First Contact - Vulnerabilities in Contactless Payments

No ratings

Presented at BlackHat Europe 2019 by

Leigh-anne Yunusov

Introduced in 2007, contactless (NFC) payments have been used widely for a decade. Accounting for more than 40% of transactions globally, contactless payments are fast replacing cash and CHIP. Yet, contactless makes use of protocols much older than the technology itself. So, how safe and secure are contactless payments?In this talk, we discuss how the EMV protocols and magstripe modes used for contactless are equally flawed. For the first time, we show how to bypass the UK £30 limit for contactless payments made using physical cards. Then how to circumvent limits for mobile wallets using locked mobile phones. What's more, we cover flaws in the generation keys values, the unpredictable number (UN) and application transaction counter (ATC). Another first, we perform a pre-play attack using EMV without downgrading to legacy modes.