Thinking Of Going Smart In Your Kitchen?}

Sunday, February 14, 2010

University of Cambridge security expert Professor Ross Anderson has blasted the EMV system used worldwide for credit and debit card transactions, and known in the UK as Chip and PIN, after his research team discovered a serious vulnerability. The group were able to carry out purchases using a card, even without knowing the associated personal identification number (PIN), by using a “man-in-the-middle” attack.

Retail terminals at the point of sale require the cardholder to insert their card and enter their secret PIN before a transaction can be authorised. They then communicate with the microchip built in to the card itself, which holds the PIN. If the correct number has been given, this chip returns a standard verification code (0x9000) to the terminal.

In the researchers’ attack they inserted a genuine card into a second reader, connected to a laptop. The laptop is linked by thin wires to a fake card, which is inserted into the retailer’s terminal. The laptop relays the communications between the terminal and the stolen, but genuine, card, up until the stage where the PIN is to be checked. At this point it intercepts and responds with the verification code, no matter what number was entered. The retailer’s terminal then believes that the correct PIN has been entered, and the card can be told that a signature was used to verify the cardholder instead.

Their technique has been tested successfully on cards from six different issuers: Bank of Scotland, Barclaycard, Co-operative Bank, Halifax, HSBC and John Lewis.

The group say that not much technical skill is required for the attack, and suggested the equipment needed could be kept in a backpack, with the wires to the fake card running down a user’s sleeve. They believe the equipment could be miniaturised to the size of a remote control.

“In practice how this attack would work is that one reasonably technically skilled person would build a device that carries out the attack and then sell this equipment on the internet just like criminals already do,” said Dr Steven Murdoch who worked on the project.

Professor Anderson claimed that the attack could already be in use by criminals. “We have many examples of people who have had their cards stolen and then purchases made using the chip and pin,” he said. “They are adamant they didn’t use it but if the banks say chip and pin has been used you have to pay. I think many of these people would have been victim of the kind of technique we have developed.”

He was scathing about bank claims that the system was secure. “The banks are wrong. All the banks are lying. They are maliciously and wilfully deceiving the customer. If there was any justice then the police would be looking into this. The system is not fit for purpose.”

Consumer group Which? have also called for an investigation, stating that in a recent survey one in seven people said that money had been taken from their accounts without authorisation. Around half of these did not have the money refunded by the bank.

“We want the banks to look into these potential flaws,” said Cathy Neal from Which? Money, “because we have had many examples where the banks have said a pin was used and the customer said it hasn’t.”

Over 90 percent of UK card transactions at point-of-sale use chip and PIN, according to the UK Payments Administration. The attack does not affect ATM transactions, which use different standards. Mark Bowerman, a spokesman for the group which represents card companies, said that there was no evidence the attack was in use and emphasised that card fraud had fallen with the introduction of chip and PIN.

“We are taking this paper very seriously, as maintaining excellent levels of card security is paramount,” he said. “However, we strongly refute the allegation that chip and PIN is broken.”

The research paper has been made available as a working draft, and is due to be published at the IEEE Security and Privacy Symposium in May 2010. Members of the banking industry were informed of the vulnerability in early December last year.

Saturday, February 26, 2011

An elderly Brooklyn, New York woman was found dead yesterday after a fire triggered by a voodoo ceremony caused a blaze in an apartment that left dozens homeless. The details of the ceremony were not clear, but sources say it led to sex.

An unidentified woman hired a Voodoo priest for $300, identified as Nelson (Pepe) Pierre, to perform a mystic ceremony meant to bring her good luck. The woman went to Pierre’s apartment, where she ended up in bed surrounded by lit candles which were mistakenly knocked over, setting the bedsheets on fire. In an effort to suppress the flames, Pierre splashed water from the bathroom sink on the sheets while his roommate, who was ironing at the time, opened a window for air. However, according to the New York Fire Department, wind gusting through the open window created a “blowtorch effect” which caused the fire to spread to the 4th floor hallway and into the 5th and 6th floors. The blaze killed one woman, three others were severely injured, and at least 20 firefighters were left with burn wounds.

In an NYFD statement, Fire Commissioner Salvatore J. Cassano said, “Time and time again we respond to tragedies that could have been so easily prevented. This fire had so many of those elements … hopefully others will learn from this tragedy.” It took hours for hundreds of firemen from dozens of companies to bring the raging fire under control.

Pierre, a man in his 60s, did not call 911 right away, but attempted to quell the fire using water from the bathroom sink. A source in law enforcement said, “Nobody sees a crime right now. It was an accident. Maybe they weren’t careful, but they did try to put it out.”

Mary Feagin, a 64-year old retired teacher, died in the blaze.

The New York Police Department is currently investigating the incident.

Saturday, April 12, 2008

On the back of new restrictions being imposed on eBay users in the United Kingdom requiring that sellers offer PayPal payments for all sales, eBay Australia is mandating that only PayPal payments will be acceptable as of June 17. PayPal is a wholly-owned subsidiary of eBay, and charges a 30¢ transaction fee, plus a commission between 1.1% for high volume traders, and 2.4% for low value or low volume traders. These higher costs will be passed onto buyers.

Cash payment on pick up will be the only other payment option, and it may only be offered in conjunction with PayPal.

eBay has brought in this restriction under the guise of improving customer protection, bolstering its “Paypal Buyer Protection” insurance programme to allow claims up to A$20,000 instead of the previous maximum of $3,000, however as of June 17 many of the items which would exceed $3,000 are no longer covered by the programme, such as services, vehicles, real estate and businesses.

eBay Trust and Safety director Alastair MacGibbon said this change was not in response to the once-off fund established in March to refund eBay buyers who lost their non-existent holiday accommodation packages from the Melbourne eBay seller Robert Kobis. Mr MacGibbon said “It is part of a much larger initiative”.

In addition to these measures, Paypal will be withholding funds from some sellers for 21 days

The Australian Competition and Consumer Commission has held discussion with eBay, but declined to comment. The Australian Consumers Association spokesman Christopher Zinn said the unique use of PayPal could give rise to competition issues, however if the costs charged stayed as they were, they had no further concerns.

Thursday, July 27, 2006

Six hundred Tube passengers had to be moved to safety in west London tonight after a landslide close to a station on the London Underground.

Commuters on board an eastbound Piccadilly Line train at Boston Manor Station were evacuated after around four tonnes of debris landed on the tracks. The train collided with the rubble, but London Underground said the train stayed on the tracks. There are no reports of any injuries. Due to inspections of damage caused, the Piccadilly Line has been suspended between Northfields and Heathrow. London Underground said all of the train’s passengers were led off onto the platform at Boston Manor within 15 minutes.

A spokeswoman said: “London Underground is currently assessing the impact of an embankment landslip between Boston Manor and Northfields. Initial indications are that three to four tonnes of debris has ended up on the track. An eastbound Piccadilly Line train came into contact with the debris at Boston Manor station.”

A replacement bus service is operating between Northfields and Heathrow. Tube tickets can also be used on Heathrow Connect rail services from Ealing Broadway.

Staff at London Underground are trying to clear the debris overnight in the hope of resuming service on the line on Friday morning.