{"id":187640,"date":"2021-02-23T16:54:08","date_gmt":"2021-02-23T13:54:08","guid":{"rendered":"https:\/\/en.buradabiliyorum.com\/security-flaw-detected-for-the-second-time-in-credit-cards\/"},"modified":"2021-02-23T16:54:08","modified_gmt":"2021-02-23T13:54:08","slug":"security-flaw-detected-for-the-second-time-in-credit-cards","status":"publish","type":"post","link":"https:\/\/buradabiliyorum.com\/en\/security-flaw-detected-for-the-second-time-in-credit-cards\/","title":{"rendered":"#Security flaw detected for the second time in credit cards"},"content":{"rendered":"

“#Security flaw detected for the second time in credit cards<\/strong>”<\/p>\n

\n
\n
\n
\"credit
\n Credit: CC0 Public Domain
\n <\/figcaption><\/figure>\n<\/div>\n<\/div>\n

After finding a vulnerability in certain credit cards for the first time last year, ETH researchers have now found a way to outsmart the PIN codes for other payment cards.<\/p>\n

Making a contactless payment with a credit or debit card is quick and easy, and has proved particularly useful during the current pandemic. For added security, the user has to enter a PIN code above a certain amount (usually CHF 80 in Switzerland) \u2013 at least, that’s the theory. As three researchers in the Information Security Group at ETH Zurich were able to show, these security measures can be bypassed with certain cards. The first time the researchers were able to document how credit cards could be used without a PIN code was in summer 2020, using Visa cards. The team have now disclosed that another bypass is possible with other types of payment cards, namely Mastercard and Maestro.<\/p>\n

The methods used by the researchers are based on the “man-in-the-middle” principle, where attackers exploit the data exchanged between two communication partners (in this case the card and the card terminal). To replicate this effect, the researchers used an Android app<\/a> they had created and two NFC-enabled mobile phones. The app falsely signaled to the card terminal that no PIN was required to authorize the payment and that the card owner’s identity had been verified. Initially, the method worked only on VISA cards, as other providers use a different protocol (a protocol governs data transmission).<\/p>\n


\n