Understanding Security APIs - CrySyS Lab

• Procedural control bypass. Procedural controls can be subtly modified to allow
key material change or discovery by one or a few of the authorised parties
in collusion. They can only be completely bypassed by targeting weak links
further up the chain. For instance, older banking HSMs use key switches
for authorisation. If there is a reissue procedure for lost keys, a requisition
form could be forged by the attacker, completely bypassing the rest of the
procedures protecting the bank’s legitimate copy.
• Key material discovery. Occasionally gross misunderstandings of the secrecy
requirements on key components are made. There are reports of key components
being stored in public correspondence files [3], instead of being destroyed
after use. An attacker could exploit a failure such as this to discover a transport
key, and unpick the rest of the system from there.
• Brute force cryptographic attacks. Older bank systems still using DES are
nowadays vulnerable to brute force key material guessing attacks. Insiders
with HSM access may be able to use techniques such as a meet-in-the-middle
attack (see section 7.2.2) to bring the key search within range of a desktop
PC. Outsiders may need to invest roughly £10000 to build equipment that
can crack DES keys in a reasonable time period.
• Falsely disputed transactions. Every bank customer has a simple strategy
available to defraud the bank – make some ATM withdrawals outside their
normal pattern of usage, and claim they are phantoms. This strategy relies
upon the legal precedent making customer reimbursement likely.
• HSM vulnerability disclosure. Discovering and disclosing vulnerabilities without
ever being in a clear position to exploit them can support goals of extortion
and blackmail.
4.2 Electronic Payment Schemes
The existing electronic payment schemes based on magstripe cards have used HSMs
for some time to protect communications links between banks, and to hold keys
which are used to verify the genuineness of a card presented to a Point of Sale
(POS) machine (using the CVV values). These contain secure microcontrollers such
as the Dallas DS5002. In large supermarkets and chain stores, HSMs may also
be used as concentrators for networks of tills handling card and PIN information.
HSMs are also an integral part of the back-end systems at banks which process these
transactions, preventing operations centre employees from exploiting their positions.
The EMV standard is currently being rolled out, which aims to replace current
magstripe technology with PIN on chip smartcards. The EMV standard is named
after the three member organisations that created it: Europay, Mastercard and
33