topic Re: How a criminal ring defeated Chip & PIN cards in Credit in the News

How a criminal ring defeated Chip & PIN cards

Simply827 — Tue, 20 Oct 2015 15:20:23 GMT

http://arstechnica.com/tech-policy/2015/10/how-a-criminal-ring-defeated-the-secure-chip-and-pin-credit-cards/

Re: How a criminal ring defeated Chip & PIN cards

pipeguy — Tue, 20 Oct 2015 16:10:15 GMT

Interesting story but I doubt it'll be the last one on getting around the "security features" of the new EMV chips. Still, it's a lot more difficult than cloning a mag-strip.

Thaks for posting the story !

Re: How a criminal ring defeated Chip & PIN cards

Anonymous — Tue, 20 Oct 2015 17:37:18 GMT

Appreciate the information! What an eye opener.

Re: How a criminal ring defeated Chip & PIN cards

Open123 — Wed, 21 Oct 2015 14:51:01 GMT

I find this passage particularly relevant.

"That suggests a concerning dynamic between the card holder and the bank that could be jarring for American users in the near future—if banks see the EMV standard as impervious to fraud, it will be difficult or impossible for the cardholder to get the bank to accept liability for legitimate hacks."

What motivation would American consumers, who have zero liability now, willingly introduce this element to our everday lives? What's in it for us?

All these years, I've yet to hear a single compelling argument (from the consumer's perspective) why we should adopt a "chip & pin" system. Similar to that "verify by Visa" crap. Whenever I see it, I won't use a Visa card.

Re: How a criminal ring defeated Chip & PIN cards

Anonymous — Wed, 21 Oct 2015 20:07:24 GMT

I am sure everyone commenting has read the article, but may have missed a very important and significant piece of information. This hack was done when PIN was verified at the terminal by communicating with the chip on the card. That's why this hack worked. This is not the case anymore. Hasn't been for a few years, Now the PIN is verified by the card issuer and NOT programmed in the chip on the card. Unless someone knows your PIN, stolen card isn't going to work. This also why FBI warned about using the PIN instead of signature for EMV cards.

Let's not sound the alarm just yet. Everything is under control.

Re: How a criminal ring defeated Chip & PIN cards

Open123 — Thu, 29 Oct 2015 22:36:35 GMT

With EMV implementation the past couple of weeks, some comical things have happened. While I'm all for EMV & sign, the implementation has already caused me unnecessary inconvience I'd rather not endure. All this trouble, and not one bit of it benefits me as a consumer.

I'm in the Bay Area, which I'd imagine is one of the more tech savvy parts of the country. Still, while at Trader Joe's, I've noticed the line has gone considerably slower because of the changeover to EMV. Literally, there are signs written on the machines telling people to "stop and wait for instruction" from the cashier. While I don't find it all that complex (I mean, pretty simple using an EMV card, just stick it in and wait for approval), every customer is getting instructed. The first time, it was comical. Now, after the umpteenth time, it's become annoying being treated as if I were a child. "What are you using to pay?" "Don't do anything until I tell you to." "What, you're using Apple Pay?"

Or, at CVS here, there's a white piece with almost illegible handwriting stipulating, "NO EMV, SWIPE CARD!" Maybe that one article was right on making jest of Americans only being able to leaning "one" thing at a time! LOL

Whatever, they need to stop telling everyone how to pay and treating people like children. This is becoming really tiresome being dictated to by all manners of cashiers.

Re: How a criminal ring defeated Chip & PIN cards

vanillabean — Fri, 30 Oct 2015 03:02:35 GMT

The Bay Area is pretty much a nanny state, isn't it?

Re: How a criminal ring defeated Chip & PIN cards

Open123 — Fri, 30 Oct 2015 13:25:57 GMT

@Anonymous-own-fico wrote:
The Bay Area is pretty much a nanny state, isn't it?

I'm still trying to figure out what goes in the black, blue and/or green trash bins.

To this day, I still get confused and just throw everything into the black one. A well meaning person once threatened to make a citizen's arrest because I was violating local ordinance. When I remarked that having 3 trash bins was too complicated for me to follow, she cited it was no excuse.

Re: How a criminal ring defeated Chip & PIN cards

14Fiesta — Sat, 31 Oct 2015 04:25:10 GMT

@Open123 wrote:
With EMV implementation the past couple of weeks, some comical things have happened. While I'm all for EMV & sign, the implementation has already caused me unnecessary inconvience I'd rather not endure. All this trouble, and not one bit of it benefits me as a consumer.

I'm in the Bay Area, which I'd imagine is one of the more tech savvy parts of the country. Still, while at Trader Joe's, I've noticed the line has gone considerably slower because of the changeover to EMV. Literally, there are signs written on the machines telling people to "stop and wait for instruction" from the cashier. While I don't find it all that complex (I mean, pretty simple using an EMV card, just stick it in and wait for approval), every customer is getting instructed. The first time, it was comical. Now, after the umpteenth time, it's become annoying being treated as if I were a child. "What are you using to pay?" "Don't do anything until I tell you to." "What, you're using Apple Pay?"

Or, at CVS here, there's a white piece with almost illegible handwriting stipulating, "NO EMV, SWIPE CARD!" Maybe that one article was right on making jest of Americans only being able to leaning "one" thing at a time! LOL

Whatever, they need to stop telling everyone how to pay and treating people like children. This is becoming really tiresome being dictated to by all manners of cashiers.

Well, at least it's better than Walgreen's. They somehow managed to mess up EMV implementation nationwide, and a software glitch causes EMV chips to not be read, but when you swipe, it tells you to use the chip. Try using this chip again and it won't work. I have literally taken the 10 millionth call today asking me why their card was declined at Walgreen's.

The best part, is where Walgreen's corporate is fully aware of the issue, and is working on a fix (it's been over a month), but they have failed to inform ANY of their store managers or cashiers that the issue is with the chip reader......

/rant

Re: How a criminal ring defeated Chip & PIN cards

Anonymous — Sun, 01 Nov 2015 06:32:23 GMT

@Anonymous wrote:
I am sure everyone commenting has read the article, but may have missed a very important and significant piece of information. This hack was done when PIN was verified at the terminal by communicating with the chip on the card. That's why this hack worked. This is not the case anymore. Hasn't been for a few years, Now the PIN is verified by the card issuer and NOT programmed in the chip on the card. Unless someone knows your PIN, stolen card isn't going to work. This also why FBI warned about using the PIN instead of signature for EMV cards.

Let's not sound the alarm just yet. Everything is under control.

I just got a Revolut prepaid card (UK card, but apparently available to Americans too) to play with and the PIN's most definitely still checked on that card (and possibly others). Though if we ever go from signature to PIN for US chip cards the issuers will llikely be the ones verifying the PIN as you said.

Also as a note, issuers will actually need to auto-decline transactions where a PIN wasn't transmitted in order for the hole to be completely closed; there's another vulnerability where the card's made to look like a chip and signature card, skipping the PIN prompt altogether. Though since stores like Walgreens apparently don't support PIN at all right now, that might be difficult.

Re: How a criminal ring defeated Chip & PIN cards

Anonymous — Wed, 04 Nov 2015 14:17:36 GMT

I just got a Revolut prepaid card (UK card, but apparently available to Americans too) to play with and the PIN's most definitely still checked on that card (and possibly others).

I am very curious; how do you know that the PIN is stored on the chip?

I have changed my PIN on WF and BofA cards; both are EMV and PIN was change was requested over the phone. New PIN was mailed to me. Cards did not touch any ATM or a POS terminal, just to rule out the possibility that it there was any reprogramming done, not that a POS can do it anyway.

Re: How a criminal ring defeated Chip & PIN cards

Anonymous — Wed, 04 Nov 2015 15:16:28 GMT

@Anonymous wrote:
I just got a Revolut prepaid card (UK card, but apparently available to Americans too) to play with and the PIN's most definitely still checked on that card (and possibly others).
I am very curious; how do you know that the PIN is stored on the chip?

I have changed my PIN on WF and BofA cards; both are EMV and PIN was change was requested over the phone. New PIN was mailed to me. Cards did not touch any ATM or a POS terminal, just to rule out the possibility that it there was any reprogramming done, not that a POS can do it anyway.

The instructions for Revolut specifically say that you have to enter the old PIN one last time for any PIN change to take effect, which implies that the PIN is on the card.

Re: How a criminal ring defeated Chip & PIN cards

Anonymous — Wed, 04 Nov 2015 18:44:39 GMT

tmiw, I respectfully disagree with your assumption based on stated observation. It is a security mechanism just to verify the ownership of the card. POS terminals can not re-program a smartcard chip; only read access.

Re: How a criminal ring defeated Chip & PIN cards

Anonymous — Wed, 04 Nov 2015 18:56:47 GMT

@Anonymous wrote:
tmiw, I respectfully disagree with your assumption based on stated observation. It is a security mechanism just to verify the ownership of the card. POS terminals can not re-program a smartcard chip; only read access.

Issuers can instruct the POS terminal to send specific commands to the chip though, which can do things like change the PIN stored on the card. Also, I ran a program called cardpeek on that particular card and got the following for the "cardholder verification list":

Apply succeeding CV rule if this rule is unsuccessful: Enciphered PIN verified online - If unattended cash
Apply succeeding CV rule if this rule is unsuccessful: Plaintext PIN verification performed by ICC - If terminal supports the CVM
Apply succeeding CV rule if this rule is unsuccessful: Enciphered PIN verified online - If terminal supports the CVM
Fail cardholder verification if this CVM is unsuccessful: Signature (paper) - If terminal supports the CVM
Fail cardholder verification if this CVM is unsuccessful: No CVM Required - If terminal supports the CVM

The bold indicates that a POS terminal is going to verify the PIN on the card if possible. Verification with Revolut's servers is only if verifying the PIN on the card itself doesn't work.

Re: How a criminal ring defeated Chip & PIN cards

Anonymous — Wed, 04 Nov 2015 20:50:04 GMT

tmiw, I stand educated.

I have put my Amazon card to good use. I will be taking a peek at all of my cards tomorrow.

Can you tell by looking at the information using cardpeek, if the chip allows write operation? I know that my office access card does get updated every time it is inserted in the reader. We are told this is done for redundancy and audit. We were also told that if someone has a wild idea of sticking a chipped bank card into office access points, nothing will happen since chips on those cards are locked and can not perform write operations even if instructed by the chip reader/writer.

Re: How a criminal ring defeated Chip & PIN cards

Anonymous — Wed, 04 Nov 2015 21:14:53 GMT

@Anonymous wrote:
tmiw, I stand educated.

I have put my Amazon card to good use. I will be taking a peek at all of my cards tomorrow.

Can you tell by looking at the information using cardpeek, if the chip allows write operation? I know that my office access card does get updated every time it is inserted in the reader. We are told this is done for redundancy and audit. We were also told that if someone has a wild idea of sticking a chipped bank card into office access points, nothing will happen since chips on those cards are locked and can not perform write operations even if instructed by the chip reader/writer.

cardpeek is read-only so it's not really possible to use it to determine whether a card is writeable. However, you can usually get a good idea from the mailers issuers are sending with their new cards (they'll likely say that you need to use it somewhere with an attendant after changing the PIN or similar).

Re: How a criminal ring defeated Chip & PIN cards

Open123 — Sat, 07 Nov 2015 20:43:00 GMT

@14Fiesta wrote:
Well, at least it's better than Walgreen's. They somehow managed to mess up EMV implementation nationwide, and a software glitch causes EMV chips to not be read, but when you swipe, it tells you to use the chip. Try using this chip again and it won't work. I have literally taken the 10 millionth call today asking me why their card was declined at Walgreen's.

The best part, is where Walgreen's corporate is fully aware of the issue, and is working on a fix (it's been over a month), but they have failed to inform ANY of their store managers or cashiers that the issue is with the chip reader......

/rant

To Trader Joe's credit, today I notice they've opened up a "cash only" register.

After a month or so, the changeover to EMV is noticeably slower. Lines are longer and move much more slowly. Now, when going to Trader Joe's, I'm going to start carrying cash, which I haven't for years. Short line, use a rewards card. Long line, pay cash.