Abstract
Recent roll-outs of contactless payment infrastructures -- particularly in Austria and Germany -- have raised concerns about the security of contactless payment cards and Near Field Communication (NFC). There are well-known attack scenarios like relay attacks and skimming of credit card numbers. However, banks and credit card schemes often mitigate these attacks. They explain that attacks are impractical (e.g. in a relay attack an attacker needs to have RF access to a victim's card while performing a payment transaction) or even impossible (e.g. skimmed data does not contain the dynamic authorization codes that are normally required to perform a payment transaction). This paper introduces an attack scenario on EMV contactless payment cards that permits an attacker to create functional clones of a card that contain the necessary credit card data as well as pre-played authorization codes. The card clones can then be used to perform a limited number of EMV Mag-Stripe transactions at any EMV contactless payment terminal.
Original language | English |
---|---|
Title of host publication | Proceedings of the 7th USENIX Workshop on Offensive Technologies (WOOT'13) |
Publisher | USENIX |
Number of pages | 12 |
Publication status | Published - 2013 |
Event | 7th USENIX Workshop on Offensive Technologies (WOOT'13) - Washington, D.C., United States Duration: 13 Aug 2013 → 13 Aug 2013 https://www.usenix.org/conference/woot13 |
Workshop
Workshop | 7th USENIX Workshop on Offensive Technologies (WOOT'13) |
---|---|
Country/Territory | United States |
City | Washington, D.C. |
Period | 13.08.2013 → 13.08.2013 |
Internet address |