EMV credit card cloning: PIN code known by a malicious person

Question

Could a credit card cloned (chip or magnetic band) if someone has it for a few seconds and knows the PIN code?

If the PIN code is changed, can the cloned card still be used?

Answer 1

Could a credit card cloned (chip or magnetic band) if someone has it for a few seconds and knows the PIN code?

It depends.

• The magnetic band can be easily cloned and you don't even need the PIN to clone it. You only need the PIN to use the card later. This cloning is not only possible but widely done by criminals.
• The chip can not be cloned, at least not with the current methods available to criminals. Even if you know the PIN code. Thus it is inherently more safe than magnetic stripe and that's why the United States mandates the use of EMV by 10/2015 (or at least the liability on misuse shifts to the one accepting non-EMV payments). In Europa EMV is already common for years and thus cloning of credit cards is less a problem.

Answer 2

TL;DR:

A lot of threats relies on the attacker knowing only the card number and the expiration date and not the PIN. Personally, if changing one thing, I would merely request to change the card number instead of the PIN.

Some web-forms on the Internet give me the impression that some countries are used to keep the same card number when renewing a card. In France (at least) the card number is not valid more than 2-3 years: after this period the card is replaced by a new one whose number is partially different and as unpredictable as possible (at the opposite, without explicit request the PIN code remains the same over the years and card renewals).

---

TS;IWM: (Too short; I want more! ;) )

From a theoretical perspective, a smart card can be compared to a networked computer: it's content cannot be accessed directly, one must send requests to the chip (either to access some data or execute some operation) and the chip answers depending on the protocol requirement (authentication might be needed in prior to some requests, etc.).

Therefore, still from a theoretical perspective, a smart card itself can be considered as secure, this led to a wrong marketing discourse claiming that systems based on it were "unbreakable" or that such card were "unclonable". However, a complex system like the payment system cannot be shrinked to the sole EMV card security: everything around it must be taken into account, from the protocols to the devices, a lot of disparate elements participating into weakening the payment system and making it far from being "unbreakable".

Too short keys used (1993-1998)

The smart card being a French invention, France was obviously an early adopter of this technology to increase payment system security. Indeed, the magstripe was not perceived as being secure enough, and the future shows that this weakness was true (at the end of this video for instance, we can see someone creating a credit card from an hotel door card).

Despite "GIE cartes bancaires" (the French banks consortium handling smart card based payment systems) claims that this system was unbreakable, a security researcher, Serge Humpich, contacted them privately and demonstrated this was not true. Due to a too short private key being used, Serge Humpich was indeed in measure, not only to clone a card, but even to create new cards with fancy numbers.

While Serge humpich's goal was to help the "GIE cartes bancaires" to improve the security of their system, as a reward they sued him for having reverse-engineered it. As a reward, the "GIE cartes bancaires" sued him for having reverse-engineered their security system.

Nevertheless, after this event the private has been upgraded ad nowadays its length is reviewed on a yearly basis).

A bit of tape to force a fallback on the magstripe

The smart card payment system being still not widely accepted around the world, the ATM and payment devices accept magstripe as a fallback when the chip is unavailable or unreadable.

Next issue: by putting some tape on the the chip you can force an ATM to fall-back on the easily forgeable magstripe, allowing you to clone even a chip-enabled card without having to actually clone the chip itself.

Some banks reacted by restricting payment made by EMV enabled card to be chip-only, the EMVCo consortium also proposed to use a different CCV (a 3 number ID) on the the chip and on the magstripe in order to prevent to build a valid magstripe from data read from the chip (called iCCV, I do not know if this is widespread, the video linked above showing someone forging a magstripe using data collected via NFC make me doubtfull about this...).

A communication protocol too complex to be secure

The protocol involving the chip, the payment/ATM device and the bank is very complex, too complex according some people. The communication between the card and the device is not fully secured (some steps involve no cryptography, signature, etc.), this includes several backward and international compatibility features and some other features allowing the transaction to proceed even in case of technical issues. Moreover, the different steps composing the transaction are not tight together.

All this complexity make any flaw hardly fixable, while opening the door to a wide range of attacks, including the following Man-In-The-Middle (MiTM) attack.

Instead of a simple piece of tape as seen before, the attacker will now put a specially crafted second chip over the genuine one which will take in charge all of the MiTM process. It could for instance:

• Take in charge the PIN authentication while deceiving the genuine card into thinking it is acknowledging a chip and signature transaction (French link from the Cambridge University researches work, see below),
• It could downgrade security settings, in order for instance to disable some optional cryptography,
• The chip can even be installed on the payment device side, capturing informations and PIN numbers from all cards going through it. The attacker can then retrieve the collected information using a specially crafted smart-card or simply through the air if the MiTM device includes, for instance, WiFi capabilities (such device has been encountered in real life by the team presenting the above linked DefCon video, they were even more worried to discover a serial number on such device implying some semi-industrial production).

A system too complex to be correctly implemented

The standard complexity also encourages for weak implementation.

Cambridge University researchers have shown that several ATM use a weak pseudo-random number generator. While the card contains a secret encryption key which cannot be discovered, malicious payment devices could trick a card into producing several signed messages by advance which will then be used against such weak ATM, effectively making resulting malicious "clone" cards act as the genuine one from the ATM point-of-view.

This attack has been described in 2012, since then it is said that weak ATM's have been upgraded and fixed. However, by the end of 2014 newspapers still seem to describe attacks looking strangely close to this one. Funnily enough, this article mentions a bank which detected the attack because some EMV payment have been processed for magstripe-only cards.

Other attacks

At last, I cannot without mentioning other situation where card number obtained by cloning devices can also be useful:

• While all ATM require the bank authorization before proceeding with the request, it is not the case for all payment system. Some of them, mainly in location where payment must be processed very quickly (toll highways, automated gas stations, ...) or for small amounts do not contact the bank and rely only on the exchanges made with the card to accept the transaction. Such payment systems with no bank authorization capacity can often be recognized by a notice telling that they do not accept "Visa Electron" cards (this card requires bank authorization for each transaction),
• Collected card numbers can also be used for online, phone or mail-order payment. There are still a large number of websites not asking (or asking but not checking) the three-digit CCV number and which haven't subscribed to Visa 3-D Secure / MasterCard SecureCode systems. No PIN needed here, only the card number and expiration date, the very information provided by the chip without any authentication required.

Customer liability

As a side note, the worse in all this is that several of the above mentioned attacks, producing a transaction labelled as EMV (no matter if a physical card has been used or not) makes most often the consumer directly responsible of the financial consequences. Most banks indeed only covers frauds as-long-as the PIN code has not been used. As-soon-as the transaction appear as EMV on their logs, upon the wrong assumption that smart card security is unbreakable, they often blindly consider that the PIN code has been used and that the consumer is responsible by negligence.

Answer 3

Speaking from a UK standpoint (which I've got a fair amount of experience with- done this on TV recently- legally) there's a few points to note. Let's break the card itself down first into sections-

Chips

The chip cannot be copied or cloned without substantial resources and engineering. It's not impossible, just it'd be quicker to mug you and steal the actual card. These chips are common (actually issued by default) in the UK for several years.

Magstripe

The cloning of the magstripe can be done easily and quickly with skimmers as we already know. These are available almost everywhere now and have obvious genuine usage alongside... Y'know... Cloning

Contactless chip (RFID)

Theoretically a replay type attack can be carried out on the target card and cloned to another card but this takes a fair amount of time (~2-5mins) to copy the card and has the potential of "bricking" it.

Since chip cloning is out, as is RFID cloning in this case, the potential damage that can occur from a magstripe clone depends on the transaction. Online purchases don't require a PIN but do usually require information that's not on the card (CVV/CSV/Billing address/password auth with your bank). Some websites will allow folks to order without checks but those places are fast going out of fashion. Similarly cash point ATMs inside a bank will reject (or swallow) your card since it doesn't have a chip.

However, those stand alone third party ATMs that can literally be "wheeled in" to any shop can be fooled into accepting the cloned card without the PIN. How does this work? In the UK, the PIN is stored in the chip itself- or at least a hashed version. When you insert your card, it reads the magstripe & chip, contacts your bank, waits for pin entry, checks that against the chip, then let's you withdraw money- if the issuing bank gives it the all clear.

The bypass comes into play here because of technology. Or lack of it. Because a 100% uptime internet connection between two points can't ever be guaranteed, there's inbuilt fallbacks for some of the third party ATMs that let it accept magstripe only transactions if an Internet connection cannot be established with the issuing bank. It just places it in a queue for processing later. This is usually a simple situation to create by literally pulling the Ethernet plug on the ATM (although props to anyone that goes to the bother of packet sniffing one of those things and somehow injecting packets/simple DNS fail)

The best part is any PIN will work since the PIN hash is unreadable. Some ATMs bypass this pin entry screen, some don't.

Also payment terminals shipped to vendors usually come with a default setting meaning that if the chip is detected as broken, it tries again 3 times until finally falling back to magstripe (which doesn't require PIN entry).

Your issuing bank can detect attempted withdrawals/balance queries and more so if you're in doubt, phone them and ask. They'll also be able to get date, time, location (maybe even security footage from the area) if it's used without your permission.

Recommendation- never give your card to anyone, ever and if you think it may have been compromised- immediately phone your issuer and tell them. Change your pin to something different with each card too (and cut out that damned contactless chip, that's nothing but bad news)

Edit

The common thing for card skimmers to do now is collate all the info into a database and sell it on as a package. The risks of using a cloned card, or even the data on a website, are too high. Much easier to sell on 100, 1,000, or 10,000 credit card details than it is to clone a single card, pray it works, find somewhere secluded, try it out, do some OpSec, ?????, profit.