Chip | madrock

A blog posting on BoingBoing provides further discussion as to the
inappropriate deployment and of RFID chips within the existing payment
marketplace.

http://www.boingboing.net/2006/10/23/report_contactless_c.html

The underlying point of this article is, the card schemes and banks said they are using key rotating encryption of all data between the card and the acquirer/issuer, but this is clearly not the case in many situations.

Another interesting paper is ‘RFID Payment Card Vulnerabilities Technical Report’ located at:

http://www.nytimes.com/packages/pdf/business/20061023_CARD/techreport.pdf

Technology is always being challenged

Posted by :Derek On : June 18, 2008

Category: RFID

Tags:acquirer, algorithm, authentication, bank, Banking, bidirectional, Card, card schemes, Chip, chip solutions, cryptographic algorithms, data, DES, Digital, digital signatures, Dust, EMV, financial transaction, identification, javascript, Merchant, payment, Pin, privacy, processing, Reader, Relay, RFID, rfid chip, RFID-enabled, RSA, rsa laboratories, script, security, security privacy, Shiraz, Skimmer, skimmers, SMS, standards, support, technique, technology, transaction, type, Vulnerabilities

I read a very interesting paper created by the University of Massachusetts,Â RSA Laboratories and Innealta, Inc.<<

This paper primarily relates to the compromise of contact less payment technologies (RFID) if the RFID and/or reader have not been implemented correctly or the solution provider has used an inappropriate type of RFID and discusses the challenges around Chip and Pin with respect to financial transactions e.g. EMV standards and compliance.

Additionally, the paper describes a RFID relay method which is being discussed within many forums around the world and we have now begun to see equipment being produced for the RFID skimmers/clonners to use for malicious means.

The overarching point of this paper is to use an appropriate RFID & Chip solutions which supports the security/privacy of the user and purpose of theÂ transaction (financial or non financial)<<

The paper can be found at http://prisms.cs.umass.edu/~kevinfu/papers/RFID-CC-manuscript.pdf

In modern payment RFID & Chip solutions, newer devices can be used which possess a high degree of processing power and are therefore able to execute strong cryptographic methods (such as digital signatures) to protect the identification and payment information whilst the transaction is occurring.

These systems often utilise bidirectional authentication between the RFID/Chip scanner and the RFID tag/Chip prior to performing the transaction. These methods and cryptographic algorithms are accepted and proven to work within the traditional payment markets.

As mentioned in the paper, some solution store static digitally signed and/or encrypted data which is provided to the RFID/Chip reader when queried, but this data never changes from one transaction to another. This may allow a malicious individual to capture and re-inject the data into the reader at a later stage. The alternative to storing static digitally signed and/or encrypted data is to negotiate a key exchange at the time of the transaction in which the card/value information is encrypted and subsequently transmitted. With this method the transmitted data
changes on every transaction and therefore even if a malicious individual was to capture the encrypted transaction data from one transaction, this would not be accepted by the reader if re-injected at a later stage.

Although this is the case today, older RFID/Chip solutions often use technologies which are not appropriate for financial transactions and therefore may be compromised easily and in some cases without the knowledge of the card holder, merchant or acquirer.

I find this interesting how some of these less secure solution have been approved for use by acquiring banks and the card schemes around the world (if they were told) in recent years, where it has been seen that these solutions have utilised techniques or deployment methods which can be compromised. These technologies and techniques would never be approved within the Point of Sale (PoS) or traditional banking markets.

It can only be assumed that the need to get product to market quickly at the expense of proper testing, understanding and with due consideration to industry lessons learnt has succeeded again.

ISO 14443 contactless card

Posted by :madrock.net On : March 24, 2008

Category: RFID

Tags:access, bank, Card, Chip, chip card, contactless card, contactless cards, DES, development, Dust, environment, frequency, identity, interface, ISO 14443, iso standards, payment, payment solutions, proximity, public transport services, Radio, radio frequency power, Restaurant, RFID, security, Shiraz, smart card, standards, Technical, technology, transmission

An international standard for proximity or contactless smart card communication

ISO 14443 contactless card

ISO 14443 is an international standard which describes how contactless cards and terminals should work to ensure industry-wide compatibility, for example in identity, security, payment, mass-transit and access control applications.

ISO standards are developed by the ISO, the International Organization for Standardization. Technical committees comprising experts from the industrial, technical and business sectors develop the standards to increase levels of quality, reliability and interoperability on a global scale.

Gemplus has always had a strong involvement in ISO definition of the chip card standards, and has been represented in the development of this international standard. The ISO 14443 is divided into 4 separate parts outlining physical characteristics, radio frequency power and signal interface, initialization and anti-collision and transmission protocol.

Gemplus has developed a wide range of contactless payment solutions based on the ISO 14443 international standard. The speed and convenience of contactless technology has created a significant demand for this sort of solution in environments such as fast food restaurants, gas stations, public transport services, banks and many others.

Bluetooth Wireless Specification

Posted by :madrock.net On : March 24, 2008

Category: Bluetooth, Radio General, Security

Tags:access, algorithm, antenna, architecture, ASP, attack, authenticate, authentication, Bluejacking, Bluetooth, bluetooth profiles, bluetooth special interest group, broadcast, Card, Chip, Communications, Cryptographically, data, DES, Digital, Dust, EDR, EFT, Electronic, encryption, environment, Ericsson, Ethernet, frequency, GHz, Guide, hardware, HCI, identification, identity, interface, ISP, JAVA, javascript, Mall, mobile phones, network, personal area networks, phone, php, Pin, Radio, RSA, SAP, scatternet, script, security, security concerns, Serious, Shiraz, SLA, SNARF, standards, support, Technical, technology, template, transmission, trunk, USB, VOIP, Vulnerable, web, wireless personal area, wireless personal area networks

Source

This article is about the Bluetooth wireless specification. For King Harold Bluetooth, see Harold I of Denmark

Bluetooth is an industrial specification for wireless personal area networks (PANs).

Bluetooth provides a way to connect and exchange information between devices like personal digital assistants (PDAs), mobile phones, laptops, PCs, printers and digital cameras via a secure, low-cost, globally available short range radio frequency.

Bluetooth lets these devices talk to each other when they come in range, even if they’re not in the same room, as long as they are within 10 metres (32 feet) of each other.

The spec was first developed by Ericsson, later formalised by the Bluetooth Special Interest Group (SIG). The SIG was formally announced on May 20, 1999. It was established by Sony Ericsson, IBM, Intel, Toshiba and Nokia, and later joined by many other companies as Associate or Adopter members.

* 1 About the name
* 2 General information
o 2.1 Embedded Bluetooth
* 3 Features by version
o 3.1 Bluetooth 1.0 and 1.0B
o 3.2 Bluetooth 1.1
o 3.3 Bluetooth 1.2
o 3.4 Bluetooth 2.0
* 4 Future Bluetooth uses
* 5 Security concerns
* 6 Bluetooth profiles
* 7 See also
* 8 External links

About the name

The system is named after a Danish king Harald BlÃ¥tand (<arold Bluetooth in English), King of Denmark and Norway from 935 and 936 respectively, to 940 known for his unification of previously warring tribes from Denmark, Norway and Sweden. Bluetooth likewise was intended to unify different technologies like computers and mobile phones. The Bluetooth logo merges the Nordic runes for H and B.

General information

A typical Bluetooth mobile phone headset

The latest version currently available to consumers is 2.0, but few manufacturers have started shipping any products yet. Apple Computer, Inc. offered the first products supporting version 2.0 to end customers in January 2005. The core chips have been available to OEMs (from November 2004), so there will be an influx of 2.0 devices in mid-2005. The previous version, on which all earlier commercial devices are based, is called 1.2.

Bluetooth is a wireless radio standard primarily designed for low power consumption, with a short range (up to 10 meters [1], ) and with a low-cost transceiver microchip in each device.

It can be used to wirelessly connect peripherals like printers or keyboards to computers, or to have PDAs communicate with other nearby PDAs or computers.

Cell phones with integrated Bluetooth technology have also been sold in large numbers, and are able to connect to computers, PDAs and, specifically, to handsfree devices. BMW was the first motor vehicle manufacturer to install handsfree Bluetooth technology in its cars, adding it as an option on its 3 Series, 5 Series and X5 vehicles. Since then, other manufacturers have followed suit, with many vehicles, including the 2004 Toyota Prius and the 2004 Lexus LS 430. The Bluetooth car kits allow users with Bluetooth-equipped cell phones to make use of some of the phone’s features, such as making calls, while the phone itself can be left in a suitcase or in the boot/trunk, for instance.

The standard also includes support for more powerful, longer-range devices suitable for constructing wireless LANs.

A Bluetooth device playing the role of “master” can communicate with up to 7 devices playing the role of “slave”. At any given instant in time, data can be transferred between the master and one slave; but the master switches rapidly from slave to slave in a round-robin fashion. (Simultaneous transmission from the master to multiple slaves is possible, but not used much in practice). These groups of up to 8 devices (1 master and 7 slaves) are called piconets.

The Bluetooth specification also allows connecting two or more piconets together to form a scatternet, with some devices acting as a bridge by simultaneously playing the master role in one piconet and the slave role in another piconet. These devices have yet to come, though are supposed to appear within the next two years.

Any device may perform an “inquiry” to find other devices to which to connect, and any device can be configured to respond to such inquiries.

Pairs of devices may establish a trusted relationship by learning (by user input) a shared secret known as a “passkey”. A device that wants to communicate only with a trusted device can cryptographically authenticate the identity of the other device. Trusted devices may also encrypt the data that they exchange over the air so that no one can listen in.

The protocol operates in the license-free ISM band at 2.45 GHz. In order to avoid interfering with other protocols which use the 2.45 GHz band, the Bluetooth protocol divides the band into 79 channels (each 1 MHz wide) and changes channels up to 1600 times per second. Implementations with versions 1.1 and 1.2 reach speeds of 723.1 kbit/s. Version 2.0 implementations feature Bluetooth Enhanced Data Rate (EDR), and thus reach 2.1 Mbit/s. Technically version 2.0 devices have a higher power consumption, but the three times faster rate reduces the transmission times, effectively reducing consumption to half that of 1.x devices (assuming equal traffic load).

Bluetooth differs from Wi-Fi in that the latter provides higher throughput and covers greater distances but requires more expensive hardware and higher power consumption. They use the same frequency range, but employ different multiplexing schemes. While Bluetooth is a cable replacement for a variety of applications, Wi-Fi is a cable replacement only for local area network access. A glib summary is that Bluetooth is wireless USB whereas Wi-Fi is wireless Ethernet.

Many USB Bluetooth adapters are available, some of which also include an IrDA adapter.

Embedded Bluetooth

Bluetooth devices and modules are increasingly being made available which come with an embedded stack and a standard UART port. The UART protocol can be as simple as the industry standard AT protocol, which allows the device to be configured to cable replacement mode. This means it now only takes a matter of hours (instead of weeks) to enable legacy wireless products that communicate via UART port.

Features by version

Bluetooth 1.0 and 1.0B

Versions 1.0 and 1.0B had numerous problems and the various manufacturers had great difficulties in making their products interoperable. 1.0 and 1.0B also had mandatory Bluetooth Hardware Device Address (BD_ADDR) transmission in the handshaking process, rendering anonymity impossible at a protocol level, which was a major set-back for services planned to be used in Bluetooth environments, such as Consumerism.

Bluetooth 1.1

In version 1.1 many errata found in the 1.0B specifications were fixed. There was added support for non-encrypted channels.

Bluetooth 1.2

This version is backwards compatible with 1.1 and the major enhancements include

Adaptive Frequency Hopping (AFH), which improves resistance to radio interference by avoiding using crowded frequencies in the hopping sequence
Higher transmission speeds in practice
extended Synchronous Connections (eSCO), which improves voice quality of audio links by allowing retransmissions of corrupted packets.
Received Signal Strength Indicator (RSSI)
Host Controller Interface (HCI) support for 3-wire UART
HCI access to timing information for Bluetooth applications.

Bluetooth 2.0

This version is backwards compatible with 1.x and the major enhancements include

Non-hopping narrowband channel(s) introduced. These are faster but have been criticised as defeating a built-in security mechanism of earlier versions; however frequency hopping is hardly a reliable security mechanism by today’s standards. Rather, Bluetooth security is based mostly on cryptography.
Broadcast/multicast support. Non-hopping channels are used for advertising Bluetooth service profiles offered by various devices to high volumes of Bluetooth devices simultaneously, since there is no need to perform handshaking with every device. (In previous versions the handshaking process takes a bit over one second.)
Enhanced Data Rate (EDR) of 2.1 Mbit/s.
Built-in quality of service.
Distributed media-access control protocols.
Faster response times.
Halved power consumption due to shorter duty cycles.

Future Bluetooth uses

One of the ways Bluetooth technology may become useful is in Voice over IP. When VOIP becomes more widespread, companies may find it unnecessary to employ telephones physically similar to today’s analogue telephone hardware. Bluetooth may then end up being used for communication between a cordless phone and a computer listening for VOIP and with an infrared PCI card acting as a base for the cordless phone. The cordless phone would then just require a cradle for charging. Bluetooth would naturally be used here to allow the cordless phone to remain operational for a reasonably long period.

Security concerns

In November 2003, Ben and Adam Laurie from A.L. Digital Ltd. discovered that serious flaws in Bluetooth security lead to disclosure of personal data (see http://bluestumbler.org). It should be noted however that the reported security problems concerned some poor implementations of Bluetooth, rather than the protocol itself.

In a subsequent experiment, Martin Herfurt from the trifinite.group was able to do a field-trial at the CeBIT fairgrounds showing the importance of the problem to the world. A new attack called BlueBug was used for this experiment.

In April 2004, security consultants @Stake revealed a security flaw that makes it possible to crack into conversations on Bluetooth based wireless headsets by reverse engineering the PIN.

This is one of a number of concerns that have been raised over the security of Bluetooth communications. In 2004 the first purported virus using Bluetooth to spread itself among mobile phones appeared for the Symbian OS. The virus was first described by Kaspersky Labs and requires users to confirm the installation of unknown software before it can propagate. The virus was written as a proof-of-concept by a group of virus writers known as 29a and sent to anti-virus groups. Because of this, it should not be regarded as a security failure of either Bluetooth or the Symbian OS. It has not propagated ‘in the wild’.

In August 2004, a world-record-setting experiment (see also Bluetooth sniping) showed that with directional antennas the range of class 2 Bluetooth radios could be extended to one mile. This enables attackers to access vulnerable Bluetooth-devices from a distance beyond expectation.

Bluetooth uses the SAFER+ algorithm for authentication and key generation.

Bluetooth profiles

In order to use Bluetooth, a device must be able to interpret certain Bluetooth profiles. These define the possible applications. Following profiles are defined:

Generic Access Profile (GAP)
Service Discovery Application Profile (SDAP)
Cordless Telephony Profile (CTP)
Intercom Profile (IP)
Serial Port Profile (SPP)
Headset Profile (HSP)
Dial-up Networking Profile (DUNP)
Fax Profile
LAN Access Profile (LAP)
Generic Object Exchange Profile (GOEP)
Object Push Profile (OPP)
File Transfer Profile (FTP)
Synchronisation Profile (SP)

This profile allows synchronisation of Personal Information Manager (PIM) items. As this profile originated as part of the infra-red specifications but has been adopted by the Bluetooth SIG to form part of the main Bluetooth specification, it is also commonly referred to as IrMC Synchronisation.

Hands-Free Profile (HFP)
Human Interface Device Profile (HID)
Hard Copy Replacement Profile (HCRP)
Basic Imaging Profile (BIP)
Personal Area Networking Profile (PAN)
Basic Printing Profile (BPP)
Advanced Audio Distribution Profile (A2DP)
Audio Video Remote Control Profile (AVRCP)
SIM Access Profile (SAP)

Compatibility of products with profiles can be verified on the Bluetooth Qualification website.

External links

Bluetooth Tutorial Includes information on Architecture, Protocols, Establishing Connections, Security and Comparisons
Bluetooth connecting and paire guide
The Official BluetoothÂ® Wireless Info Site<SIG public pages
Howstuffworks.com explanation of bluetooth
The Bluetooth Car Concept
A series of guides on how-to connect devices like mobile phones, PDAs, desktop/laptops, headsets and use different Bluetooth services
Mapping Salutation Architecture APIs to Bluetooth Service Discovery Layer
Bluetoothâ„¢ Security White Paper
Security Concerns
Laptops, PDA and mobile (cell) phones with Bluetooth(TM) and Linux
Bluetooth qualified products
Bluecarkit discussion forum about Bluetooth car handsfree
Bluetooth in spanish
Radio-Electronics.ComÂ â€“ Overview of Bluetooth and its operationi>
Bluetooth Background information about bluetooth (German)
Bluetooth.orgÂ â€“ The Official Bluetooth Membership Sitei>

Technobile: Chip and pin may be a wonderful concept, but dont write off humans yet – they are more reliable

Posted by :madrock.net On : March 24, 2008

Category: Banking & EFTPoS, Security

Tags:account, bank, Banking and EFTPoS, Card, Chip, Credit, Debit, debit card, DES, eavesdropper, Guardian, ISP, money, online, Pin, Radio, Reader, Self-service, Shiraz, technology, transaction

Guardian Technology Pages
28 September 2006
The Guardian

“Your card has been declined.”
“What? No way, there’s plenty of money in that account!”
“I’m sorry, madam, but it’s refusing the transaction.”
“It’s your card reader, that card worked fine in Boots five minutes ago.”
“The card has been declined. Do you have another one?”
The casual eavesdropper might infer that I – the protesting woman in that dialogue – am financially irresponsible, that my credit card is maxed out or my debit card has reached its overdraft limit. In fact, it’s far more likely that the reader on the chip and pin machine is throwing a strop. There is a machine at WH Smith in North End Road, Fulham, that hates my debit card and never accepts it. I’ve given up trying there. But it’s not the only one.
Self-service machines have sprung up everywhere, sprouting card readers and keypads. But watch closely and you will find that more often than not, there is an angry person muttering and swearing at the machine while a queue forms. Watch a little longer and you’ll see that queue evaporate – and reform at the counter in front of a human being.
This happened to me and my partner in France recently when we pulled into a petrol station in Epernay. In our desperation, we pulled up at an empty pump, wondering vaguely why it had no queue while others did.
Why? Because before it would dispense petrol, it wanted a credit card and pin. We fed it mine and I keyed in the number, only for it to be spat out with terrifying admonitions in French about the card being refused. I wiped the strip and tried again. Same reaction, causing a moment’s panic: we’d spent a bit on that card – did my bank think it was stolen? Was it blocked?
So we tried my partner’s card. Same thing. And then the penny dropped that the pumps with the queues were the old-fashioned ones where you fill the car up and then pay at the till. Clearly the locals knew all about these pumps.
Mind you, it was a miracle we got to France at all. When we arrived at the Eurotunnel terminus we joined a queue of cars for the automatic check-in. I am not the most patient of queuers and within a short time I was railing about how slowly it was moving. A man in a bright yellow jacket was buzzing about from car to car. Finally we got to the head of the queue and fed in the card that was used to book the shuttle online.
It didn’t want to know. It spat the card out. We tried again and got as far as tapping in our reservation number. It spat it out again. The chap in the high-visibility jacket buzzed over to us and rolled his eyes, saying: “It’s been playing up all day.” He went into the booth with the card – and then we heard him saying over his radio that the whole system had gone down in protest.
As an idea, the technology is great. In practice, we have a long way to go before we can dispense with human beings who can override systems when good card readers go bad. Kate Bevan

What changes to contactless standards and technology are expected in the future?

Posted by :Derek On : March 24, 2008

Category: RFID

Tags:access, authenticate, Card, Chip, contactless card, contactless cards, contactless technologies, data, DES, development, frequency, IEC, ISO/IEC 14443, ISO/IEC 15693, network, Pin, Reader, RFID, security, Shiraz, standards, support, technology

Many vendors are actively developing new technologies to address the increasing market need for secure contactless technologies for a wide variety of applications. Changes in government regulations will also provide opportunities for enhancing contactless technology performance. It is important to note, however, that standards development is a lengthy process so it takes time for new technology developments to be reflected in standards that help to drive the availability of interoperable solutions. A few examples of new technologies that are expected include:

Changes to technology based on the ISO/IEC 15693 standard. Contactless cards supporting the ISO/IEC 15693 standard currently operate at 1.65 Kb/sec to meet FCC limits on sideband power in this frequency range. The FCC is expected to lift its restriction in late 2002, which would allow cards based on the ISO/IEC 15693 standard to improve their data rates.
Changes for higher speed operation. ISO working groups plan to add higher speed modes of operation to ISO/IEC 14443. This will increase the speed supported by this standard from 106 Kb/sec to the 848 Kb/sec that has already been demonstrated by IC manufacturers.
Alternative access control reader networking solutions. Wireless readers offer a significant advantage in lower costs of installation, particularly in older facilities. New security approaches can ensure strong authenticated channels between hosts or panels and new wireless readers. IP readers also permit direct connectivity to LANbased management and control applications.
The ability for a single contactless chip in a card to operate in full ISO/IEC 14443 and ISO/IEC 15693 modes.

Is there a risk of someone listening or stealing the information from a contactless card?

Posted by :madrock.net On : March 24, 2008

Category: Banking & EFTPoS, RFID, Security

Tags:Authorisation, Card, Chip, contactless card, contactless cards, contactless technologies, data, DES, encryption, hack, password, Pin, processing, Reader, RFID, security, Shiraz, technology, transmission

One risk with contactless cards is the ability for the card to be activated when it enters a reader’s RF range without the owner being aware of it. To prevent a contactless card activation without the card owner being aware of it, the application can be configured to always ask for the owner’s authorisation (password, PIN or biometric) before providing any user information or processing on the userâ€™s behalf.

e level of security of communication required between the contactless card and the reader must be defined as part of the system design and security controls must put in place so that un-invited listeners cannot intercept the data in any meaningful way. For example, all of the contactless technologies can use data encryption to protect data on the card and during transmission; this helps to ensure that, if information is intercepted, the information cannot be used by the recipient. It is important that all of the applicationâ€™s requirements be understood and defined prior to any technology selection and implementation so that the appropriate security features are designed into the system.
Additionally, the contactless chip is designed to self destruct if anyone tries to hack into it.

What do you mean by three technologies on one card?

Posted by :madrock.net On : March 24, 2008

Category: RFID

Tags:Card, Chip, circuit, DES, dual interface, interface, magnetic stripe, Reader, RFID, Shiraz, smart card, smart card reader, support, technology

There is confusing terminology used in the market to refer to cards that can support a combination of technologies. Cards are described as multiple technology when multiple, independent technologies share a common plastic card and do not communicate or interact with each other (e.g., magnetic stripe and contactless or contact chip). Cards are described as having a â€œdual-interfaceâ€ when the card has a single integrated circuit (IC) that can communicate with a smart card reader/terminal via either contact or contactless.

Archives for : Chip

Ham Radio Links

Equipment suppliers and manufacturers

Electronic service

Contactless credit cards with RFID are easily hacked

Technology is always being challenged

ISO 14443 contactless card

Bluetooth Wireless Specification

Table of contents

About the name

General information

Embedded Bluetooth

Features by version

Bluetooth 1.0 and 1.0B

Bluetooth 1.1

Bluetooth 1.2

Bluetooth 2.0

Future Bluetooth uses

Security concerns

Bluetooth profiles

See also

External links

Technobile: Chip and pin may be a wonderful concept, but dont write off humans yet – they are more reliable

What changes to contactless standards and technology are expected in the future?

Is there a risk of someone listening or stealing the information from a contactless card?

What do you mean by three technologies on one card?

Categories

Archives

Blogrolls