Hot answers tagged smartcard
13
From an end user perspective, i usually give the reader and surrounding plates a good whack with my fist and i try and peel back any of the faceplates with my keys or a knife. The fact of the matter is, the best quality skimmers aren't detectable. POS machines can be hacked which results in an almost undetectable scenario. Your best bet, if you want to avoid ...
10
Citing from Smart card handbook By Wolfgang Rankl, Wolfgang Effing
The HASH option of the PERFORM SECURITY OPERATION command can be used to compute a hash value. The command may transfer either the data to be hashed or a hash value already computed outside the smart card along with the data needed for the final step of the computation. In the latter ...
9
As stated, that policy is weird. For a true digital signature (as in RSA or ECDSA), the message to be signed is first hashed, and the rest of the operation uses the resulting hash value only. The hash computation uses only public elements; there is no key in the hash. Therefore, requiring part of the hash computation to be performed on the smartcard makes ...
9
The backdoor that you are describing can be installed if you have code execution on the ATM. This research, as well as methods of obtaining code execution on an ATM where pioneered by Barnaby Jack and are detailed in his BlackHat (and defcon) 2010 Jackpotting ATMs talk.
9
Assuming the laptops to run under Windows, you would need the following:
a PKI solution to initialize and manage smart cards; each smart card will contain a private key and the associated certificate;
to enable smart card logon so that users open a session on the laptop with the smart card, instead of a password (the smart card itself will require entry of ...
7
The newest skimmers cannot be seen. These skimmers wafer thin and insert into the card reader:
To make matters worse the modification can be purely software. ATMs can be hacked, their software can be modified to log the mag strips and pins of every user.
This is a purely loosing battle and you take a chance every time you use an atm. Security is ...
6
I think this is to ensure that the response entered into the website is a fresh(ish) one. If the one time password was generated directly then it could be used at any point in the future, the server has no way of checking when it was generated. By providing the challenge to the card it means that the response generated can only be used for the transaction ...
6
EMV cards and smart cards in general do indeed have an embedded private key and enough horsepower to do the crypto math needed to sign a transaction without revealing the secret.
https://secure.wikimedia.org/wikipedia/en/wiki/EMV
https://secure.wikimedia.org/wikipedia/en/wiki/Smart_card
6
There is a security standard for smartcards under the Common Criteria scheme: the Smart Card Protection Profile. A protection profile defines the security properties that are expected from a device or system.
The smart card PP is defined for EAL4+. To put it succintly, the EAL defines what aspects of the product's design are evaluated and to what extent ...
5
Here's an interesting paper about the security of smart cards (in debit cards) used for online banking security in the UK under the CAP scheme.
http://www.cl.cam.ac.uk/~sjm217/papers/fc09optimised.pdf
Here's a link from the UK with nice details about chip and pin systems:
http://www.lightbluetouchpaper.org/2010/02/11/chip-and-pin-is-broken/
We ...
5
Have a read of the How to get into RFID auditing question as there are some very useful links there.
Contactless cards and RFID cards are just a small computing core with some limited functionality and a radio transceiver which not only powers the card when a radio signal is present, but also receives and transmits data within a small range.
The key usual ...
5
In the Windows world, cryptography with special hardware goes through the "Cryptographic Service Providers" (CSP). A CSP is a module registered in the OS, which offers access to such a kind of hardware.
From C#, you can look at RSACryptoServiceProvider, which can be created with some parameters which designate a specific CSP.
The non-Windows world tends to ...
5
Smartcard communication protocols follow well-established standards (connector size and location, voltages, signals, logical transport protocol...) so chances are that card readers are indeed interchangeable. If the bank sent you both the card and the reader then there is a slight probability that they did something fancy which compromises interoperability, ...
4
If you don't want to read straight from standards, and you are looking something in book form, this is a nice primer, (fairly) entry level into smart card security: http://www.amazon.com/Smart-Cards-Tokens-Security-Applications/dp/1441944265 . It's written by two university professors and is the course book on a msc course about smart cards.
For a more ...
4
Depending on what you are looking for there is a lot of technologies covering the smart card topic. Some of them coming to my mind:
ISO 7816: cards with contact http://www.cardwerk.com/smartcards/smartcard_standard_ISO7816.aspx
ISO 14443: contactless smart cards
http://en.wikipedia.org/wiki/ISO/IEC_14443
PKCS#15: Cryptographic Token Information Format ...
4
WRT to smart card being used as an authentication factor for computer access, the private key on the smart card can be protected by a PIN/password. So the smart card auth can also provide the additional factor of "what you know" in addition to "what you have."
For most users, the risks are acceptable when compared to the cost of managing ...
4
There are a few different types of Smart Cards, here are the types my old Dell 6420 supports:
Type "A" : ISO14443A — 106 kbps, 212 kbps, 424 kbps, and 848 kbps
Type "B" : ISO14443B — 106 kbps, 212 kbps, 424 kbps, and 848 kbps
HID iClass
Contactless
ISO15693 (Proximity card)
FIPS201 see also NXP Fire
What are you going to use the Smartcard for? ...
4
EMV is a communication protocol, and by implication it specifies what data must be stored on the credit/debt card. It doesn't specify what technical measures protect the card as a physical device. EMV is irrelevant to your question.
To understand why a chip isn't so easy to duplicate, read about the physical security of smart cards. There isn't much public ...
4
Simply storing a secret on a piece of hardware doesn't help secure anything, (god forbid) we have USB sticks for that. The secret must never leave the piece of hardware in order for it to be effective. A device like a smart card is effective in two-factor authentication because it handles the challenge response.
If your device is as effective as a ...
3
Smart card are based on standards defined for hardware and the software (operating system) residing in them. There are many standards which defines the hardware features. You can read through some smart card topics in net for hardware interface and design of an smart card.
In short I will try to give some answers below:
The contactless cards are better ...
3
Sure, but this makes a certain set of assumptions.
The OTP is event-based, not time-based
You have to be tracking previously used tokens
You have to track expected future tokens
The user doesn't have the ability to reset their OTP sequence with the initial seed
In theory with an event-based OTP once you use it anything generated before it is unsuable ...
3
I know of a range of organisations who use smartcards either for access to buildings, access to computers or terminals (eg citrix) or for both. It is the sort of organisations you would expect - ones that have a high impact if unathorised access is gained by an attacker.
Also, as @ewanm89 commented, most European bank cards are now smart cards - and some ...
3
CAC cards themselves are used only by the US Department of Defense. But similar cards are used elsewhere. By 'similar' I mean embedded-chip plastic cards that carry a picture and other secure identity information and that use PKI.
Malaysia's official ID card MyKad (also carries fingerprint)
Many EU countries, including Estonia's official ID card ...
3
Wow. Cool Reader!! I wish I could say I'd tried it, it's very enticing.
From a solid understanding of SmartCards, though, I don't think you are going to get away without entering the password. The password is protecting the keys on the Smart Card, not the usage of the device. These keys need to be protected from use on your device, or any other device - ...
3
Found the solution myself.
There is one smart card platform that implements Java Card 3.0.1 Classic, available as a smart card and as a USB token:
Sm@rtCafé Expert 6.0
StarSign Crypto USB Token
There also seems to be some similar card from CardLogix.
However, these are all Java Card 3.0 Classic, which is very close to Java Card 2.2.2. The minute ...
3
The problem with what you ask for is about sharing the keyboard with the OS. When a keyboard is plugged in a machine, then the operating system on that machine is made aware of every key press and key release event, and the OS maintains the knowledge of which key is pressed at any time. For your PIN entry scenario, you not only need the key presses to be ...
3
The best you can really do is use ATMs you know or ATMs that have good physical security if one you know isn't available. (go to an ATM inside a bank). Even then, I always spot check the machine for any signs of tampering.
A simple trick that can work well is to make sure the keypad isn't compromised (by looking and pulling on it) and then if it appears ...
2
Typically for parking and cashless vending systems, the actual funds reside on a server or IT storage database and simply reference the balance of money on an account that is linked to the card number, this way if a card is lost or stolen, the card can simply be withdrawn and blocked and a replacement card issued which would then be connected to the existing ...
2
There's a (longish) talk about biometrics and RFID that has a discussion of some of the problems with RFID cards, including weak/broken security mechanisms, security mechanisms that aren't (i.e. that are claimed to be present by the vendor but aren't), and the fact that the contactless interface introduces new methods of attack that aren't present in contact ...
2
Many companies use various hardware devices (e.g., RSA SecurID) for authentication. I don't know how many other organizations use smartcards (like the CAC card) for security.
One limitation of smartcards and CAC cards is that they do not protect against malware on your PC (e.g., the man-in-the-browser attack). In particular, malware on your computer can ...
Only top voted, non community-wiki answers of a minimum length are eligible
