In June 2010, Omar Choudray submitted a dissertation to the University of Cambridge Computer Laboratory, Darwin College, to be considered for the degree of Master of Philosophy in Advanced Computer Science.
The dissertation was entitled
"The Smart Card Detective" and various organisations want to ban all access to it.
NOTE: EMV is the dominant protocol used for smart card payments worldwide, with over 730 million cards in circulation.
Known to bank customers as Chip and PIN, it is used in Europe; it is being introduced in Canada; and there is pressure from banks to introduce it in the USA too. EMV secures credit and debit card transactions by authenticating both the card and the customer presenting it through a combination of cryptographic authentication codes, digital signatures, and the entry of a PIN.
The dissertation describes and demonstrates a protocol flaw which allows criminals to use a genuine card to make a payment without knowing the cards PIN, and to remain undetected even when the merchant has an online connection to the banking network. The fraudster performs a man-in-the-middle attack to trick the terminal into believing the PIN verified correctly, while telling the card that no PIN was entered at all.
Above is the link to the full paper. It describes fully, how to make such a device. In the paper it is called a
"Smart Card Detective"(SCD). The cost of all components (including two types of LCD and a battery, which is not shown) was around 100. It required about three days of work to assemble the components and wires into the prototype board.
You might like to take a "Copy" of the paper. (Just out of interest, of course, and merely, whilst you still can)
Other more ambitious and criminally minded readers of this paper might like to consider having an 'SCD' made for themselves and even using it for personal illegal gain. (Hence the reason the authorities want access to the paper blocked)
Hmmm? Like some others, it seems to me, that the authorities and banks might be a tadge wrong on this one and might just be codding us along about their security systems, particularly with regard to Chip and PIN technology.