We present an attack on hardware security modules used by retail banks for the secure storage and verification of customer PINs in ATM (cash machine) infrastructures. By using adaptive decimalisation tables and guesses, the maximum amount of information is learnt about the true PIN upon each guess. It takes an average of 15 guesses to determine a four digit PIN using this technique, instead of the 5000 guesses intended. In a single 30 minute lunch-break, an attacker can thus discover approximately 7000 PINs rather than 24 with the brute force method. With a $300 withdrawal limit per card, the potential bounty is raised from $7200 to $2.1 million and a single motivated attacker could withdraw $30{50 thousand of this each day. This attack thus presents a serious threat to bank security.
http://cryptome.org/pacc.htm
Thursday, February 20, 2003
Popular Posts
-
The concept of dragons was probably brought to Japan around 2,000 years ago, along with the technology for paddy agriculture. Their images h...
-
...These measures, based on the US Digital Millennium Copyright Act (DMCA) give far too much power to publishers, at the expense of individu...
-
His system, he said, starts with a laser that sends part of its beam into photo detectors which produce electrical signal that feed back to ...
-
Someone that gets it. Service-oriented software, when done correctly in a platform-agnostic way can be flexible, cheap, and can motivate m...
-
...why was this given the file name of skyfall?... Certain information, while not specific as to target, gives the government reason to beli...
-
When it comes to buying equipment, think g, not b. New 802.11g hardware is nearly five times faster than 802.11b gear, and it will interoper...
-
This edition provides a prose rendering of The Epic of Gilgamesh, the cycle of poems preserved on clay tablets surviving from ancient Mesopo...
-
From the bygone debates over DDR vs. RDRAM to the current controversy over Apples DDR implementations, one issue is commonly misunderstood i...
-
In my mind, this is a huge waste of effort. Put a base on Mars instead of the Moon -- there's huge science finds waiting there to be dis...
-
Personally, I believe that consciousness is an emergent property of complex, ordered (yet chaotic) systems which are not necessarily biologi...