Hot answers tagged

192

You can't clone the chip. A magnetic strip holds a secret number, and if someone knows that number they can claim to be the owner of the card. But if a bad guy swipes the card, they then know the number, and can make their own card, i.e. "cloning". This has turned out to be a major practical problem with magstripe cards. A chip also holds a secret number. ...


58

The chip carries out a cryptographic operation on data passed to it that requires knowledge of the key that is strongly protected within the chip - so an attacker cannot easily copy the card. That said, there have been some successful research papers on timing or power attacks, but these are from lab conditions, and probably not a real worry in the wild. ...


34

A satellite TV system must face the following challenge: it is one-way. The receivers cannot do anything but receive; they cannot emit anything. The generic problem is known as broadcast encryption. In practice, things go that way: Each subscriber has a smartcard, and that card contains a key Ks specific to that subscriber. The media stream is encrypted ...


27

From an end user perspective, i usually give the reader and surrounding plates a good whack with my fist and i try and peel back any of the faceplates with my keys or a knife. The fact of the matter is, the best quality skimmers aren't detectable. POS machines can be hacked which results in an almost undetectable scenario. Your best bet, if you want to avoid ...


26

The magnetic strip contains the exact information used to identify the card. The chip holds a piece of information that it doesn't share, but that it can use to prove it has that information. Thus, a magnetic stripe is dumb and can be copied, but since the chip doesn't give out its secret, a vendor can't simply copy it when you use it. A magnetic stripe ...


15

This is just some extra information but it didn't fit as a comment under Thomas' answer. There's an interesting pirating method that have made it possible for the cycle to extend way longer than two weeks. It's called CardSharing. Here's how it works: Somebody buys a legitimate card and inserts it into a modified satellite receiver that will use the card ...


14

Other answers already given are correct, but I would like to give the following as an answer with no technical background required on part of the person asking: When you use a magnetic strip Credit Card, the device is saying to the card: "My user will input a PIN to verify, let me read your strip so I can check it". ( EDIT: OK, the above paragraph is not ...


11

Citing from Smart card handbook By Wolfgang Rankl, Wolfgang Effing The HASH option of the PERFORM SECURITY OPERATION command can be used to compute a hash value. The command may transfer either the data to be hashed or a hash value already computed outside the smart card along with the data needed for the final step of the computation. In the latter ...


11

The newest skimmers cannot be seen. These skimmers wafer thin and insert into the card reader: To make matters worse the modification can be purely software. ATMs can be hacked, their software can be modified to log the mag strips and pins of every user. This is a purely loosing battle and you take a chance every time you use an atm. Security is ...


11

NIST has defined in NIST Special Publication 800-22 an extensive set of statistical tests for verifying a source of randomness. However, while this is good enough to assert that a RNG is not obviously broken, it isn't sufficient to assert that a RNG is "good". It is the nature of RNGs that very subtle flaws can lead to breaking it. The only proper way of ...


10

Does the smart card ever "reveal" the private key to applications like SSH or GPG? If so, it seems anyone who has the PIN and the device itself can still get at the private key, and offers no advantages over regular USB drives. If not, how exactly do applications work without knowing the private key? Ideally, No. The primary advantage of such a token ...


10

As stated, that policy is weird. For a true digital signature (as in RSA or ECDSA), the message to be signed is first hashed, and the rest of the operation uses the resulting hash value only. The hash computation uses only public elements; there is no key in the hash. Therefore, requiring part of the hash computation to be performed on the smartcard makes ...


10

This wouldn't be a problem at all. As you see in the picture in your link, there is a version with a smaller form factor (ID-000). This is the same card just with cut outs. Everything outside the contact area is just plastic. I made you a drawing in paint showing where the actual IC is in the card. Everything outside this box can be removed without any ...


9

The backdoor that you are describing can be installed if you have code execution on the ATM. This research, as well as methods of obtaining code execution on an ATM where pioneered by Barnaby Jack and are detailed in his BlackHat (and defcon) 2010 Jackpotting ATMs talk.


9

Essentially, each subscriber has a key in their smart card. When a new subscriber is added or changes their service, a new group key is sent over the broadcast system, encrypted with that subscriber's key. The keys to actually decrypt individual programs are themselves encrypted with the group key for the set of services that program belongs to. Legitimate ...


9

You need to run: gpg --card-status and gpg will do it for you: /tmp$ mkdir gpgtmp /tmp$ chmod go-rwx gpgtmp /tmp$ GNUPGHOME=/tmp/gpgtmp gpg --keyserver pgp.mit.edu --recv F8713BDF gpg: sleutelring ‘/tmp/gpgtmp/secring.gpg’ is aangemaakt gpg: sleutelring ‘/tmp/gpgtmp/pubring.gpg’ is aangemaakt gpg: opvragen sleutel F8713BDF van hkp sleutelserver ...


8

There are a few different types of Smart Cards, here are the types my old Dell 6420 supports: Type "A" : ISO14443A — 106 kbps, 212 kbps, 424 kbps, and 848 kbps Type "B" : ISO14443B — 106 kbps, 212 kbps, 424 kbps, and 848 kbps HID iClass Contactless ISO15693 (Proximity card) FIPS201 see also NXP Fire What are you going to use the Smartcard for? ...


8

Smartcard communication protocols follow well-established standards (connector size and location, voltages, signals, logical transport protocol...) so chances are that card readers are indeed interchangeable. If the bank sent you both the card and the reader then there is a slight probability that they did something fancy which compromises interoperability, ...


8

Assuming the laptops to run under Windows, you would need the following: a PKI solution to initialize and manage smart cards; each smart card will contain a private key and the associated certificate; to enable smart card logon so that users open a session on the laptop with the smart card, instead of a password (the smart card itself will require entry of ...


8

Exact cryptography depends on the bank. The communication standard (ISO 7816) is flexible and does not mandate specific cryptographic algorithms. In practice, you would find the two following models: The card does symmetric cryptography only (symmetric encryption, MAC). The card has a static identifier (which contains, roughly speaking, the card number and ...


8

Details depend on bank, card type and country, so they vary quite a lot, but the generic model is the following: The magnetic stripe contains, mostly, a computer-readable copy of the information embossed on the card: account number, holder name, expiration date. The chip contains a secret key which is used to "sign" (not necessarily a true signature; often ...


7

I think this is to ensure that the response entered into the website is a fresh(ish) one. If the one time password was generated directly then it could be used at any point in the future, the server has no way of checking when it was generated. By providing the challenge to the card it means that the response generated can only be used for the transaction ...


7

There is a security standard for smartcards under the Common Criteria scheme: the Smart Card Protection Profile. A protection profile defines the security properties that are expected from a device or system. The smart card PP is defined for EAL4+. To put it succintly, the EAL defines what aspects of the product's design are evaluated and to what extent ...


7

Found the solution myself. There is one smart card platform that implements Java Card 3.0.1 Classic, available as a smart card and as a USB token: Sm@rtCafé Expert 6.0 StarSign Crypto USB Token There also seems to be some similar card from CardLogix. However, these are all Java Card 3.0 Classic, which is very close to Java Card 2.2.2. The minute ...


7

You might want to clarify your question - here's an answer as to why it's safer card issuer: If a magstripe card is stolen it's quite easy for the thief to use it fraudulently - how often are signatures really checked (in fact in the US I've often had the card handed back to me before I've signed, even where extra ID isn't requested). If a chip&pin ...


7

You could wrap up the rest of the answer with "The YubiKeys implements the cryptographic smart card protocol using a programmable microcontroller". So what does this imply? Cryptographic Smart Cards The idea behind cryptographic smart cards is that they're equipped with their own crypto processor, and are able to perform several operations: create keys ...


6

EMV cards and smart cards in general do indeed have an embedded private key and enough horsepower to do the crypto math needed to sign a transaction without revealing the secret. https://secure.wikimedia.org/wikipedia/en/wiki/EMV https://secure.wikimedia.org/wikipedia/en/wiki/Smart_card


6

EMV is a communication protocol, and by implication it specifies what data must be stored on the credit/debt card. It doesn't specify what technical measures protect the card as a physical device. EMV is irrelevant to your question. To understand why a chip isn't so easy to duplicate, read about the physical security of smart cards. There isn't much public ...


6

Have a read of the How to get into RFID auditing question as there are some very useful links there. Contactless cards and RFID cards are just a small computing core with some limited functionality and a radio transceiver which not only powers the card when a radio signal is present, but also receives and transmits data within a small range. The key usual ...


6

The best you can really do is use ATMs you know or ATMs that have good physical security if one you know isn't available. (go to an ATM inside a bank). Even then, I always spot check the machine for any signs of tampering. A simple trick that can work well is to make sure the keypad isn't compromised (by looking and pulling on it) and then if it appears ...



Only top voted, non community-wiki answers of a minimum length are eligible