The EMV Protocol: Secure Until Companies Add Features

▶ Watch (2:58)

When you tap a contactless card, the reader asks what card it is. Visa replies differently than Mastercard. The card creates a cryptographic MAC using a key shared only with the bank. The bank checks the MAC, runs fraud and balance checks. Four lights on the reader mark each stage. The process is fast and works well. If EMV companies stopped there, everything would be fine. They cannot help themselves. They add new features and tweaks, and those break security.

Apple Transit Mode: No Face ID, No Limit

▶ Watch (13:10)

Apple and Visa added a transit mode that removes the lock screen. A magic code at the ISO 14443 layer unlocks the payment app. The reader sends a flag saying “I’m a transit reader.” The attacker relays and flips the high‑amount bit. The card thinks $10,000 is a low amount. The attacker lies that Face ID was done. The bank approves. Apple blamed Visa. Visa blamed Apple. The attack works in practice. Malware now uses it to steal money from phones with Apple Pay, Visa, and transit mode enabled.

Square Offline Mode: The Loyalty Card Trick

▶ Watch (22:19)

Square’s offline mode uses a loyalty card query to detect phones. The reader asks “Do you have loyalty cards?” An error means plastic card. A “no” means phone. Attackers record and replay the no‑loyalty response. Square then accepts the transaction without authentication. One attack charged $20,000. Square fixed it quickly. The fix introduced a window where readers accepted any signature offline. For months anyone could record card data and print money.

Timing Out Relay Attacks: A Standard in Progress

▶ Watch (30:49)

Relay attacks add milliseconds. Timing the exchange at the low ISO layer can stop them. The reader starts a clock when it sends a message. If the card replies before 15 milliseconds, it is genuine. Above that, it is a relay. Mastercard’s higher‑layer timing fails because card distance varies. The low‑layer approach works. The team has spent two years with the ISO standardization committee. The amendment is being voted on now. A single change took two days of debate between Dutch and French delegations.

Q&A

Why are those fields not covered by the MAC? They are covered by the signature, but the signature is only checked in offline mode. The reader thinks it’s online. ▶ 17:51

Notable Quotes

So, if you have Apple Pay and Visa and Transit mode, people can take any amount of money from your phone whatsoever. Tom Chothia · ▶ 21:49

Visa said it was Apple’s fault and they were fine with it. Apple said it was Visa’s fault and they were fine with it. Tom Chothia · ▶ 21:13

Square fixed this very quickly and very effectively. Tom Chothia · ▶ 27:15

we propose actually timing this exchange. Tom Chothia · ▶ 30:16

Key Takeaways

  • Apple’s transit mode bypasses Face ID for Visa transactions up to any amount.
  • Square’s offline mode used a loyalty card query that plastic cards could replay.
  • Timing at the NFC handshake layer can stop relay attacks; ISO approval is pending.

About the Speaker

Tom Chothia is a Professor of Cyber Security at the University of Birmingham, UK. His research involves the development of new mathematical analysis techniques, and the application of these techniques to real world cyber security problems. His past work on the security of EMV, ApplePay, banking apps, pacemakers and video game cheats have all received widespread media coverage.