Apacs responds to chip and Pin scare

Powered by SC Magazine
 

Banking association investigates warning that consumers could be duped.

Banking association investigates warning that consumers could be duped.

The Association for Payment Clearing Services (Apacs) has responded to claims of a vulnerability in the supposedly watertight chip and Pin system.

Researchers at Cambridge University claimed last week that a flaw in the system could lead to consumers being duped by fake machines.

Steven Murdoch and Saar Drimer said that most discussions over the security of chip and Pin have focused on the tamper-resistance of terminals.

But this only ensures that the terminal will no longer be able to communicate with the bank once it has been opened.

This does not prevent anyone replacing most of the terminal's hardware and presenting it to customers as legitimate, so freely collecting card details and Pins.

The researchers took the chassis of a genuine terminal and replaced much of the internal electronics, taking control of the screen, keypad and card-reader.

To demonstrate the technique they uploaded a video of the terminal playing Tetris to YouTube.

Apacs, the payments organisation representing high street banks, said: " People could, in theory, use this to steal account details from cards. Our experts are in discussion with the manufacturers of terminals to see what can be done.

"However, we would say that this has only been seen in a laboratory so far. People would not be able to create counterfeit chip and Pin cards, but they could use this information abroad to make purchases."

Copyright ©v3.co.uk


 
 
 
Top Stories
Photos: iTnews Benchmark Awards countdown begins
Just a few days left until entries close for 2014.
 
Australian Govt to rethink cyber security strategy
Six-year old policy to be refreshed.
 
The failure of the antivirus industry
[Blog post] Insights from AVAR 2014.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
Who do you trust most to protect your private data?







   |   View results
Your bank
  39%
 
Your insurance company
  3%
 
A technology company (Google, Facebook et al)
  8%
 
Your telco, ISP or utility
  7%
 
A retailer (Coles, Woolworths et al)
  2%
 
A Federal Government agency (ATO, Centrelink etc)
  20%
 
An Australian law enforcement agency (AFP, ASIO et al)
  15%
 
A State Government agency (Health dept, etc)
  5%
TOTAL VOTES: 1033

Vote