Certainly harder than cloning a magnetic stripe, but the PIN verification was as simple as the reader saying "Is 1111 the right pin?" and the card responding "Yep, that's the right pin." So they took apart the cards and MITMed the response to always confirm, no matter what pin was entered.
Hopefully that's been fixed by now, but with the number of readers that would need to be upgraded, I wouldn't count on fixes rolling out quickly. And who knows if there are other weaknesses?
Certainly harder than cloning a magnetic stripe, but the PIN verification was as simple as the reader saying "Is 1111 the right pin?" and the card responding "Yep, that's the right pin." So they took apart the cards and MITMed the response to always confirm, no matter what pin was entered.
Hopefully that's been fixed by now, but with the number of readers that would need to be upgraded, I wouldn't count on fixes rolling out quickly. And who knows if there are other weaknesses?