Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

It's frequently stated that EMV cards cannot be cloned. I'd like to know, specially with commodity smart card readers/ writers, why is this true? What specific data cannot be read using commodity hardware, and what type of hardware would be required to do so?

share|improve this question
    
EMV is beyond the card itself. There's a chip on the card that cannot be cloned, thus defeating the efforts of cloning the card by skimming it over a reader. –  Nathan C Dec 2 '13 at 16:03
    
That's my question: why cannot the chip be cloned? –  Jaywalker Dec 2 '13 at 16:09
2  
It's a physical device on the card itself, not "virtual" or encoded onto the card. –  Nathan C Dec 2 '13 at 16:10

4 Answers 4

up vote 5 down vote accepted

To use an analogy, expanding on what people have said about it being a chip:

An older style magstripe card was simply a string of characters encoded onto the card, it could be read, or written, and that was it. It's like a page of a book, you can read it, but if you don't understand, you can't ask it questions.

An EMV chip is a small microprocessor. It runs a specific application. You can't just read what it knows, but you can 'ask' it 'questions' by issuing commands from the EMV set, and see what it returns. Unlike Magstripe, it's interactive, and is capable of both answering and more importantly, refusing to answer queries.

All of this is a little simplified. Encryption obviously plays a large role in EMV, and it's much complex than just some little microbug that you can interview, like I make it sound, but the essence is there.

Like @Lucas Kauffman has mentioned, EMV isn't unclonable, but it is significantly more difficult, at least if you start from first principles. As with many security issues, these complex differences will start to mean less and less now that vulnerabilities have been found, because it will be possible to buy cloners without needing to know how they actually work.

share|improve this answer
    
Like your answer in general; would you like to add more explanation to the first sentence of the third para: "An EMV chip is a small microprocessor, and hence cloning actually means...." –  Jaywalker Dec 6 '13 at 17:52
    
Ok, well, the chip actually runs software, so rather than being a list that can be read, or a file that can be opened, it's a program that will take input, and return output based on the results of its program code. To successfully clone a card, you need to create another card that provide the right answer to any input challenge, and to do that, you have to work out what the process is. –  Owen Dec 9 '13 at 10:16
    
@Owen: No, you have to work out what the cryptographic secret stored in the chip is. Generally, the process (or algorithm) should be considered to be well known - otherwise, how would anyone know it's cryptographically secure. –  Lawrence Dol Jan 24 at 0:43
    
@SoftwareMonkey It is good practice for a designer to assume the attacker knows the algorithms (and pick well-analyzed cryptographic algorithms and protocols) plus the communication protocol. That does not imply they actually are published, so as an attacker, you may still need to figure them out, in addition to the key itself. –  Christopher Creutzig Jan 24 at 6:34
    
@SoftwareMonkey: Working out what the cryptographic secret is necessary yes, but so is working out what algos and crypto system are being used, which would be the process I referred to. The question was quite simple, so I simplified the answer too. Card distributors actually don't yell about what crypto they're using, although they obviously release this info to some people, like the manufacturers of POS systems. To clone cards and such, you do need to do a bit of working out what process is in use. –  Owen Jan 24 at 12:39

The chip is actually a device which can perform calculations execute instructions. It's used for challenge response as to authorize attackers. It's therefor not possible to just clone them.

There are attacks against the EMV cards as demonstrated by the University of Camebridge. They published a paper about it named "Chip and Skin: Cloning EMV cards with a preplay attack".

The attack heavily relies on flawed random number generator used by the bank terminals. There is also a Defcon presentation on chip & pin which can be found here.

I attended an OWASP chapter meeting last year where Senior Cambrdige ResearcherSteven Murdoch presented their attack. He also noted that recently criminals had realized to reduce the attack for which they needed a complete PC in a back pack, to a simple chip which can be fit in plastic banking card (the chip itself was a mere 3 mm longer).

share|improve this answer
    
The good news is that by updating the faulty POS terminal such "preplay" attacks against predictable nonce values are immediately thwarted. Updating 100,000 POS machines is much more practical and cost-effective than replacing 1000,000,000 cards (because the chip code is flawed). –  Lawrence Dol Jan 24 at 0:50

The key is that EMV cards don't just output the same response every time. They're a challenge-response system: they work by reading a "challenge" message from the terminal, doing some computation within the chip, and then outputting a unique "response" message back. If you capture that response, you're only capturing one possible output -- the one that corresponds to the challenge it was sent. Since a terminal should never output the same challenge twice and the challenge should be unpredictable, then that capture response should be useless in the future.

In order to fully clone an EMV chip, you need to know the secret that's stored inside it. Since it never transmits that secret, obtaining it is impractical.

This in contrast to other identification technology such as RFID and magnetic stripes which only know how to transmit one number. In the case of these technologies, cloning that output is reasonably simple.

share|improve this answer

The chip on EMV cards is a physical device, so you can't simply clone the card and expect it to work in a POS terminal. This is the entire point of the Chip-and-PIN system.

share|improve this answer
3  
Begging the question. You can't answer the question "why can X not be cloned", with "because X can't be cloned, that's the whole point of X". –  Lawrence Dol Jan 24 at 0:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.