According to this site http://www.lightbluetouchpaper.org/2009/08/25/defending-against-wedge-attacks/ there is a flaw in EMV. Since then has this flaw been fixed?

Is it the same law as the one exposed by BBC/Cambridge University? http://events.ccc.de/congress/2010/Fahrplan/events/4211.en.html


because that later works even when terminal makes a connection to the bank "remain undetected even when the merchant has an online connection to the banking network"

whereas the first seems not as it is said:

"the wedge attack can be detected if the terminal goes online, because the MAC check will fail."

If not it isn't clearly explained the remediation to that kind of flaw? Can the Bank or user do something to protect against this?

1 Answer 1


I think they are slightly different attacks, in the lightbluetouchpaper blog the wedge sends a fake MAC back to the terminal, in the other attack the card sends the MAC. This is why the second attack can work online, it uses a genuine MAC that the bank will accept.

The blog is run by the Cambridge researchers, Ross Anderson, Steven Murdoch et al. The original paper which presented the second attack that works online "Chip and PIN is Broken" can be found here: http://www.cl.cam.ac.uk/research/security/banking/nopin/oakland10chipbroken.pdf

In the paper the researchers suggest some possible fixes and why they would/would not work in the 'VI Solutions and Non-Solutions section'. The main point they make is that to implement an effective solution the EMV standard would have to be changed which would be an incredibly costly thing to do due to large number of merchants, cards and banks using the current implementation and as far as I'm aware there has been no fix rolled out for the standard.

It would be possible for individual banks to fix this by getting the terminal to send the CVMR (Cardholder Verification Method Result) to the bank so the bank could check what the card thought had happened in the transaction and compare it to what the terminal thought had happened, they could then see that the terminal thought a PIN was used and the card thought a signature was used so know something was wrong. As the paper says

Out of many, we have only seen one EMV card which requests this field, and it is not clear that the issuer actually validates the CVMR against the IAD. Whether this fix works for a given bank will depend on its systems; we have not been able to test it, and given that it involves reissuing the card base it would take years to roll out.

So the only way to know if fixes have been made is to test newly issued cards, as far as I'm aware there hadn't been anything published on this.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .