The Security Risks of Contactless Payment

guest · Jun 27, 2020

The Security Risks of Contactless Payment
June 26, 2020
https://securityintelligence.com/articles/the-security-risks-of-contactless-payment/

Contactless payment first arrived in the 1990s and is now having its moment. Both companies and consumers are looking for ways to conduct business with as little physical interaction as possible during in-person transactions.

Consumers are minimizing what they carry, which means less cash on hand. The more they can conduct business with their phone, the better, for convenience and efficiency. But given this shift to using our phones for payment, are organizations doing enough to ensure mobile security?
Click to expand...

Non-contact forms of payment have been put to use mostly by corporations.
Further, don’t expect that credit card companies are the only players in this contactless exchange. Apps like Venmo, Zelle and PayPal, as well as company-owned payment options, are more frequently preferred by consumers.
With Convenience Comes Risk
Contactless payment is convenient, but like any technology, it comes with both mobile security and data privacy risks.

Contactless credit cards use radio frequency identification (RFID) to transmit the data, and hackers have been successful in making fake scanners or using card skimmers designed to steal data transmitted via RFID.
Click to expand...

guest · Oct 6, 2020

Touch and go: Contactless payment security controls defeated by security researchers
October 6, 2020
https://portswigger.net/daily-swig/...ity-controls-defeated-by-security-researchers

Security controls designed to limit retailers’ exposure to fraud from contactless payments can be bypassed, security researchers have warned.

Contactless – or near-field communication (NFC) – payments offer greater convenience and ease of use than earlier chip-and-PIN verification methods.
Banks and credit card issuers have claimed contactless is just as secure as earlier card payment methods.

However, research by Leigh-Anne Galloway, head of commercial research at Cyber R&D Lab, and Tim Yunusov, head of offensive security research at Cyber R&D Lab and parent company Positive Technologies, has raised doubts about such assertions.
Click to expand...

In follow-up research presented at Black Hat Asia last week, Galloway and Yunusov showed how it was possible to bypass multi-factor authentication controls designed to guard against tap-and-go fraud with contactless credit and debit cards.
The researchers devised various hacks to get around the cumulative limits – the maximum amount of money that a cardholder can spend using contactless payments before being forced to use the fallback chip-and-PIN method.

Visa, which said it wasn’t familiar with Galloway and Yunusov’s latest research, echoed Mastercard in stating that contactless is secure and subject to only low levels of fraud:
Click to expand...

guest · Aug 27, 2021

Academics bypass PINs for Mastercard and Maestro contactless payments
August 27, 2021
https://therecord.media/academics-bypass-pins-for-mastercard-and-maestro-contactless-payments/

A team of scientists from a Swiss university has discovered a way to bypass PIN codes on contactless cards from Mastercard and Maestro.

The now-patched vulnerability would have allowed cybercriminals to use stolen Mastercard and Maestro cards to pay for expensive products without needing to provide PINs on contactless payments.
Click to expand...

Discovered by a team from the Department of Computer Science at the ETH Zurich university, the attack is extremely stealthy and could be easily deployed in a real-world scenario if new bugs in contactless payment protocols are discovered.

The general idea behind the attack is for an attacker to interpose itself between the stolen card and a vendor’s Point-of-Sale (PoS) terminal, in what security researchers would normally call a Man/Person/Meddler-in-the-Middle (MitM) scenario.
Click to expand...

The initial Visa PIN bypass (2020)
The research team used this attack scheme last year when they discovered a way to bypass PINs on Visa contactless payments.
The attack, described in a September 2020 research paper titled “The EMV Standard: Break, Fix, Verify,” [...]
The follow-up Mastercard and Maestro PIN bypass (2021)
But the ETH Zurich team continued their research following their initial findings and focused on bypassing PINs on other types of cards that didn’t use the Visa contactless payments protocol.
Click to expand...

The research team said it disclosed its two PIN bypasses to both Visa and Mastercard (which also owns the Maestro brand).
Mastercard rolled out fixes to its network earlier this year, but Visa appears to have not addressed this issue.
Click to expand...

Paper: Card Brand Mixup Attack: Bypassing the PIN in non-Visa Cards by Using Them for Visa Transactions

guest · Sep 29, 2021

Apple Pay with VISA lets hackers force payments on locked iPhones
September 29, 2021
https://www.bleepingcomputer.com/ne...ets-hackers-force-payments-on-locked-iphones/

Academic researchers have found a way to make fraudulent payments using Apple Pay from a locked iPhone with a Visa card in the digital wallet with express mode enabled.

The method is akin to a digital version of pickpocketing. It works over the air even if the iPhone is in a bag or in someone’s pocket and there is no transaction limit.
Ticket-gate payment trick
Looking into relay attacks on contactless payments, researchers at the University of Birmingham and the University of Surrey in the U.K. found that iPhone devices confirm transactions under certain conditions.
Click to expand...

In combination with a Visa card, “this feature can be leveraged to bypass the Apple Pay lock screen, and illicitly pay from a locked iPhone, using a Visa card, to any EMV reader, for any amount, without user authorisation.”

The researchers were able to emulate a ticket-barrier transaction by using a Proxmark device acting as a card reader communicating with the target iPhone and an Android phone with an NFC chip that communicated with a payment terminal.
Click to expand...

The attack is more complicated than this, though. The researchers explain [...]
The tests were successful only with iPhone and Visa cards. With Mastercard, a check is performed to make sure that a locked iPhone accepts transactions only from card readers with a transit merchant code.

The findings of this research have been sent to both Apple and Visa in October 2020 and May 2021, respectively, but neither fixed the problem.
Click to expand...

Practical EMV Relay Protection
(PDF): https://practical_emv.gitlab.io/assets/practical_emv_rp.pdf

We investigate transport payment modes and find that we can build on relaying to bypass the Apple Pay lock screen, and illicitly pay from a locked iPhone to any EMV reader, for any amount, without user authorisation. We show that Visa’s proposed relay-countermeasure can be bypassed using rooted smart phones.
We analyse Mastercard’s relay protection, and show that its timing bounds could be more reliably imposed at the ISO 14443 protocol level, rather than at the EMV protocol
level.

With these insights, we propose a new relay-resistance protocol (L1RP) for EMV.
Click to expand...

EASTER · Sep 30, 2021

I always found chip and pin quite more secure.
Anything wireless can easily be leeched sort of like those physical skimmers only worse.

guest · Nov 12, 2021

Flaws Allow Unlimited Purchases on Apple, Samsung, Google
Vulnerabilities Affect Smartphones With Public Transit Schemes Enabled
November 11, 2021
https://www.databreachtoday.com/flaws-allow-unlimited-purchases-on-apple-samsung-google-a-17896

Vulnerabilities in Apple Pay, Samsung Pay and Google Pay allow attackers to make unlimited purchases using stolen smartphones enabled with express transport schemes.

To speed up the ticketing process, express transport scheme terminals don't request an immediate online authorization, according to a research report by Positive Technologies that was presented at Black Hat Europe on Wednesday.

"The flaws allow attackers to make unlimited purchases using stolen smartphones with enabled express transport schemes that do not require unlocking the device to make a payment. Until June 2021, purchases could be made at any PoS terminals, not only in public transport. On iPhones, payments could be made even if the phone's battery is emptied," Timur Yunusov, a researcher from Positive Technologies, tells Information Security Media Group.
According to the report, the feature is available in the U.S., the U.K., China and Japan.
Click to expand...

Critical Findings
"To perform the attack, smartphones with Samsung Pay and Apple Pay must be registered in these countries, but the cards can be issued in any other region. The stolen phones can also be used anywhere. The same is possible with Google Pay,” Yunusov states.

Yunusov says that prior to 2019, Apple Pay and Samsung Pay did not allow payments unless the phone was unlocked using a fingerprint, facial ID or PIN code. But now, he says, it is possible to use a locked phone by using public transport schemes or Apple's Express Transit mode.
Click to expand...

While explaining the flaws, Yunusov told ISMG that the root of all attacks is flaws in Europay, Mastercard and Visa - or EMV specification - and how mobile wallets such as Apple, Samsung and Google and tokenization services such as Visa and Mastercard interpret the specification differently.
Responsible Disclosure
Yunusov says his team informed Apple, Google and Samsung about the detected vulnerabilities in March, January and April 2021, respectively, and the companies said they were not planning on making any changes to their systems, but asked for permission to share the findings and report with the payment systems.

The researchers say they tried to contact Visa and Mastercard technical specialists but never received a response.
Click to expand...

Hand in Your Pocket Without You Noticing: Current State of Mobile Wallet Security

Apple Pay, Google Pay, and Samsung Pay are the de-facto payment services for mobile users. Their growth and popularity during COVID-19 have given mobile users the option to pay with ease, often without the need to touch a payment terminal. Mobile wallets are considered by many to be state-of-the-art when it comes to payment security. But in fact, these brands do not protect their customers well enough against malicious actors. They only protect themselves.

In our research, we've found inconsistencies in "contactless payments for public transport" schemes that lead to potential fraud using lost or stolen mobile phones. We successfully defrauded victims using stores located around the planet without the phone ever leaving the victim's pocket.
Click to expand...

guest · Jan 31, 2023

PoS malware can block contactless payments to steal credit cards
By Bill Toulas @billtoulas - January 31, 2023

New versions of the Prilex point-of-sale malware can block secure, NFC-enabled contactless credit card transactions, forcing consumers to insert credit cards that are then stolen by the malware.
Click to expand...

On a payment terminal, contactless transactions use NFC (Near Field Communication) chips embedded in credit cards and mobile devices to conduct close-proximity payments via credit cards, smartphones, or even smartwatches.

However, using NFC chips in credit cards has made it harder for point of sale (PoS) malware to steal credit card information, causing threat actors to develop new methods to steal your payment information.
Click to expand...

Kaspersky, following the Prilex PoS malware closely, reports seeing at least three new variants in the wild, with version numbers 06.03.8070, 06.03.8072, and 06.03.8080, first released in November 2022.

These new variants introduce a new feature that prevents payment terminals from accepting contactless transactions, forcing customers to insert their cards.
Furthermore, in September 2022, Kaspersky reported that Prilex added EMV cryptogram generation to evade transaction fraud detection and to perform "GHOST transactions" even when the card is protected with CHIP and PIN technology.
Click to expand...

Block and steal
When the new Prilex feature is enabled, it will block contactless transactions and display a "Contactless error, insert your card" error on the payment terminal.

This forces the victim to finish the transaction by inserting a credit card, making capturing the card information through the payment terminal easier.
The malware uses a rule-based file to determine if it should block a transaction based on whether it has detected the use of NFC.
Click to expand...

Prilex's operators block NFC transactions because those generate a unique ID or card number that's only valid for a single transaction, so if that data is stolen, it wouldn't be helpful for the crooks.

"These [filtering] rules can block NFC and capture card data only if the card is a Black/Infinite, Corporate or another tier with a high transaction limit, which is much more attractive than standard credit cards with a low balance/limit," explains Kaspersky in the report.
Payees have limited means to protect themselves against PoS malware like Prilex, as there's no way to know if a payment terminal might be infected.
Click to expand...

Kaspersky: Prilex modification now targeting contactless credit card transactions

January 31, 2023
Prilex is a singular threat actor that has evolved from ATM-focused malware into unique modular PoS malware—actually, the most advanced PoS threat we have seen so far, as described in a previous article. Forget about those old memory scrapers seen in PoS attacks. Prilex goes beyond these, and it has evolved very differently.

This is highly advanced malware adopting a unique cryptographic scheme, doing real-time patching in target software, forcing protocol downgrades, manipulating cryptograms, doing GHOST transactions and performing credit card fraud—even on cards protected with the so-called unhackable CHIP and PIN technology. And now, Prilex has gone even further.
Click to expand...

Log in or Sign up

The Security Risks of Contactless Payment

guest Guest

guest Guest

guest Guest

guest Guest

EASTER Registered Member

guest Guest

guest Guest

Log in or Sign up

The Security Risks of Contactless Payment

guest Guest

guest Guest

guest Guest

guest Guest

EASTER Registered Member

guest Guest

guest Guest

Useful Searches