Close up (sort of) of credit card chip - Page 1
Forum section: electronics / general

author: Red Squirrel
author_rank: Super Contributor
timestamp: November 04, 2017, 12:28:03 am
content: Never really taken one of these apart before but had an old deactivated card lying around.I don't have an actual microscope so that's as close as I can get, but it's kinda neat as you can see the actual die and the bonding wires. I would guess the rectangular part on the bottom left is probably some kind of flash memory.

author: Halcyon
author_rank: Unknown
timestamp: November 04, 2017, 12:45:38 am
content: I doubt it would be flash, it'll be some kind of write-once, read-many memory if I had to guess. They aren't designed to be reprogrammed although I think they do contain some amount of writeable memory (I think it stores something like the last 5 transactions). I think they also have some crypto stuff on-board. I'm not an expert by an means in credit cards, so someone else who knows more will correct me if I'm wrong.

author: tooki
author_rank: Super Contributor
timestamp: November 04, 2017, 11:07:47 am
content: I think it depends on the chip. For sure, rewritable chip cards exist; they are used for stored-value cards, like the prepaid telephone cards many countries used to use for payphones, various transit fare cards, and stored-value debit cards.Additionally, every SIM card is rewritable: they support storing the phone book on the SIM card, though people rarely use that feature any more.

author: rbm
author_rank: Regular Contributor
timestamp: November 04, 2017, 12:17:09 pm
content: Since Red Squirrel's location is Ontario, I'd venture a guess that the card he disassembled was a Debit/Credit card issued by a Canadian bank. If so, the chip is a secure storage device, and not a smartcard. It is hardened memory with no intelligence onboard. The payment terminal reads data from the card, including the cryptographic representation of the user's PIN and track equivalent data. The chip conforms to EMV specifications for memory layout and electrical characteristics. It is Read Write because the user has the capability to update their PIN at the Bank, and an offline representation needs to be stored on the chip during that process.Smartcards are more prevalent in Europe than North America. Smartcards have hardened memory as well as hardened crypto-processors onboard, making them intelligent. They act like a Secure Cryptographic Device (SCD) and are capable if performing encryption/decryption onboard the card itself and capable of interacting with PKCS-enabled applications.

author: Ampera
author_rank: Super Contributor
timestamp: November 04, 2017, 04:25:29 pm
content: Credit/bank cards are a funny thing in the US (and maybe Canada, don't know, don't live there).We still actually use magstripe on a lot of our cards. I am somewhat sure that it's a more secure version of the technology, but it's still there with some places not even accepting, or sporadically accepting chip cards.

author: rstofer
author_rank: Super Contributor
timestamp: November 04, 2017, 06:20:34 pm
content: Quote from: TwoOfFive on November 04, 2017, 04:25:29 pmIn the US, the merchants will either upgrade their readers to accept chip cards or suffer the entire financial loss of fraudulent transactions. The days of the banks eating the losses have come to an end. The cardholder never was at much risk.Despite all the magic, my card gets 'stolen' 3 or 4 times per year. Not that I ever lose physical possession, just that somebody comes up with the number. My latest incident was a bogus charge at Uber. I have never used Uber. I didn't chase it down a rathole to find out where it was charged but it was probably a long way away.I think it is time for the banks to lay down the law - use chips or else, no exceptions. The problem is, the industry can't get merchants certified fast enough. Then too, some merchants don't want to upgrade. Too bad for them!https://www.creditcards.com/credit-card-news/understanding-EMV-fraud-liability-shift-1271.phpApparently, the rule boils down to "the party with the least level of security eats the losses".

author: ajb
author_rank: Super Contributor
timestamp: November 04, 2017, 11:15:57 pm
content: Quote from: rstofer on November 04, 2017, 06:20:34 pmThere was actually at least one lawsuit over this. A grocery chain got all of their equipment ready for EMV, notified the network that they were ready for certification well before the shift, and at least as of four and a half months after the liability shift, the network still hadn't certified them. Here's an article from when the suit was initiated, it looks like it's become a class action effort since then:https://arstechnica.com/information-technology/2016/03/supermarket-sues-banks-over-chip-card-shift-says-it-lost-10k-in-4-5-months/I think a lot of stores were in a similar situation. You certainly saw a lot of places get fancy new chip readers only to have to tape over the chip slots or post "No chip!" signs next to them for months and months. Even a good sized grocery chain near me was in that situation (although I don't know the details).There are lots of stories of other EMV rollout problems, mainly down to the requirements not being finalized well enough in advance of the deadline. Apparently a lot of equipment manufacturers and service providers were't able to have their systems ready until right before, even well after, the deadline, and once theywereready, there was so much pent up demand from retailers trying to get compliant that they couldn't ship and install them fast enough. On the whole, it's been a mess, and retailers who have already spent thousands of dollars on new equipment and software still wound up on the hook for credit card fraud.

author: Mr. Scram
author_rank: Super Contributor
timestamp: November 05, 2017, 12:46:50 am
content: Quote from: tooki on November 04, 2017, 11:07:47 amEvery SIM card is rewritable because it has been designed to store and even run applications. This stems from dark ages many moons ago, when people thought the next generation of phones would run apps that could be installed over the network. They future didn't quite happen as expected and even though phones would store and run applications, they obviously don't use the SIM card for it. However, the remnants of the idea that they would are still present in SIM cards.Most people don't realize a SIM card is pretty much a complete and discrete system, with its own OS and everything.

author: rbm
author_rank: Regular Contributor
timestamp: November 05, 2017, 01:23:03 am
content: Quote from: TwoOfFive on November 04, 2017, 04:25:29 pmThe same information encoded on the magstripe is also encoded in the EMV chip. However there are significant differences in the format between the two such that the track-equivalent data on the chip is able to thwart card-present counterfeit fraud. That's the promise of EMV and it has proven to significantly reduce counterfeit card-present fraud in mature markets such as Europe and Canada.Quote from: rstofer on November 04, 2017, 06:20:34 pmThat's not exactly true. Generally, the issuer assumes liability for any counterfeit fraud on card-present transactions if the fraudulent transaction occurs at an EMV-enabled point-of-sale terminal and the card was dipped or tapped; however, merchants still are liable for fraud if they accept a swipe from a chip-enabled card on a EMV-enabled terminal. For card-not-present transactions, such as ecommerce, the merchant holds the liability for fraud, unless they use fraud management tools such as Verified-by-Visa or MasterCard SecureCode in which case the issuer assumes the liability. The roll-out of 3D Secure v2.0 during 2018/2019 will shift that liability picture significantly.

author: Bud
author_rank: Super Contributor
timestamp: November 05, 2017, 02:38:14 am
content: Quote from: rbm on November 04, 2017, 12:17:09 pmI did not quote the rest of your post, but Canadian credit and debit cards perform on card transaction specific cryptography such as generation of application cryptogram and dynamic CVC, therefore by your own definition they ARE smartcards.

author: Halcyon
author_rank: Unknown
timestamp: November 05, 2017, 06:51:07 am
content: Quote from: TwoOfFive on November 04, 2017, 04:25:29 pmThe only people still using mag stripes are criminals who skim the data from cards.Here in AU, you can't use the mag stripe unless you tap or insert first and it determines your card to have a faulty chip or for some reason it's not readable.

author: SeanB
author_rank: Super Contributor
timestamp: November 05, 2017, 07:12:17 am
content: Chip and PIN is the most common here, only a very few places ( The post office for example) still will, because of issues with software) will use the magstripe info as backup read, but in all cases they will either tap or insert the chip.There are replay attacks and clone techniques for the chip cards though, and a number of instances of them being cloned as well. The card manufacturers and the banks try to ignore these, always blaming the customer, though there are a few big value claims going through where the bank is losing the court case, as the customers have the lawyers and the proof they had control of the card during the times in question, plus proof of location and actions. There have been rogue readers found as well, that will do things to the data while the card is inserted, like run remote withdrawals while pretending to wait for the card ( they intercept the info in a MITM attack, and send a transaction request the card verifies as signature requiring instead of a PIN, part of the EMV standard, and get a valid authorisation sent to a remote ATM that is doing the hack) then resending the real info and getting the valid second response to reply to the purchase. others send a fake PIN request to the EMV reader, as you can send an arbitrary customer input request that requires a number be entered, so send the PIN entry screen and get the PIN, as you already have from the card reader a cleartext full card number and magstripe track data off the chip, then send the request again for the PIN as encrypted blob for the back end processor. instant cloned magstripe card then, so if you get a pin request and a second one immediately after, and you have entered your PIN correctly then immediately contact your bank and cancel the card, as you suspect it has been cloned. Lot of that malware running around on poorly protected POS system ( Target, Walmart and TJ Max amongst others in the USA recently) computers that likely run on an open network with lax updating and security.

author: rbm
author_rank: Regular Contributor
timestamp: November 05, 2017, 12:53:50 pm
content: Quote from: Bud on November 05, 2017, 02:38:14 amYou are correct; I was mistaken. Did some research and found out that there is a embedded 3DES cryptoprocessor on the chip in addition to hardened memory, required to process the symmetric keys used for card authentication. So it is a smart card and not just a hardened memory card.

author: amyk
author_rank: Super Contributor
timestamp: November 05, 2017, 04:55:26 pm
content: Flylogic's blog had a lot of pictures of these before they became IOActive and shut down the siteThe Archive still remembers, however:http://web.archive.org/web/20130102170323/http://www.flylogic.net:80/blog/

author: rstofer
author_rank: Super Contributor
timestamp: November 05, 2017, 05:38:54 pm
content: In all of this, why are the bad guys so much smarter than the good guys? It seems to me that the good guys lack imagination. They're not open to considering how many different styles of attacks there might be. They get focused on cryptography and the bad guys use phishing.Getting a replacement card 3 or 4 times a year is a PITA.I suppose the bad guys could be random guessing credit card numbers but how is it that my card is used in New York and I live in California and still have physical possession? The good news is that the bank is pretty smart. They pretty much know I'm not in New York and they decline the transaction. That works well when there is a face to face transaction. Not so good for online transactions because I actually do buy a lot of stuff from out of state. I got hit with a flurry of iTunes online purchases a couple of years ago. These were obviously online orders.There is another side to this. There doesn't seem to be any prosecution for anything less than a billion dollars in losses. Has any small time fraudster ever gone to jail? In the real estate debacle with all the fraudulent short sales, the banks never wanted to prosecute and will do just about anything to avoid getting involved. It is easier to write off the losses and move on.In the case of credit cards, the losses are just tacked on to the interest rate. The banks don't really care because they are making a bundle of money on interest. They just don't want to inconvenience their customers.I don't want to see CCs get tied to a PIN. I realize it is part of the 'something you have and something you know' concept but once I place an online order, the PIN is in the wind.

author: rbm
author_rank: Regular Contributor
timestamp: November 06, 2017, 09:30:41 am
content: It's not that the good guys lack imagination; the good guys are encumbered with legacy and compatibility issues. Issuers and acquirers need to have the new technologies interoperate with the old ones and so are limited with options for in-band fraud prevention because the transaction processing systems and protocols are not built with this in mind. EMV, tokenization, point-to-point encryption and 3DS v2.0 are options that will have a positive effect on lowering fraud rates and reducing card data breaches in the future.You can't just guess account numbers because you have to accurately associate them with other information such as expiry date and cardholder name.Traditional law enforcement and litigation lag behind technology which is why you don't see the perpetrators brought to justice. It's hard to apprehend a criminal in one jurisdiction and prosecute them in another, especially if extradition is involved. Furthermore, to get a successful indictment, you have to prove beyond a reasonable doubt that the accused performed the crime and that takes great care in preserving chain of custody on evidence; hard to do with electronic evidence.PINs are used for card-present transactions, not card-not present. Also, PIN blocks are exchanged, not the PINs themselves.