Tag Info

Hot answers tagged

22

From an end user perspective, i usually give the reader and surrounding plates a good whack with my fist and i try and peel back any of the faceplates with my keys or a knife. The fact of the matter is, the best quality skimmers aren't detectable. POS machines can be hacked which results in an almost undetectable scenario. Your best bet, if you want to avoid ...


22

A satellite TV system must face the following challenge: it is one-way. The receivers cannot do anything but receive; they cannot emit anything. The generic problem is known as broadcast encryption. In practice, things go that way: Each subscriber has a smartcard, and that card contains a key Ks specific to that subscriber. The media stream is encrypted ...


10

As stated, that policy is weird. For a true digital signature (as in RSA or ECDSA), the message to be signed is first hashed, and the rest of the operation uses the resulting hash value only. The hash computation uses only public elements; there is no key in the hash. Therefore, requiring part of the hash computation to be performed on the smartcard makes ...


10

Citing from Smart card handbook By Wolfgang Rankl, Wolfgang Effing The HASH option of the PERFORM SECURITY OPERATION command can be used to compute a hash value. The command may transfer either the data to be hashed or a hash value already computed outside the smart card along with the data needed for the final step of the computation. In the latter ...


10

The newest skimmers cannot be seen. These skimmers wafer thin and insert into the card reader: To make matters worse the modification can be purely software. ATMs can be hacked, their software can be modified to log the mag strips and pins of every user. This is a purely loosing battle and you take a chance every time you use an atm. Security is ...


9

The backdoor that you are describing can be installed if you have code execution on the ATM. This research, as well as methods of obtaining code execution on an ATM where pioneered by Barnaby Jack and are detailed in his BlackHat (and defcon) 2010 Jackpotting ATMs talk.


9

Essentially, each subscriber has a key in their smart card. When a new subscriber is added or changes their service, a new group key is sent over the broadcast system, encrypted with that subscriber's key. The keys to actually decrypt individual programs are themselves encrypted with the group key for the set of services that program belongs to. Legitimate ...


9

This is just some extra information but it didn't fit as a comment under Thomas' answer. There's an interesting pirating method that have made it possible for the cycle to extend way longer than two weeks. It's called CardSharing. Here's how it works: Somebody buys a legitimate card and inserts it into a modified satellite receiver that will use the card ...


8

Assuming the laptops to run under Windows, you would need the following: a PKI solution to initialize and manage smart cards; each smart card will contain a private key and the associated certificate; to enable smart card logon so that users open a session on the laptop with the smart card, instead of a password (the smart card itself will require entry of ...


7

I think this is to ensure that the response entered into the website is a fresh(ish) one. If the one time password was generated directly then it could be used at any point in the future, the server has no way of checking when it was generated. By providing the challenge to the card it means that the response generated can only be used for the transaction ...


7

There is a security standard for smartcards under the Common Criteria scheme: the Smart Card Protection Profile. A protection profile defines the security properties that are expected from a device or system. The smart card PP is defined for EAL4+. To put it succintly, the EAL defines what aspects of the product's design are evaluated and to what extent ...


7

Details depend on bank, card type and country, so they vary quite a lot, but the generic model is the following: The magnetic stripe contains, mostly, a computer-readable copy of the information embossed on the card: account number, holder name, expiration date. The chip contains a secret key which is used to "sign" (not necessarily a true signature; often ...


6

EMV cards and smart cards in general do indeed have an embedded private key and enough horsepower to do the crypto math needed to sign a transaction without revealing the secret. https://secure.wikimedia.org/wikipedia/en/wiki/EMV https://secure.wikimedia.org/wikipedia/en/wiki/Smart_card


6

There are a few different types of Smart Cards, here are the types my old Dell 6420 supports: Type "A" : ISO14443A — 106 kbps, 212 kbps, 424 kbps, and 848 kbps Type "B" : ISO14443B — 106 kbps, 212 kbps, 424 kbps, and 848 kbps HID iClass Contactless ISO15693 (Proximity card) FIPS201 see also NXP Fire What are you going to use the Smartcard for? ...


6

The best you can really do is use ATMs you know or ATMs that have good physical security if one you know isn't available. (go to an ATM inside a bank). Even then, I always spot check the machine for any signs of tampering. A simple trick that can work well is to make sure the keypad isn't compromised (by looking and pulling on it) and then if it appears ...


6

Exact cryptography depends on the bank. The communication standard (ISO 7816) is flexible and does not mandate specific cryptographic algorithms. In practice, you would find the two following models: The card does symmetric cryptography only (symmetric encryption, MAC). The card has a static identifier (which contains, roughly speaking, the card number and ...


5

Smartcard communication protocols follow well-established standards (connector size and location, voltages, signals, logical transport protocol...) so chances are that card readers are indeed interchangeable. If the bank sent you both the card and the reader then there is a slight probability that they did something fancy which compromises interoperability, ...


5

Here's an interesting paper about the security of smart cards (in debit cards) used for online banking security in the UK under the CAP scheme. http://www.cl.cam.ac.uk/~sjm217/papers/fc09optimised.pdf Here's a link from the UK with nice details about chip and pin systems: http://www.lightbluetouchpaper.org/2010/02/11/chip-and-pin-is-broken/ We ...


5

In the Windows world, cryptography with special hardware goes through the "Cryptographic Service Providers" (CSP). A CSP is a module registered in the OS, which offers access to such a kind of hardware. From C#, you can look at RSACryptoServiceProvider, which can be created with some parameters which designate a specific CSP. The non-Windows world tends to ...


5

Have a read of the How to get into RFID auditing question as there are some very useful links there. Contactless cards and RFID cards are just a small computing core with some limited functionality and a radio transceiver which not only powers the card when a radio signal is present, but also receives and transmits data within a small range. The key usual ...


5

GnuPG 2.1.0beta2 supports signing certificates in batch mode: Support X.509 certificate creation. Using "gpgsm --genkey" allows the creation of a self-signed certificate via a new prompt. Using "gpgsm --genkey --batch" should allow the creation of arbitrary certificates controlled by a parameter file. An example parameter file is ...


5

You are trying to do authorization with a physical device meant for authentication. This rarely works well. A smart card is used to authenticate the user, in that it contains a private key which remains under exclusive use of the owner. The certificate is a method by which the link between the public key and the owner's identity are distributed; it is ...


4

WRT to smart card being used as an authentication factor for computer access, the private key on the smart card can be protected by a PIN/password. So the smart card auth can also provide the additional factor of "what you know" in addition to "what you have." For most users, the risks are acceptable when compared to the cost of managing ...


4

EMV is a communication protocol, and by implication it specifies what data must be stored on the credit/debt card. It doesn't specify what technical measures protect the card as a physical device. EMV is irrelevant to your question. To understand why a chip isn't so easy to duplicate, read about the physical security of smart cards. There isn't much public ...


4

If you don't want to read straight from standards, and you are looking something in book form, this is a nice primer, (fairly) entry level into smart card security: http://www.amazon.com/Smart-Cards-Tokens-Security-Applications/dp/1441944265 . It's written by two university professors and is the course book on a msc course about smart cards. For a more ...


4

Depending on what you are looking for there is a lot of technologies covering the smart card topic. Some of them coming to my mind: ISO 7816: cards with contact http://www.cardwerk.com/smartcards/smartcard_standard_ISO7816.aspx ISO 14443: contactless smart cards http://en.wikipedia.org/wiki/ISO/IEC_14443 PKCS#15: Cryptographic Token Information Format ...


4

I know of a range of organisations who use smartcards either for access to buildings, access to computers or terminals (eg citrix) or for both. It is the sort of organisations you would expect - ones that have a high impact if unathorised access is gained by an attacker. Also, as @ewanm89 commented, most European bank cards are now smart cards - and some ...


4

Simply storing a secret on a piece of hardware doesn't help secure anything, (god forbid) we have USB sticks for that. The secret must never leave the piece of hardware in order for it to be effective. A device like a smart card is effective in two-factor authentication because it handles the challenge response. If your device is as effective as a ...


4

Found the solution myself. There is one smart card platform that implements Java Card 3.0.1 Classic, available as a smart card and as a USB token: Sm@rtCafé Expert 6.0 StarSign Crypto USB Token There also seems to be some similar card from CardLogix. However, these are all Java Card 3.0 Classic, which is very close to Java Card 2.2.2. The minute ...


4

You need to run: gpg --card-status and gpg will do it for you: /tmp$ mkdir gpgtmp /tmp$ chmod go-rwx gpgtmp /tmp$ GNUPGHOME=/tmp/gpgtmp gpg --keyserver pgp.mit.edu --recv F8713BDF gpg: sleutelring ‘/tmp/gpgtmp/secring.gpg’ is aangemaakt gpg: sleutelring ‘/tmp/gpgtmp/pubring.gpg’ is aangemaakt gpg: opvragen sleutel F8713BDF van hkp sleutelserver ...



Only top voted, non community-wiki answers of a minimum length are eligible