PINATA: PIN Automatic Try Attack

Presented at DEF CON 29 (2021), Aug. 7, 2021, 1 p.m. (45 minutes)

A brute force attack is a trial-and-error method used to obtain information such as user passwords or personal identification numbers (PINs). This attack methodology should be impossible to apply to the actual secured EMV bank cards. In this talk, we will analyze how an inadequate implementation could rely on an extreme and sophisticated PIN brute force attack against 10,000 combinations from 4 digit PIN that could affect millions of contact EMV cards.

Presenters:

• Salvador Mendoza - Security Researcher, Ocelot Offensive Security Team
  Salvador Mendoza is a Metabase Q security researcher and member of the Ocelot Offensive Security Team. Salvador focuses on tokenization processes, payment systems, mag-stripe information and embedded prototypes. He has presented on tokenization flaws and payment methods in different conferences such as Black Hat USA, DEF CON, HITB, Troopers and many others. Also, Salvador designed different tools to pentest mag-stripe information and tokenization processes. Author of "Show me the (e-) money Hacking a sistemas de pagos digitales: NFC. RFID, MST y Chips EMV". A Spanish-written book with a collection of different attacks against payment systems. @Netxing salmg.net

Links:

• https://defcon.org/html/defcon-29/dc-29-speakers.html#mendoza
• https://infocon.org/cons/DEF CON/DEF CON 29/DEF CON 29 video and slides/DEF CON 29 - Salvador Mendoza - PINATA PIN Automatic Try Attack - Live.mp4
• https://infocon.org/cons/DEF CON/DEF CON 29/DEF CON 29 video and slides/DEF CON 29 - Salvador Mendoza - PINATA PIN Automatic Try Attack.mp4
• https://infocon.org/cons/DEF CON/DEF CON 29/DEF CON 29 presentations/Salvador Mendoza - PINATA- PIN Automatic Try Attack - Slides.pdf (slides)
• https://infocon.org/cons/DEF CON/DEF CON 29/DEF CON 29 presentations/Salvador Mendoza - PINATA- PIN Automatic Try Attack.pdf (slides)
• https://infocon.org/cons/DEF CON/DEF CON 29/DEF CON 29 video and slides/DEF CON 29 - Salvador Mendoza - PINATA PIN Automatic Try Attack.srt (subtitles)
• https://www.youtube.com/watch?v=VOIvEqjJNOY

Similar Presentations:

• DEF CON 19 (2011) / Chip & PIN is Definitely Broken
• 33C3 (2016) / Do as I Say not as I Do: Stealth Modification of Programmable Logic Controllers I/O by Pin Control Attack
• 31C3 (2014) / Practical EMV PIN interception and fraud detection