Cloning Real-World Payment Tokens

Daniel Bailey
RSA Laboratories

ABSTRACT:
Credit card issuers now routinely hand out key fob-sized electronic payment tokens to their customers. Rather than swiping a credit card, the customer merely needs to wave the token near a reader to complete a transaction. To thwart eavesdroppers, issuers routinely use cryptography. But in this talk we show that not all cryptography is created equal. By analyzing a payment token's output using off-the-shelf equipment, we were able to determine the secret 40-bit algorithm being used. Once we knew the details of this algorithm, we could make a working copy of any token in a matter of minutes.