DEF CON 33 - How Extra Features In Contactless Payments Break Security, What We Can Do - Tom Chotia

The speaker reveals critical vulnerabilities in contactless payment systems caused by companies adding undocumented features that compromise security 5:43.

Key Takeaways:
• European contactless payments have stricter security rules compared to the US, requiring PIN verification for transactions over $100 1:55
• The team discovered a major Visa vulnerability allowing attackers to bypass Apple Pay authentication in transit mode, enabling unauthorized payments of any amount by manipulating protocol flags 15:30
• Square's offline payment system also contained vulnerabilities where plastic cards could impersonate phones, making unauthorized high-value transactions 26:55
• The team is working with ISO to implement timing checks at the protocol level to prevent relay attacks, though standardization is challenging 31:10

The vulnerabilities highlighted demonstrate how payment companies' race to add features without proper security coordination puts consumers at risk of financial fraud.

Sources:

• 1:55 Differences between European and US payment security rules
• 5:43 New payment features introducing vulnerabilities
• 15:30 Visa transit mode attack details
• 26:55 Square offline vulnerability
• 31:10 Proposed timing solution to prevent relay attacks