[LINK] RFI: PayWave/PayPass Contactless Chip Cards

[Kim Holburn]

On 2012/Apr/11, at 3:33 PM, Roger Clarke wrote:

>> On Wed, Apr 11, 2012 at 3:11 PM, Roger Clarke 
>> <Roger.Clarke at xamax.com.au> wrote:
>>> Is anyone aware of any forms of consumer resistance to these things?
>>> 
> At 15:16 +1000 11/4/12, Andy Farkas wrote:
>> I got a new card last week.
>> First thing I did was scratch the chip off.
> 
> 1.  The visible chip is a contact-based chip.
> 
> That technology is of long standing, but the banks have only recently 
> started using them to reduce the insecurity of card transactions.
> 
> I've not done a deep audit myself of course, but my position on this 
> aspect is that it's a good thing generally, including for consumers 
> (because it disguises data that would otherwise appear on the mag 
> stripe, or in more primitive systems on the embossing).
> 
> 2.  The contactless chip that supports Visa PayWave and MasterCard 
> PayPass is embedded in the card (along with the induction coil), and 
> can't be seen.
> 
> Presumably it would be possible to scratch away at the card, get down 
> to the embedded chip, and damage it.  Although it may be easier to 
> bend the card sufficiently to break the induction coil and hence 
> disable the communications between the contactless chip and the 
> reader.

If you really wanted to damage the chip you could probably give it a small dose of microwaves.  I don't think it is a good idea though.

The simple but annoying option is of course to carry it around wrapped in foil until you want to use it.

Kim

-- 
Kim Holburn
IT Network & Security Consultant
T: +61 2 61402408  M: +61 404072753
mailto:kim at holburn.net  aim://kimholburn
skype://kholburn - PGP Public Key on request