Recent roll-outs of contactless payment infrastructures -- particularly in Austria and Germany -- have raised concerns about the security of contactless payment cards and Near Field Communication (NFC). There are well-known attack scenarios like relay attacks and skimming of credit card numbers. However, banks and credit card schemes often mitigate these attacks. They explain that attacks are impractical (e.g. in a relay attack an attacker needs to have RF access to a victim's card while performing a payment transaction) or even impossible (e.g. skimmed data does not contain the dynamic authorization codes that are normally required to perform a payment transaction). This paper introduces an attack scenario on EMV contactless payment cards that permits an attacker to create functional clones of a card that contain the necessary credit card data as well as pre-played authorization codes. The card clones can then be used to perform a limited number of EMV Mag-Stripe transactions at any EMV contactless payment terminal.
|Title of host publication||Proceedings of the 7th USENIX Workshop on Offensive Technologies (WOOT'13)|
|Number of pages||12|
|Publication status||Published - 2013|
|Event||7th USENIX Workshop on Offensive Technologies (WOOT'13) - Washington, D.C., United States|
Duration: 13 Aug 2013 → 13 Aug 2013
|Workshop||7th USENIX Workshop on Offensive Technologies (WOOT'13)|
|Period||13.08.2013 → 13.08.2013|