No abstract

No abstract

This report explains recent developments in relay attacks on contactless smartcards and secure elements. It further reveals how these relay attacks can be applied to the Google Wallet. Finally, it gives an overview of the components and results of a successful attempt to relay an EMV Mag-Stripe transaction between a Google Wallet device and an external card emulator over a wireless network. Status: FinalThis work is part of the project "4EMOBILITY" within the EU programme "Regionale Wettbewerbsfähigkeit OÖ 2007-2013 (Regio 13)" funded by the European regional development fund (ERDF) and the Province of Upper Austria (Land Oberösterreich). Applying recent secure element relay attack scenarios to the real world: Google Wallet Relay Attack The revised version gives a more detailed analysis of the Google Wallet oncard component, adds new ideas on how to improve the attack, details further information on our test setup, and adds an analysis of Google's approach to fix the vulnerability. Applying recent secure element relay attack scenarios to the real world: Google Wallet Relay Attack Michael Roland Applying recent secure element relay attack scenarios to the real world: Google Wallet Relay Attack Michael Roland 1. The card's radio frequency interface can be shielded with a Faraday cage (e.g. aluminium foil) when not in use. 2. The card could contain additional circuitry for physical activation and deactivation. 3. Additional passwords or PIN codes could be used for two-factor authentication. Applying recent secure element relay attack scenarios to the real world: Google Wallet Relay Attack Michael Roland Applying recent secure element relay attack scenarios to the real world: Google Wallet Relay Attack Michael Roland Applying recent secure element relay attack scenarios to the real world: Google Wallet Relay Attack

No abstract