Abstract

I’ll be talking about my experience with the Chip and PIN system. During my MPhil at Cambridge I developed a device, the Smart Card Detective (or SCD ), whose main purpose was to protect card users from tampered terminals—these are terminals that show an amount on their display but actually debit your card another. Saar Drimer and Steven Murdoch have demonstrated such attacks.

At the beginning of 2010 Steven Murdoch has discovered the NO PIN attack against Chip and PIN cards, where by using a man-in-the-middle attack one can make a PIN transaction without actually knowing the correct PIN .

Once my device (the SCD ) was built and tested for its main purpose, I decided to test the NO PIN attack. This was trivial to execute with the existing framework. After that we’ve been demonstrating it many times in the media (BBC, Canal+, ITV , ...), including live tests at shops in Cambridge.

Now I continue my research on this system. I have recently presented a paper on peer-to-peer payments on top of the existing system. And I will briefly describe the current experiments on the contactless version of the Chip and PIN system.