Reading at ZDNet

Flaw 'calls entire architecture' of chip and pin into question

Verified by Visa and Mastercard SecureCode are there purely to protect the banks, not the card holder. They offer zero additional protection to the consumer, but allow the bank to claim that transactions using purloined credit card credentials were really made by the card holder. It is as simple as that. 



The issue has been noted, and commented on in the blogosphere as far back as June 2008, but has received little attention in the mainstream media, despite the obvious security implications.

Since card information is can be bought online for as low as $2.50, "Stolen Card Info Plunges to $2.50 in Black Market" and obtaining a DOB is so easy a caveman could do it, it's looking like VbV is more of a marketing ploy than of any real value when it comes to protecting the security of an online transaction. What I found even more interesting was Visa's declination to comment about the story which the Register tells us at the end of this article:

VbyV password reset is childishly simple • The Register



Both VbyV and SecureCode are based on 3DSecure, a name that hints at the introduction of some kind of three-factor authentication scheme. But unlike robust authentication techniques, hackers don't have a hardware token generating one-time passwords to worry about - it's just more of the same.



And since card details + CVV number is no longer considered as secure enough then it's hard to see how card details + CVV number + VbyV login is any more robust.



Much was made of how easy it was for a hacker to reset Sarah Palin's webmail account password and gain illicit access to emails, but resetting passwords for Verified by Visa - which supposedly makes online transactions more secure is arguably even easier. To reset Palin's email account a hacker needed to know the Republican VP candidate's birth date, her zip code and the answer to a secret question on where she met her husband. Resetting a Verified by Visa password, by contrast, requires only card details (got $2.50?) and a date of birth.



Register commenter Anthony explains.



Verified by Visa (VbV) allows anyone who has the credit card number in their hands to set a new password for VbV with just the card details and the card owner's date of birth. Since the latter is trivial to discover for most people, this adds almost no additional security to the process.



Register reader Jusme reports the same issue. Verified by Visa is one of the reasons I no longer use Barclaycard. Pretty much every time I had to use it the password was not recognised and I had to "reset it", which just meant entering my DOB and a new password, hardly very secure.



Online shoppers who buy goods and service with participating retailers are asked to submit a VbyV or SecureCode password to authorise transactions. These additional checks are typically submitted via a website affiliated to a card-issuing bank but with no obvious connection to a user's bank. Punters aren't informed up front that a merchant has signed up to Verified by Visa. Sites used to authenticate a VbyV or SecureCode password routinely deliver a dialogue box using a pop-up window or inline frame, making it difficult to detect whether or not a site is genuine.  The appearance of phishing attacks hunting for Verified by Visa passwords are among the reasons some punters are wary of the technology. Once obtained by fraudsters, either by direct phishing attack or through other more subtle forms of social engineering trickery,





An anonymous commenter to our original stories agrees:

Verified by Visa and Mastercard SecureCode are there purely to protect the banks, not the card holder. They offer zero additional protection to the consumer, but allow the bank to claim that transactions using purloined credit card credentials were really made by the card holder. It is as simple as that.

The issue has been noted, and commented on in the blogosphere as far back as June, but has received little attention in the mainstream media, despite the obvious security implications.

Credit card verification systems 'not secure'

Emma Woollacott | Fri 29th Jan 2010, 05:41 am

"While other single sign-on schemes such as OpenID, InfoCard and Liberty came up with decent technology they got the economics wrong, and their schemes have not been adopted.

• 3-D Secure has lousy technology, but got the economics right (at least for banks and merchants); it now boasts hundreds of millions of accounts."

• The main problem, they say, is that the system trains shoppers in bed habits. There's no visual verification for the buyer that their password is being protected.
  
  
  
  


• In addition, they say, the system is also vulnerable to phishing.
  
  
  
  


• The password activation process is flawed, as only poor authenticators are used, such as birthdate - often easily discoverable by fraudsters.
  
  
  
  


• "What's needed now is for regulators to intervene on behalf of the consumer," say the authors, calling for the EU to go one step further than planned and make secure electronic signatures compulsory.