Relaying contactless payment cards

across a room... or the ocean!

Andreea-Ina Radu

@inutza16
@neko3

Contactless Payment Cards

How a Contactless Transaction Works

Hello 👋 SELECT 2PAY.SYS.DFF0
Hi, I speak VISA 👋 File Control Information Template
Let's talk VISA! SELECT VISA
Tell me the payment info! Processing Options Data Object List
Amount, currency, date, random number GPO command
Cool, I'll sign this off! Response Message Template Format (includes Application Cryptogram)

How a Relay Attack Works

Hello 👋 (few cm at most)
Hello 👋 (some meters/km)
Hello 👋
Hello 👋
Hello 👋
...

...
Hello 👋
Hi, I speak VISA 👋
Let's talk VISA!
Tell me the payment info!
Amount, currency, date, random number
Cool, I'll sign this off!

...

...

Video of demo

This was also tried NYC - Birmingham...

and it worked!

Can we stop this?

Kind of... Distance bounding

Amount, currency, date, random number
Cool, I'll sign this off!

Keep your cards safe!

Thanks for listening!

AMA in the Q&A!