Cherry pick POC of emv simulation #2652
Open
+1,297
−5
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Hello,
I have here a proof of concept that allows the proxmark3 RDV4 to use the attached card reader for signing contactless transactions, turning the proxmark into a payment device (only works with Visa cards for now and I think is hardcoded for UK based payments, if anyone wants to try it out, I can fix that).
I think it is pretty interesting feature to enable because it allows you to MITM/play around with contactless flow.
I think that this is only possible due to security lapses in the way Visa differentiates between contactless and contact transactions, you are kindof tricking the card into performing this signature. I suspect that it bypasses PIN protections in certain circumstances. I can write long boring technical explanation on this later. Visa was not interested in this bug report so here we are.
I assume that there is interest in having this in the codebase - if not it would be good to know so I don't spend time cleaning the PR up! Note that this PR is messy and not in its final form (but does work every time).
If there is interest, it would be good to get some answers to these questions:
emv smart2nfc
because it doesn't 'sit' anywhere. Is this desirable?