Would chip-and-PIN have prevented the Target breach?
As we all know, Target was breached and the hackers stole lots of credit card numbers. Target is now advocating for chip-and-PIN, as a way to provide better security for credit cards. This makes me wonder. If chip-and-PIN had been in place, would it have prevented the breach? Or would the attack still have been possible (merely forcing the attackers to shift their methods slightly)? Is this just PR, or would chip-and-PIN have made a significant difference against the kind of attack seen in the Target breach?
Recall that, in the Target breach, the attackers were able to compromise Target's point-of-sale terminals: not just one of them, but all of them. Is chip-and-PIN secure in that threat model, where the attacker controls the point-of-sale terminals?
Does it depend upon whether credit cards contain both a chip and a magstripe (for backwards compatibility with legacy systems), or if they contain just the chip (and no backwards compatibility)? My impression is that the way this gets deployed is: first we have credit cards that support both chip-and-PIN as well as a legacy magstripe; then after some period of time, when there is sufficient deployment of the chip-and-PIN terminals, then credit card companies might start providing credit cards that have only the chip but not the magstripe. Does that affect the analysis? For instance, is the answer that if credit cards had both the chip and the magstripe, then a compromised point-of-sale terminal can steal the credit card number and CVV off the magstripe nad then clone the card, but if credit cards had only a chip, then they couldn't?