Hacker News Reader

Comment by Daniel_sk | Hacker News Reader

There is a clever solution to this from a bank in Slovakia (Tatrabanka), you can use their mobile banking application to generate a one-time numerical code for the withdrawal. So you can just generate the code and enter it on any ATM that is owned by this bank. You don't need to have the card with you (and you can forward this code to your wife for example). Also 100% of cards in Europe are also protected by PIN, so simple skimmers won't work.

View on HN

PIN does not protect you from skimmers... Everything you need is on the magnetic stripe, PIN is only needed if you use the chip - which an attacker obviously wouldn't.

The whole concept of chip+pin is pretty pathetic considering that the magnetic stripe is still there for backwards compatibility.

And now with wireless cards it is even less secure than a magnetic stripe.

Ok, I didn't know that. But I have never used the magnetic strip in Europe, I don't think anyone accepts it here. My previous bank would even issue standard debit cards without the magnetic strip. So how would you use the card without the PIN? Can you read the whole card number + expiration + CVV code and then buy something online?

In Sweden it is not that uncommon (majority of readers take both chip+magnetic stripe). Also, ATMs swallow the whole card so a skimmer would work there even if the ATM itself only uses the chip. And now with wireless you could probably trivially skim people that used the chip (or wireless) functionality as well.

I have never seen a card without magnetic stripe, that is awesome. I even have some trouble getting a card without wireless...

At least whole card number + expiration is on the magnetic stripe. You don't need CVV as it is optional. Everything is written in clear-text and by definition that text must contain everything needed to perform a purchase.

As I described below, all of this is part of Authorization, in principle an old-fashioned carbon impression sheet of your card could be used to justify a $5000 payment and it's up to you to contest that if it's bogus. Authorization protects the bank, not the customers.

But for the Authorization a PIN absolutely can be required for online card transactions using a mag stripe. And this was routinely done in countries which had PINs for debit cards years before EMV. The terminal calls the bank and says I have this card, and here's the PIN entered by the customer, is that OK?

Unlike the mag stripe you can't clone a card using the "wireless" EMV mode, the chip isn't just playing back a fixed data stream, it's an active component.

[ It might be instructive to expand here, so I shall ]

A part of an EMV transaction the terminal and card are supposed to pick random ("unpredictable") numbers each time. If this is done correctly it presents a significant security feature. For example, suppose tomorrow I plan to tell a jewellery store's payment terminal that your card, which I was able to access briefly today when you were in the same elevator as me, authorises purchase of a $500 watch, then I'll pawn the watch and keep the cash. Well, I need the cryptographically signed message from your card saying this is authorized. But, that message needs the unpredictable number that the jewellery store terminal will choose tomorrow, which I don't know yet, so I can't do it.

Now, in practice researchers found some terminals and cards are crap and e.g. the numbers they use aren't truly unpredictable. But that's an implementation flaw that can be fixed, just the same as if your bank has a habit of leaving the back door open and the vault unlocked. It's something your defence attorney should know if the bank accuses you of fraud for someone else's transaction, but it's not an inherent problem in "wireless" EMV.

The whole point is that the attacker can opt to withdraw funds using a site/service/xxx that doesn't perform such authorization. I've only seen such authorizations be used on domestic sites, an attacker would probably even prefer to withdraw funds from a country other than that of the victim.

Making the whole endeavor pointless.

Absent the authorization you can just unwind the transaction, since there's no evidence whatsoever that you authorized it. It will depend on how strong consumer protection is as to whether this actually leaves you financially whole afterwards or whether the bank is able to get away with just giving back the money for the single transaction.

To the extent that Authorization isn't mandatory before the Payment step, sure, everything about payment cards is "pointless". Banks have decided they don't care about fraud and will just pass that cost on to you. shrug

You can do that if the bank decides that you have not been negligent. Whether you have been negligent seems to be correlated with how much money was taken from you ;)

Anyway, it is pretty immoral to rely on reimbursements - actively funding and making thievery profitable.

During my visit in the US, sometimes my European creditcard would not work with magnetic stripe, the dealer telling me to use the chip. There were some terminals which had a non working chip-reader, you had to enter the cardnumber + CVV to pay.

Not sure what your point is, the success rate of a magnetic skimmer would be 100% regardless.

That the home bank somehow knows that you just used the magnetic stripe and says "I want the chip". Of course skimming (the act of reading and copying the magnetic data) still works, but payment not.

My memory is hazy on this but I believe there is a bit on the magnetic stripe that says "hey, I have a chip please use that instead". And if the terminal supports chips it will probably ask you to use the chip instead.

If the terminal does not have a chip reader (or doesn't parse that information) it will allow the purchase. If you are cloning the magnetic stripe you would of course reset that bit and you would be all good.

I've seen you claim wireless cards are really insecure a few times in this thread. I was wondering about a source, and about the mechanism.

Certainly, using rather basic NFC smart card technology, all but on-line attacks could be eliminated. My question is then, what kind of low-protection protocol do they use in practice to make this so insecure.

Specifically, I am asking about an offline attack that allows an actual spend the bank would accept. I am also only interested in debit cards (because that is what I have) so just reading a CC number from NFC doesn't bother me.

My "Party trick" when NFC payments was newish in the UK was using a pair of Nexus S phones in a relay attack.

I would say to a friend "I bet I can buy the next round using your card, if I can you buy the round if not I'll buy the round" Get them to place their wallet with their card in it on the table with one of my phones near the wallet and I would present my other phone to the reader at the bar.

At the time the bar I did it at had public wifi without Wireless Isolation so I could use the bar's wifi as a low latency connection between the two phones but back then the tolerances on the timings would allow you do do it with a decent mobile connection. (At one point you could just get a NexusS custom rom already set up for this replay attack).

It was more of a party trick as you had to have close proximity to the payment card as it was just a relay attack and the banks limited NFC transactions to a max of £20 which the banks would cover (its been bumped upto £30 these days or more if you auth with biometrics like with Apple Pay if the store permits the transaction).

I believe NFC payment terminals these days have tightened up the timings of card reads to make such relay attacks more difficult.

Yeah, active attacks are where PIN-less NFC gets really scary. That said, just losing such a card is also scary.

It amazes me how timing makes it possible to detect this kind of stuff.

I've never been asked for a pin when using NFC payments (if you don't count the times I've used my phone) but I mix my card transactions up all the time between cash width drawls, Chip and Pin payments and NFC so I guess the "ask for a pin counter / algo" gets reset when I use a pin in Chip and Pin / ATM.

I believe that after so many NFC payments (without reseting the count) or try and make a purchase over £30 they ask for a pin and my bank will cover any NFC payments on a lost card as long as you make them aware of the loss within a reasonable time period. So personally I'm not too worried about losing my NFC card. They know its not a perfect system (is anything perfect?) so limit their loss by restricting the amounts used on such cards.

EDIT: Esp as a lost card could be used for online transactions as they have the CVV (as they have the card) and losing your card prob means losing your wallet and prob your driving license with your address on it (almost everything a bad actor needs to make an online purchase, just got to hope that Verified by Visa / Mastercard SecureCode kicks in).

I actually need the PIN for any payment over €25, which can still be done with NFC. Besides that, I'd say I still need to enter my PIN for small payments roughly once every 2 weeks.

I believe the "purchase over £30" in the UK is dependant on the store. Instead of asking I've just use Chip and Pin for such transactions. But yeah never had the "enter your pin" for small NFC payments. Guess the bank thinks I'm a low risk :-p

(Now I've said it I bet the next time I use NFC it will pester me for a pin :-p)

In the Netherlands, its something along the lines of "Every x payments, you need a PIN". I'd guess that any payment with PIN resets the counter.

I was discussing with colleagues how smart the interval is. Perhaps the bank is doing some anomaly detection to inform whether a PIN is needed.

Why would just reading a CC number and expiration date not bother you? (on lots of cards they are just plain-text for anyone who asks)

Because I use a (Dutch) debit card. This is not a Credit Card, so it does not have a real card number (it has a 4-digit number to identify it among potential other cards issued for my account). I just checked, and was surprised to see it had an expiration date, because that does not play any role in authentication.

Note that I am coming at this from the perspective "Is payment in my country done well". So I only care about attacks against my card, and the cards of people I know.

It does seem stupid to me to have a CC number and expiration date available in plain text. But honestly, I am more amazed by that information being sufficient to authorize payment. That said, it amazes that 'upgrades' both neglect to fix the underlying issue, and fail to take it into account in their implementation.

Besides this entire story, there is an interesting issue of PIN-less tap-and-pay, which scares me more (from the dutch perspective) than plaintext data on my NFC card. It doesn't scare me enough to disable it though.

How do you purchase something on international sites?

I totally agree that the requirements to authorize a transaction is laughable. Even more so that the information is printed on the card itself, insane.

I use paypal when possible. Otherwise, I have a separate, rarely used, credit card. The card has no NFC.

Notably, every time I've used it on-line, it forwarded me to my banks website, where I needed to do a 2 factor thing. I'd guess that is vendor-dependent though. I can't imagine US webshops are setup for that. (Most of my usage is amazon.de)

BBVA in Spain has the same thing, it directly asks which phone number to send the code to, in case you want another person to withdraw the money: https://www.youtube.com/watch?v=Hb6KNWSKXmE

Same in Portugal (for all banks, as we have a single ATM network owned by all of them).

Does it work without a mobile data connection? Regardless this is a great idea and I would love to know what it would take to convince other banks to do the same.

It doesn't - but usually everyone has a mobile data plan here and coverage is great, so it's not a concern. In the rare event you can use the card as backup. I wish this was some sort of standard between banks. But thankfully this is the biggest bank in the country, so their ATM is usually very close to you (there is no special hardware, it's an ordinary ATM - with just a menu option of entering the one-time code).

Reply on news.ycombinator.com