InformationWeek: The Business Value of Technology

11 Security Sights Seen Only At Black Hat

1Comments | Mathew J. Schwartz | August 01, 2012 14:00 PM

Who says fun, sun, malware, and penetration testing don't mix? This year's Black Hat conference in Las Vegas offered information security training, hardware hacking, pool time, and more.

Attack Captures Chip-And-PIN Terminal Data

Previous Image

Next Image

11 Security Sights Seen Only At Black Hat

Informationweek Discussions

To upload an avatar photo, first complete your Disqus profile. | View the list of supported HTML tags you can use to style comments. | Please read our commenting policy.

Previous Slide Next Slide 8 of 12

Attack Captures Chip-And-PIN Terminal Data

Hacking card readers--for fun, profit, or hotel-room entry--was a leading theme at this year's Black Hat. One of the more elegant, related attacks demonstrated involved a memory corruption vulnerability in some point-of-sale (POS) credit and debit card readers, detailed by "Nils," head of security research at MWR InfoSecurity, and security consultant Rafael Dominguez Vega.

While their attack has three variations, including targeting the magnetic-stripe card readers used in the United States, arguably the most interesting version targets chip-and-PIN smartcards used in Europe, which require the user to enter a PIN to authorize in-person transactions. But Nils and Vega detailed how a malicious smartcard could be used to rewrite the software running on the terminal, providing fake authorization that a transaction went through, or instructing it to record all credit card numbers and PIN codes that it sees. At the end of the day, an attacker could return to purchase goods and "pay" with a smartcard programmed to retrieve and store all data seen by the POS terminal during the day.

Credit card photograph by Flickr user Images_of_Money, via Creative Commons license.

RECOMMENDED READING:

Black Hat: 6 Lessons To Tighten Enterprise Security

Tired Of Security Problems? Change Rules Of Writing Code

HTML Access Control Busted By Security Researchers

Strike Back At Hackers? Get A Lawyer

5 Black Hat Security Lessons For CIOs

Internet Crime Focus Of Black Hat Europe

3 Big Security Themes At Black Hat Europe