I understand that standard RFID cards are vulnerable to replay attacks however, how do smart cards which are also contactless protect against replay attacks? Is this decided by the chip or by the company which validates the payment?

up vote 5 down vote accepted
+100

The most-authoritative reference on EMV replay (i.e., transaction cloning) is Peter Fillmore's latest talk from Syscan 2015

https://github.com/peterfillmore/Talk-Stuff/blob/master/Syscan2015/PeterFillmore_Syscan2015.pdf

Another great resource is Ricardo Rodriguez's talk from Rooted 2015

http://www.slideshare.net/cgvwzq/on-relaying-nfc-payment-transactions-using-android-devices

Which mentions the NFC Proxy talk from DEF CON 20 by Eddie Lee

https://youtu.be/tFi0vYuYeAI

Of additional interest is Ricardo Rodriguez's whitepaper on EMV relay attacks

http://conference.hitb.org/hitbsecconf2015ams/materials/Whitepapers/Relay%20Attacks%20in%20EMV%20Contactless%20Cards%20with%20Android%20OTS%20Devices.pdf

and Ricardo Rodriguez's website

http://vwzq.net

Some additional validation of these attacks was provided during a HackFu competition by MWR InfoSec

https://hackfu.mwrinfosecurity.com/hackfu-blog/params/post/465447/how-to-hack-a-contactless-payment-system.html

And finally, Michael Roland and Josef Langer write about the downgrade attacks against EMV, as well as the protections built into the protocol. As you can see, originally, the EMV contactless spec itself wanted to provide the protection (long before payment validation), but things don't always work out as planned.

http://0b4af6cdc2f0c5998459-c0245c5c937c5dedcca3f1764ecc9b2f.r43.cf2.rackcdn.com/12055-woot13-roland.pdf

Your Answer

 
discard

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.