Imagine walking into a store with an expired Visa card and, thanks to a clever hack, making a purchase without a hitch. This is the reality unveiled by researchers at the University of Massachusetts Amherst, who have demonstrated a method to revive expired Visa contactless cards using a technique they’ve dubbed the "Zombie Card" attack.
The Zombie Card attack exploits the way point-of-sale (POS) terminals communicate with contactless cards via near-field communication (NFC). By rewriting the expiration date that the terminal reads, attackers can trick the system into accepting a card that should have been rejected. This isn’t just a theoretical exercise; the researchers successfully executed the attack in real-world scenarios, demonstrating its feasibility and potential impact.
At the heart of this attack lies a fundamental oversight in the way card expiration is handled. The researchers found that while the card's cryptography remains intact, the POS system relies heavily on the expiration date for transaction validation. By intercepting and altering this data during the NFC communication, attackers can essentially breathe new life into expired cards. This means that the security measures intended to protect against fraud can be bypassed without breaking any cryptographic safeguards.
This incident shows a growing trend in payment security: as technology advances, so do the methods of exploitation. The reliance on expiration dates as a gatekeeper for transactions is a glaring weakness that could be addressed through more strong validation processes. As contactless payments become increasingly popular, the industry must prioritize security measures that can withstand such innovative attacks.
- Physical access to the card is required for the attack.
- The attack does not compromise the card's cryptographic security.
- POS systems need better validation beyond expiration dates.
First reported by The Hacker News.