This week, the Security Group published their findings on the vulnerability of PIN entry devices (PEDs) currently deployed in the UK (details available in their technical report). The vulnerability arises partially from insufficient protection of the PEDs from tampering and partially from communications between the card and the device not being encrypted. This effectively breaks the trusted path between customer's card and the retailer's terminal/card processing network. You can watch the BBC Newsnight program covering this.

This week we (Cronto) have also made an announcement about potential vulnerabilities of Chip and PIN based authentication for online banking. Whilst the CAP readers deployed by the UK banks can provide transaction authentication, there is still a weak link. If the user is tricked into entering incorrect details into the CAP reader then they could be inadvertently authorising a fraudulent transaction. Whilst the possibility of this happening might seem remote, our analysis of existing systems shows otherwise. Again, the threats arise because there is no trusted path from the bank to the user's card/reader as the attacker can manipulate the presentation of the bank's website to the user.

The trusted path issue is common to all consumer payments industry applications: from ATMs with added PIN pads and tampered retail terminals to man-in-the-browser'ed banking websites. The problem is also increasing with the growth of the payments industry, and any potentially successful solution requires a new approach based on innovation rather than attempts to patch the holes in the old protocols.

These issues are already a subject of both academic research and commercial product development. Some see a solution in the USB tokens with strong security protocols, some suggest the mobile phone based PKI certificates are the answer. At Cronto, we believe the visual channel is the best way to go.

<!-- If you are offended by a commercial company being passionate about its product and advocating innovation in a traditionally very conservative industry, you can stop reading now -->

We believe that our visual cryptogram can provide a trusted path from a bank to the customer in the way which is both secure and simple for consumers.

We chose the visual channel for the following reasons:

• The image can contain encrypted data
• Most end user terminals can display images: from ATMs to Train Ticket machines to websites, no hardware modifications are needed
• Taking a picture of the terminal is easy for the user
• Any personal device can be used: a camera phone, a dedicated camera token or, potentially, a CAP reader, and even a credit card itself extended with a camera and our algorithms running on the chip
• Both attack vectors – the data in transfer being tampered with, and the user typing incorrect information – are mitigated

We were able to demonstrate that two of the most popular PEDs in the UK — the Ingenico i3300 and Dione Xtreme — are vulnerable to a “tapping attack” using a paper clip, a needle and a small recording device. This allows us to record the data exchanged between the card and the PED’s processor without triggering tamper proofing mechanisms, and in clear violation of their supposed security properties. This attack can capture the card’s PIN because UK banks have opted to issue cheaper cards that do not use asymmetric cryptography to encrypt data between the card and PED.

In addition to the PIN, as part of the transaction, the PED reads an exact replica of the magnetic strip (for backwards compatibility). Thus, if an attacker can tap the data line between the card and the PED’s processor, he gets all the information needed to create a magnetic strip card and withdraw money out of an ATM that does not read the chip.

We also found that the certification process of these PEDs is flawed. APACS has been effectively approving PEDs for the UK market as Common Criteria (CC) Evaluated, which does not equal Common Criteria Certified (no PEDs are CC Certified). What APACS means by “Evaluated” is that an approved lab has performed the “evaluation”, but unlike CC Certified products, the reports are kept secret, and governmental Certification Bodies do not do quality control.

This process causes a race to the bottom, with PED developers able to choose labs that will approve rather than improve PEDs, at the lowest price. Clearly, the certification process needs to be more open to the cardholders, who suffer from the fraud. It also needs to be fixed such that defective devices are refused certification.

We notified APACS, Visa, and the PED manufactures of our results in mid-November 2007 and responses arrived only in the last week or so (Visa chose to respond only a few minutes ago!) The responses are the usual claims that our demonstrations can only be done in lab conditions, that criminals are not that sophisticated, the threat to cardholder data is minimal, and that their “layers of security” will detect fraud. There is no evidence to support these claims. APACS state that the PEDs we examined will not be de-certified or removed, and the same for the labs who certified them and would not even tell us who they are.

The threat is very real: tampered PEDs have already been used for fraud. See our press release and FAQ for basic points and the technical report where we discuss the work in detail.