Tap, Pay, and Pray
The topic covers security aspects of EMV bank cards: how to read the static data stored on a card, how those data can be copied to another smartcard using a standard reader and publicly available tools or a custom Python script, how man-in-the-middle techniques can be executed, and the PIN OK attack. A bank card is an everyday object that protects financial assets and is defended by multiple overlapping security mechanisms; banks deliberately layer these protections because no single control is sufficient.
The talk consists of:
- Background of EMV Bank cards
- EMV Protocol
- Terminal traffic
- The holes in the security
- Various attacks that an adversary can perform at home using tools that is publicly available
-Performing attacks such as MITM and PIN OK on Bank cards - Reasons why bank intentionally choose a weak system and why they are persistent on not changing it
Praneeth
A master's student in Cyber Security at the University of Birmingham.