I thought Chip & Pin was meant to be safe..

Duke · 5 Jan 2007 at 22:34

El Reg said:
UK researchers have hacked a supposedly tamper-proof Chip and PIN terminal to allow it to play Tetris. Steven Murdoch and Saar Drimer of the University of Cambridge managed to get a playable version of the classic game working on the tiny screen.

The proof-of-concept hack highlights wider security concerns about the terminals even though it was only possible after Murdoch and Drimer replaced most of the internal electronics after opening up the terminal. The attack illustrates the possibility that hackers might be able to physically modify terminals for far more malign purposes.

Video here - http://www.youtube.com/watch?v=wWTzkD9M0sU

A bit worrying

hybrid · 5 Jan 2007 at 22:36

lol - imagine what they could do to a cash machine then lol.

Do most cash machines still run 3.11?

Glaucus · 5 Jan 2007 at 22:37

Not really, they had to replace a lot of the internal components. replace enough components and you can get a screen to do anything.

Although I still think it should have one way glass your hand goes under.

cleanbluesky · 5 Jan 2007 at 22:37

Duke said:
A bit worrying

hardly, Tetris is a party at your fingertips - better than battering the soddin finances anyday

crystaline · 5 Jan 2007 at 22:39

Chip and pin is so banks can reliquinsh responsibility for on site fraud. Signiture fraud, they have to refund for. Pin fraud.. you are responsible for and will not be refunded as they will say you cannot prove you didn't share it with anyone else.

Fact.

hybrid · 5 Jan 2007 at 22:40

crystaline said:
Chip and pin is so banks can reliquinsh responsibility for on site fraud. Signiture fraud, they have to refund for. Pin fraud.. you are responsible for and will not be refunded as they will say you cannot prove you didn't share it with anyone else.

Fact.

OooOooooO, i did not know that. I shall have to remember that one.

Bunka · 5 Jan 2007 at 22:42

hybrid said:
OooOooooO, i did not know that. I shall have to remember that one.

If it's true, then what exactly can you do about it if you 'remember that one' :confused:

Jotun · 5 Jan 2007 at 22:42

It was on hackaday not long ago.

Like AcidHell2 said, they replaced a lot of the machine. All you need is the casing, sscreen, keypad and card reader to be same, and people will happily use it to pay for purchases.

I would be a lot more worried if the hardware was the same and someone had found a way to overwrite the software for the device.

Jonny L · 5 Jan 2007 at 22:43

LOL I wish you could get tetris on those things, then they could give you money off what you're buying if you win,

Duke · 5 Jan 2007 at 22:43

cleanbluesky said:
hardly, Tetris is a party at your fingertips - better than battering the soddin finances anyday

Very true

hybrid · 5 Jan 2007 at 22:46

Bunka said:
If it's true, then what exactly can you do about it if you 'remember that one'

Maybe pass the knowledge on!? :confused:

Bunka · 5 Jan 2007 at 22:49

hybrid said:
Maybe pass the knowledge on!?

Fair enough, I was just thinking that if you were in the situation where the bank claimed lack of responsibility, then you wouldn't be able to really do anything about it.

crashuk · 5 Jan 2007 at 22:51

Duke said:
Video here - http://www.youtube.com/watch?v=wWTzkD9M0sU

A bit worrying

chip and pin really worse security ever.

hybrid · 5 Jan 2007 at 22:51

ahh nah nah, i wasnt trying to say it from that point of view d00d.

Just pub ammo really lol.

cleanbluesky · 5 Jan 2007 at 22:53

crashuk said:
chip and pin really worse security ever.

That's **** and you know it, I used to play tetris on receipts with pens long before chip and pin was around

Bunka · 5 Jan 2007 at 22:53

hybrid said:
ahh nah nah, i wasnt trying to say it from that point of view d00d.

Just pub ammo really lol.

Haha, could start quite an interesting drunken debate about it after a good few pints.

hybrid · 5 Jan 2007 at 22:55

lol - cant you with anything these days... the power of alcohol

Vonhelmet · 5 Jan 2007 at 22:59

crashuk said:
chip and pin really worse security ever.

More security than signatures that go unchecked and ARE ON THE FREAKING CARD.

kibblerok · 5 Jan 2007 at 22:59

crystaline said:
Chip and pin is so banks can reliquinsh responsibility for on site fraud. Signiture fraud, they have to refund for. Pin fraud.. you are responsible for and will not be refunded as they will say you cannot prove you didn't share it with anyone else.

Fact.

Exactly

Fraud still exists but the banks don't have to pay out so its brushed under the carpet. Then they say fraud has dropped over 50% and everything is okay.....

crashuk · 5 Jan 2007 at 23:02

you can buy 1000 chip cards on the net for £500.