Cambridge boffins: Chip and PIN cards CAN be cloned – here's how
Chip and skim Boffins at Cambridge University have uncovered
shortcomings in ATM security that might be abused to create a
mechanism to clone chip-and-PIN cards. The security shortcoming
might already be known to criminals and creates an explanation
for what might have happened in some, otherwise baffling,
"phantom" withdrawal cases. Each time a consumer uses their
chip-and-PIN card, a unique "unpredictable number" is created to
authenticate the transaction. Mike Bond, a research associate at
the University of Cambridge Computer Lab, explains that elements
of these "unique" transaction authentication numbers appear to
be predictable. The cryptographic flaw – the result of mistakes
by both banks and card manufacturers in implementing the EMV*
protocol – creates a means to predict that authentication code
(the "unpredictable" number). For example, if a crook had access
several other authentication codes generated by the particular
card (in their p