Ososayensi bathola iphutha ohlelweni lwezokuphepha kwamanye amakhadi okuthenga ngesikweletu

Amakhadi webhange axhumana naye anenketho esheshayo futhi ewusizo yokukhokha ngokuthenga okujwayelekile. Kuyisikulufu esibalulekile ikhadi lakho emshinini we-POT ukwenza imali engenamqondo.

Amanani amancane angakhokhiswa ngokushesha futhi umane nje, futhi amakhadi okudlala acatshangelwa ukuthi aphephile ngenxa yekhodi yezokuphepha iyadingeka ekudonseni imali enkulu.

Iningi lalezo zingcweti ngokuyinhloko zisuselwa endaweni evamile ye-EMV, okusebenza ngaphezulu 9 Amakhadi okudlala amabhiliyoni emhlabeni jikelele. Yize ibukeziwe izikhathi eziningi kusukela lapho, I-algorithm ethuthukile inenqwaba yamandla engcupheni engaxhashazwa.

Ngeziphathimandla ezahlukahlukene zokuphepha sezivele zithola amaphutha e-applion, Ososayensi at Eth Zurich manje sekwethule okunye, Ukuphepha okukhulu kwezokuphepha.

Njengesinyathelo sokuqala, USolwazi Wokuphepha Kwemininingwane UDavid Basin wasebenzisana neRalf Sasse, Umcwaningi Ophezulu Ekuhlukanisweni KweSayensi yeLaptop, noJorge Toro pozo, I-postdoc embuthanweni ka-basin, Ukuqamba i-Mannequin eyakhelwe injongo ukuze bahlole izingxenye eziphakathi ze-EMV ezejwayelekile. Bathola umgodi obalulekile kwi-protocol esetshenziswe yi-visa yekhadi le-Bank Card.

Lokhu kubangozini kuvumela abakhwabanisi ukuthi bathole imali kumakhadi okudlala ahlelwe kabi noma antshontshiwe, Yize amanani asolwa ukuthi aqinisekiswe ngokungena kwikhodi yephinikhodi.

Lokhu kubangela ukuzuzisa ukunika amandla okukhwabanisa ukuqongelela impahla kusuka kumakhadi ahlelwe kabi noma antshontshiwe, Kungakhathaleki ukuthi inani lidinga ukugunyazwa ngokungena kwikhodi ye-PIN. I-Toro ikubeka endaweni ngokuyinhloko: "Kukho konke okulindelwe nemisebenzi, Ikhodi ye-PIN ayisebenzi lapha. "

Izinkampani ezahlukahlukene, Ifana ne-Mastercard, I-American Ecacile, kanye ne-JCB, Musa ukusebenzisa protocol ye-visa efanayo, Ngakho-ke lawa makhadi okudlala ngeke athintwe yi-loophole yezokuphepha. Noma kunjalo, Iphutha lingasebenza kumakhadi okudlala akhishwe ngokubuka kanye nobumbano, asebenzisa umthethonqubo onjenge-visa.

Abahlaziyi babenokukhetha ukukhombisa ukuthi kungenzeka ukuthi basebenzise ithuba lokuba sengozini, Akunandaba ukuthi umjikelezo ongalindeleki ngokweqiniso. Baqale bakha isoftware ye-Android bafaka kuyo ngezingcingo ezimbili ze-NFC. Lokhu kuvunyelwe 2 amayunithi wokusebenzisa idatha kusuka ku- ikhadi lesikweletu Imininingwane ye-Chip and Commerce ngemali ekhokhwayo. Ngaphandle, Abahlaziyi babengenazo izisulu noma yiziphi izici ezithile zokuphepha ngaphakathi kohlaka lokusebenza lwe-Android ukubeka kuhlelo lokusebenza.

Ucingo lokuqala lweselula lusetshenziselwa ukuskena idatha ebaluleke kakhulu kusuka ekhadini lezindleko bese uyidlulisela kwiselula yesibili ukuthola imali engavunyelwe kusuka ekhadini lasebhange elivela eceleni. Iselula elandelayo isetshenziselwa ukudonsela inani eliphakathi ekuphumeni, Izinhlobonhlobo ezifanayo zamalini zekhadi lenza sekwephuzile. Njengoba ukusebenzisa kumemezela ukuthi iShopper ingumuntu ovunyiwe wekhadi lasebhange, Umthengisi akaboni ukuthi ukuthengiselana kuyinkohliso. Impikiswano ePivotal ukuthi uhlelo lokusebenza lukhipha uhlelo lokuphepha lweKhadibhodi. Yize isamba sesingaphezu komkhawulo futhi sidinga ukuqinisekiswa kwe-PIN, Ayikho ikhodi eceliwe.

Ukusebenzisa amakhadi abo asebhange ezintweni ezahlukahlukene ezithengiswayo, Abaphenyi babekwazile ukwethula ukuthi uhlelo lokukhwabanisa lusebenza.

Kusho iToro, "I-RIP-off isebenza ngamakhadi wedebithi kanye namabhange akhishwe ezizweni eziningana ngezimali ezahlukahlukene."

Ososayensi sebevele bake bakwazisa i-visa ekuba sengozini, ngesikhathi esifanayo siphakamisa impendulo ekhethiwe.

Ukuvakasha kuchaza, "Ukulungiswa kathathu kudinga ukwenziwa kwiphrothokholi, okungenzeka kubekwe ngaphakathi kwezikhungo zemali ekhokhwayo ngohlelo lwesoftware oluzayo. Kungabulawa kahle ngokuzikhandla okuncane. Ayikho into efana nokufuna ukushintshanisa amakhadi okudlala, Futhi konke ukulungiswa kuvumelana ne-EMV evamile. "

Isethenjwa se-Journal:

1. Basin et al. Isiko le-EMV: Ukwephula, Lungisa, Gcizelela. arxiv:2006.08249 [cs.cr] arxiv.org/abs/2006.08249