Chip-And-PIN Security Questioned
Written by Evan SchumanLike the constant reports that every food imaginable causes cancer or some other deadly ailment, IT managers looking for the mythical safe security approach would be best served by giving up and having a bowl of hot fudge. This is prompted by a university report out of the U.K. that chip-and-PIN terminals, which were touted as a more expensive but more secure way to validate credit and debit card purchases, are–you guessed it–not secure.
A team at the University of Cambridge “opened up one of the supposedly tamper-proof terminals, replaced its internal hardware with their own, put it back together without any external evidence of tampering and then got the machine to play Tetris,” according to a report in Computerworld.
Researcher Saar Drimer said the school’s experiments proved that all components of the PIN pads used to authenticate such transactions could be made to interact and respond to input from one another. “This means that the card reader can read information from the chip and display it on the screen. The data from the keypad, such as a PIN, can also be recorded,” Drimer was quoted as saying.
-Marc
January 25th, 2007 at 4:53 am
Quite simply, Chip & Pin devices can be built into the countertop or standalone but devices built into countertops cannot be removed to be modified as stated in the Univ. of Cambridge report. The pin is secure because of the concealed data entry device used which when viewed by anybody other than the cardholder only shows 4 unmarked buttons being selected.
This is achieved by using 10 unmarked static buttons (0-9) adjacent to a viewing well built into the countertop which uses a scrambled selection of buttons for every new transaction and consequently a pin sequence cannot be recorded.
If these devices were used in retail outlets, it would immediately totally eliminate the number of retail customers being targeted to obtain their pin number at the point of sale by muggers as a prelude to taking money from their account after stealing their card.
What is ludicrous is that MasterCard and Visa say that you must never carry your pin number or credit card together to prevent both being stolen and yet this is what a customer at a retail outlet is expected to do and consequently they show to potential muggers that they have a card and disclose their pin number quite openly.