top | item 44151523

(no title)

halpow | 9 months ago

If you want to try easy mode, check out those newfangled android-based credit card terminal. I bet they're much more rewarding, especially since you tap your pin on the screen. Juicy.

discuss

order

bmurray7jhu|9 months ago

The touch controller is generally connected to a MUX controlled by the security processor. When entering sensitive data (PIN/PANs), the touch controller output is routed directly to the security processor, bypassing any Android-derived OS responsible for the GUI.

tgsovlerkhgsel|9 months ago

And as a user, I have absolutely no way of distinguishing this from a device that had all secure features removed, and is running a random Android that proxies the NFC or chip data to a real reader, siphoning off what they can, while my PIN gets proxied by a human typing it into the real reader in real time. All I'd notice is a second or so of latency.

_djo_|9 months ago

The PIN data is still encrypted even when displayed on a touch pad, using user interfaces controlled by firmware running in the trusted zone.

So the applications in between, that would be accessible in an attack like this, can't view the PIN.

jeroenhd|9 months ago

That'd get you the PIN quite easily, but if they're designed the same way (with all the important bits being handed off to a secure secondary processor) you still wouldn't be able to do much with the card as modern cards do a whole load of cryptography on-card to prevent stuff like this.

The attack would only work on terminals where every payment option but the magnetic card reader is broken, but those should give off skimmer alert alarm bells before you ever see a PIN prompt.

user_7832|9 months ago

I'm not sure which type of android terminals you have where you are, but in India they seem to be running Android Oreo (support ended in Jan '21). Yummy!

user_7832|9 months ago

Also, it is possible to open other apps and the notification centre. And unsurprisingly the entire device is terribly laggy.