Researchers say they’ve found a security hole that exposes EMV chip-and-PIN protected cards, adding wrinkle to the hot debate over the use of the security standard in the U.S.
According to InversePath researchers, the flaw allows skimming devices to steal data from chip-and-PIN protected cards at point of sale terminals and ATMs.
The Italian online security firm, which called chip-and-PIN “broken” at the recent CanSecWest security conference in Vancouver, built a faux skimming device. It says the device can be installed on any terminal, is difficult to locate and can draw power from the actual terminals.
InversePath also says the skimming devices can intercept EMV card communications.
EMV cards communicate with terminals through application protocol data unit messages, which read records and issue commands. The tech firm says the skimming devices can read these message exchanges.
Generally considered to be safer than MAG stripe cards, EMV cards are widely used outside the U.S. but have not caught on in the States because of concerns over the multibillion dollar cost of migration, though some, such as Wal-Mart and members of the Atlanta Fed, say the lack of migration isolates the U.S.
