News for hackers. Stuff that matters.

A comment on Why You Still Can’t Use a Chip Card Everywhere. Parent comment

Re:Why You Still Can’t Use a Chip Card Everywhere by oarsinsync on Monday July 25, 2016 @06:28AM (#12157688)
Unfortunately that's only true until the next vulnerability that allows theft via NFC on a mobile device. There has already been one, there will almost certainly be another.

http://www.securityweek.com/contactless-visa-cards-vulnerabl...

> "With just a mobile phone we created a PoS terminal that could read a card through a wallet," said Martin Emms, lead researcher on the project. "All the checks are carried out on the card rather than the terminal so at the point of transaction, there is nothing to raise suspicions. By pre-setting the amount you want to transfer, you can bump your mobile against someone’s pocket or swipe your phone over a wallet left on a table and approve a transaction. In our tests, it took less than a second for the transaction to be approved."

[ Parent | on HN ]
Re:Why You Still Can’t Use a Chip Card Everywhere by gambiting on Monday July 25, 2016 @06:32AM (#12157706)
Absolutely - but that still flags a terminal for review and will get it blocked. There does not exist any vulnerability that would allow you to clone NFC cards, which has the biggest potential for abuse. And again, even then - contactless cannot be used to take out any cash, so it's not an attractive target for thieves. What are they going to buy with a cloned NFC card(if they could get one)? Lunch?
[ Parent | on HN ]