Chip & PIN is Definitely Broken

Presented at DEF CON 19 (2011), Aug. 6, 2011, 11 a.m. (50 minutes).

The EMV global standard for electronic payments is widely used for inter-operation between chip equipped credit/debit cards, Point of Sales devices and ATMs. Following the trail of the serious vulnerabilities published by Murdoch and Drimer's team at Cambridge University regarding the usage of stolen cards, we explore the feasibility of skimming and cloning in the context of POS usage. We will analyze in detail EMV flaws in PIN protection and illustrate skimming prototypes that can be covertly used to harvest credit card information as well as PIN numbers regardless the type/configuration of the card. The attacks are believed to be unreleased so far to the public (which however does not mean fraudster are not exploiting them) and are effective in bypassing existing protections and mode of operations. As usual cool gear and videos are going to be featured in order to maximize the presentation.

Presenters:

• Andrea Barisani - Inverse Path S.r.l.
  Andrea Barisani Bio
• Adam Laurie / Major Malfunction - Aperture Labs Ltd   as Adam Laurie
  Adam Laurie Bio
• Zac Franken - Aperture Labs Ltd
  Zac Franken Bio
• Daniele Bianco - Inverse Path S.r.l.
  Daniele Bianco Bio

Links:

• https://defcon.org/html/defcon-19/dc-19-speakers.html#Barisani
• https://infocon.org/cons/DEF CON/DEF CON 19/DEF CON 19 video and slides/DEF CON 19 - Barisani Laurie Franken and Bianco - Chip and PIN is Definitely Broken - Video and Slides.mp4 (Video and Slides)

Similar Presentations:

• DEF CON 23 (2015) / Goodbye Memory Scraping Malware: Hold Out Till "Chip And Pin"
• 31C3 (2014) / Practical EMV PIN interception and fraud detection
• Black Hat USA 2011 / Chip & PIN is definitely broken