EMV Protocol Fuzzer

Surprisingly limited public research exists addressing security aspects of hardware and software specific implementations. This is something we wanted to put right and therefore started a new research programme to specifically look at this area.

Previous research has already uncovered security issues in this technology, asking serious questions of the processes used to develop and test modern EMV-enabled devices. Based on discussions with those involved in these areas MWR identified a need to further develop structured and formal security evaluation approaches in order to provide the highest levels of assurance to all interested parties.

As a result of this research we are pleased to present an EMV protocol fuzzer that can be used as a tool to evaluate the security integrity of a device under test (DUT). This solution includes a Python interface to facilitate control of the EMV fuzzer, in effect allowing on-the-fly monitoring and emulation of an EMV stream with the DUT. Various predefined security tests were also developed to formalise the security evaluation procedure. Our design is ready to be interfaced with a fuzzing algorithm and thus presents the first step towards a fully automated EMV fuzzing solution.

In order to test our solution, the proof of concept implementation of our EMV fuzzer was used against some real-world POS devices. This resulted in the identification of security issues and was part of the validation of our approach to the initial problem we were looking to solve. The security issues identified are currently being addressed by those affected and more details will be provided when it is appropriate to do so.

We are now providing details of our approach, information about our proof of concept implementation and limited technical details of our findings.

The EMV standard, also known as Chip and PIN, is used primarily by banks across the globe as the industry de-facto standard for authenticating smartcard transactions. The most widely used chip card implementations of the EMV standard are Visa, MasterCard, American Express, JCB and Discover/Diners Club International [1], [2]. Since EMV is based on the ISO 7816 standard, which secures inter-operation between smartcards and associated terminals, this research also applies to other implementations where smartcards are present such as in subscriber identity modules (SIMs) and DTV decoders.

Although the standard defining EMV is in principal secure, vulnerabilities can easily be introduced into the terminal-smartcard authentication procedure by the hardware and software specific implementation of the actual EMV-enabled device. Recent work by [3] indicated the ease, at that time, with which vulnerabilities could be found in existing POS devices by using a programmable smartcard, without the need for sophisticated card-emulating or man-in-the-middle attack hardware. In the aforementioned case a vulnerability was discovered, by modifying the smartcard response data, before the PIN verification stage, until an error exception occurred in the POS device. The fact that an error could be introduced after only a few attempts, by hand, illustrated a potential gap in the assurance processes that were in use at the time. As a result it was easy to theorise that additional vulnerabilities might exist in current POS devices used world-wide. Exploitation of the security issue found in [3], which leads to system level execution of malicious code, was completed to highlight the impact and implications of the issue. Full details of this have never been released, except to those responsible for resolving the issues.

In order to ensure the security integrity of an EMV-enabled terminal, it is necessary to test it against a multitude of response vectors, which have potentially not been accounted for in the design stages. This case lends itself particularly well to an automated electronic solution, such as an EMV fuzzing device, which would be able to test a target terminal for potential vulnerabilities in a fast, controlled and reproducible manner. Furthermore, interest has been expressed in the recent peer-reviewed literature [4] to automate the process of fuzzing POS devices in real time. This is an attractive solution to the security testing of such devices before they are deployed in-field.

In this work an automatic EMV Fuzzing device is presented. It is based on the research presented in [1], whereby a USB interface with a PC allows the communication between the smartcard and POS terminal to be monitored and modified in real-time. The EMV fuzzer is controlled by means of Python scripts allowing the simple automation of various pre-defined security tests, in effect formalising the security evaluation procedure. The proposed design automates insertion and retraction of the emulated smart card by means of a linear actuator and is ready to be interfaced with an automated fuzzing algorithm. This work presents the first step towards a fully automated EMV fuzzing solution.

The functional block diagram of the proposed design is shown below.

Functional unit one (FU1) represents the EMV fuzzing hardware and firmware. FU1 is comprised of a central microcontroller (FU1.1), a USB control interface (FU1.2) that communicates with the controlling python scripts (FU2), the ICC interface (FU1.3) that connects to a smartcard, an emulated ICC interface (FU1.4) that is connected to the DUT as well as a robotic arm (FU1.5) that automates the insertion and retraction of FU1.4 from the DUT. FU1.5 also includes a DUT reset switch in the form of a relay which can be used to reset the DUT during the fuzzing operation. The complete design with the various functional units indicated above is shown later.

The interfacing python scripts are controlled by FU3. FU3.1 implements predefined functions that are useful in the security evaluation of devices using an EMV protocol interface. FU3.2 illustrates how a fuzzing algorithm can interface with the system described above, using both the interfacing python functions as well as the developed security tests.

The hardware portion of the design is concerned with FU1. First FU1.1 – FU1.3 is implemented in soft-substrate on a PCB as shown below. Next the design of FU1.4 is implemented in PCB form. Finally FU1.5 is realised on a separate PCB which interfaces with FU1.1 – FU1.3.

The aforementioned sub-systems are interconnected to form FU1 as shown next.

The software implementation can be subdivided into the firmware written for FU1.1 and the Python software written for FU2. The firmware for FU1.1 is based on [1] with the source code available at [5]. Various modifications and additions have been made to the existing firmware – with some details contained in the appended technical report.

Notably, real-time modification of the EMV stream is supported, as required for the seamless interface with the automatic fuzzing algorithm. A method of abstracting the interfacing Python functions away from low-level timing management is devised. This allows the user to focus on the data stream exchange, rather than being constantly forced to debug timing issues. Furthermore, a new method of fostering the control bytes is implemented allowing the user more control over the EMV communication flow, which is otherwise almost entirely dependent on the DUT. Details are available in the appended report.

As mentioned earlier, only some results will be presented here. After the correct vulnerability disclosure procedure has been followed with affected parties, the remaining results will be published.

The communication stream between a Point-of-sale (POS) terminal and a VISA smart card (ICC) is captured. Data sent from the POS device is introduced by the symbol (-->) whereas data sent from the smart card is preceded by the symbol (:). A command header is shown using the notation: [CLA INS P1 P2 P3].

Two video demonstrations are provided here.

The first demo presents sniffing EMV communications between a POS terminal and VISA ICC.

The second demo shows how the data captured in the previous video can be replayed to the POS terminal.

This data can now be modified to test the DUT for various vulnerabilities. Additional videos will be added at a later stage illustrating this possibility.

An EMV protocol fuzzer to test the security integrity of EMV-enabled devices is presented. The EMV communication stream between the DUT and smart-card can be monitored and modified in real-time. Interfacing high-level Python functions have been developed, compatible with a high-level fuzzing algorithm. Furthermore, robotic automation has been included to automatically insert and retract the emulated ICC into/from the DUT – a feature necessary for automatic fuzzing. Future work should focus on developing an EMV fuzzing algorithm as well as developing new methods of reading data from the DUT in order to obtain more information about an induced system crash.

Here is the link to the technical paper for more details.

EMV Fuzzer Summary Paper

[1] O. Choudary, “The Smart Card Detective: a hand-held EMV interceptor,” University of Cambridge, Cambridge, England, 2010.

[2] J. P. Degabriele, A. Lehmann, K. G. Paterson, N. P. Smart and M. Strefler, “On the Joint Security of Encryption and Signature in EMV,” Springer Topics in Cryptology, pp. 116-135, 2012.

[3] MWR InfoSecurity, “PINPADPWN,” in Blackhat, City of Las Vegas, USA, 2012.

[4] G. de Koning Gans and J. de Ruiter, “The smartlogic tool: Analysing and testing smart card protocols,” in IEEE Fifth International Conference on Software Testing, Verification and Validation, Montréal, Canada, 2012.

[5] O. Choudary, “Google code: smartcarddetective,” University of California, Berkeley, 2 May 2011. [Online]. Available: https://code.google.com/p/smartcarddetective/. [Accessed 1 September 2014].

[6] EMVCo, “EMV Integrated Circuit Card Specifications for Payment Systems – Book 1,” EMVCo, LLC, 2008.

[7] EMVCo, “EMV Integrated Circuit Card Specifications for Payment Systems – Book 3,” EMVCo, LLC, 2008.