When organized crime applies academic results: a forensic analysis of an in-card listening device

Abstract

International audienceThis paper describes the forensic analysis of what the authors believe to be the most sophisticated smart card fraud encountered to date. In 2010, Murdoch et al. (IEEE Symposium on Security and Privacy, pp 433–446, 2010) described a man-in-the-middle attack against EMV cards. Murdoch et al. (IEEE Symposium on Security and Privacy, pp 433–446, 2010) demonstrated the attack using a general purpose FPGA board, noting that “miniaturization is mostly a mechanical challenge, and well within the expertise of criminal gangs”. This indeed happened in 2011, when about 40 sophisticated card forgeries surfaced in the field. These forgeries are remarkable in that they embed two chips wired top-to-tail. The first chip is clipped from a genuine stolen card. The second chip plays the role of the man-in-the-middle and communicates directly with the point of sale terminal. The entire assembly is embedded in the plastic body of yet another stolen card. The forensic analysis relied on X-ray chip imaging, side-channel analysis, protocol analysis, and microscopic optical inspections

The EMV Standard: Break, Fix, Verify

“…Even though Murdoch et al's attack comes with some engineering challenges, such as miniaturizing the MITM infrastructure, these challenges appear to have been overcome as observed in the aforementioned forgery of credit cards in France and Belgium [10]. Our analysis demonstrates that this attack still exists in old cards that support neither asymmetric cryptography nor online PIN verification (see Section V-A).…”

“…The MITM attack reported by Murdoch et al [1] is believed to have been used by criminals in 2010 -11 in France and Belgium to carry out fraudulent transactions for ca. 600,000 Euros [10]. The underlying flaw of Murdoch et al's attack is that the card's response to the terminal's offline PIN verification request is not authenticated.…”

Guidelines for Writing a High-Quality Thesis with the PSIThesis Template

“…Do not mix italics and quotes for emphasis, because this confuses the reader. 16 Generally, we recommend avoiding scare quotes. 17 Some authors use scare quotes to signal that they are using a word in a non-standard, ironic, or otherwise special sense (cf.…”

Unconditionally Secure Credit/Debit Card Chip Scheme and Physical Unclonable Function

“…Therefore the system, and the consistency of the measured and exchanged voltage and current data with known cable parameters and model, can be checked continuously and deterministically without destroying these data, which is totally different from the case of a quantum key distribution. The same defense method provides natural immunity against the man-in-the-middle attack [11], which was part of the successful credit card attack described before [1].…”