us-15-Fillmore-Crash-Pay-How-To-Own-And-Clone-Contactless-Payment-Devices-wp.pdf

《us-15-Fillmore-Crash-Pay-How-To-Own-And-Clone-Contactless-Payment-Devices-wp.pdf》由会员上传分享，免费在线阅读，更多相关内容在学术论文-天天文库。

1、OverviewofContactlessPaymentCardsPeterFillmoreJuly20,2015BlackhatUSA2015IntroductionContactlesspaymentshaveexplodedinpopularityoverthelast10yearswithvariousschemesbeingpopularinmanydomesticmarkets.Internationallythedominatecontactlesspaymentsstandardhashavebeenfromthet

2、raditionalmajorinternationalcreditcardcompaniesandarebasedaroundtheEMVchipcardprotocols.Utilisationoftheseprotocolshasallowedforthecardsandterminalstosupportcontactlesspaymenttechnologieswithminimalchangestoexistingdevicesinthefield.HoweverduetothesecardsutilsingtheEMVp

3、rotocols;theyalsocarrymanyoftheexistingflawsintheexistingsystems.KeyIdentifiedflawsinEMVsystemsinclude:Abilitytodowngradeauthorizationmethod.[1]Insufficientreplayprevention.[3,10]LackofManInTheMiddleprotection.[7]Noprotectionagainstrelayattacks.[4][6]Insecuregeneration

4、ofrandomnumbers.[5]Plaintexttransmissionofsensitivedata.[2]AdditionallyEMVsoftwareusedincommercialproductshasbeenshowntobevulnerabletobasiclogicalattacks.[9,8]Manyoftheseflawscanbepreventedthroughpreventionontheterminalside;propermonitoringbypaymentprocessorstoensureth

5、attransactionsareusingsecuredefaultsandhavenotbeentamperedwith.ContactlessimplementationsoftheEMVstandardfrequentlysupportsimplifiedprocessingflowstoensurecompatibilitywitholdersystemsandreducethetimeittakestoperformatransaction.Thesealterationsaffecttheabilityofexistingp

6、rotectionstopreventfraudoncards.AdditionallycontactlesspaymentcardsusealteredEMVprocessingflowscomparedtothecontactvariety.Thisisduetotheneedforcompatibilitywitholderpaymentnetworksandfor1transactionstobecompletedquickly.Thisneedintroducesothervulnerabilitiestothesystem

7、inwhichtheyareused.AnoverviewoftheEMVstandardsTheEMVstandardisapubliclyavailablesetofdocumentsavailableathttp://www.emvco.com.Thesestandardscoverthephysicalandlogicalpropertiesofthecards,terminalsandprotocolsusedintheEMVworld.CardsandterminalsarecertifiedforusebyEMVcoto

8、ensuretheyinteroperatewitheachothersafetelyandreliably.Certificationisperformedthroughindependentlaborato-riesinternat