1,529 research outputs found

    Chip and Skim: cloning EMV cards with the pre-play attack

    Get PDF
    EMV, also known as "Chip and PIN", is the leading system for card payments worldwide. It is used throughout Europe and much of Asia, and is starting to be introduced in North America too. Payment cards contain a chip so they can execute an authentication protocol. This protocol requires point-of-sale (POS) terminals or ATMs to generate a nonce, called the unpredictable number, for each transaction to ensure it is fresh. We have discovered two serious problems: a widespread implementation flaw and a deeper, more difficult to fix flaw with the EMV protocol itself. The first flaw is that some EMV implementers have merely used counters, timestamps or home-grown algorithms to supply this nonce. This exposes them to a "pre-play" attack which is indistinguishable from card cloning from the standpoint of the logs available to the card-issuing bank, and can be carried out even if it is impossible to clone a card physically. Card cloning is the very type of fraud that EMV was supposed to prevent. We describe how we detected the vulnerability, a survey methodology we developed to chart the scope of the weakness, evidence from ATM and terminal experiments in the field, and our implementation of proof-of-concept attacks. We found flaws in widely-used ATMs from the largest manufacturers. We can now explain at least some of the increasing number of frauds in which victims are refused refunds by banks which claim that EMV cards cannot be cloned and that a customer involved in a dispute must therefore be mistaken or complicit. The second problem was exposed by the above work. Independent of the random number quality, there is a protocol failure: the actual random number generated by the terminal can simply be replaced by one the attacker used earlier when capturing an authentication code from the card. This variant of the pre-play attack may be carried out by malware in an ATM or POS terminal, or by a man-in-the-middle between the terminal and the acquirer. We explore the design and.

    Chip and Skim: cloning EMV cards with the pre-play attack

    Get PDF
    EMV, also known as "Chip and PIN", is the leading system for card payments worldwide. It is used throughout Europe and much of Asia, and is starting to be introduced in North America too. Payment cards contain a chip so they can execute an authentication protocol. This protocol requires point-of-sale (POS) terminals or ATMs to generate a nonce, called the unpredictable number, for each transaction to ensure it is fresh. We have discovered two serious problems: a widespread implementation flaw and a deeper, more difficult to fix flaw with the EMV protocol itself. The first flaw is that some EMV implementers have merely used counters, timestamps or home-grown algorithms to supply this nonce. This exposes them to a "pre-play" attack which is indistinguishable from card cloning from the standpoint of the logs available to the card-issuing bank, and can be carried out even if it is impossible to clone a card physically. Card cloning is the very type of fraud that EMV was supposed to prevent. We describe how we detected the vulnerability, a survey methodology we developed to chart the scope of the weakness, evidence from ATM and terminal experiments in the field, and our implementation of proof-of-concept attacks. We found flaws in widely-used ATMs from the largest manufacturers. We can now explain at least some of the increasing number of frauds in which victims are refused refunds by banks which claim that EMV cards cannot be cloned and that a customer involved in a dispute must therefore be mistaken or complicit. The second problem was exposed by the above work. Independent of the random number quality, there is a protocol failure: the actual random number generated by the terminal can simply be replaced by one the attacker used earlier when capturing an authentication code from the card. This variant of the pre-play attack may be carried out by malware in an ATM or POS terminal, or by a man-in-the-middle between the terminal and the acquirer. We explore the design and.

    Crystallization at Solvent Interfaces Enables Access to a Variety of Cocrystal Polymorphs and Hydrates

    Get PDF
    A crystal growth technique, interfacial cocrystallization, is demonstrated to be a simple and effective method for preparing multicomponent crystal forms. The technique is based on the generation of a liquid–liquid interface between two immiscible solutions of cocrystal-forming compounds, and its utility is demonstrated through the preparation of polymorphs and hydrates of caffeine cocrystals, involving three different hydroxy-2-naphthoic acids, including the formation of some with unexpected compositions

    Be prepared: The EMV pre-play attack

    Get PDF
    EMV, also known as β€œChip and PIN”, is the leading system for smartcard-based payments worldwide; it is widely deployed in Europe and is starting to be introduced in the USA too. It replaces the familiar mag-strip cards with chip cards. A cryptographic protocol is executed between a chip card and bank servers based on a message authentication code (MAC) over transaction data, including a nonce called the unpredictable number. We discovered two protocol flaws: first, the lack of a terminal ID to identify involved parties, and second that the nonce is not generated by the relying party. Together, these make EMV vulnerable to the pre-play attack: pre-recorded transaction data from a target card can be replayed at a future location. This powerful attack can be exploited due to weak random number generators, by a man-in-the-middle between the terminal and the acquirer, or by malware in an ATM or POS terminal. Our investigation started when we discovered that EMV implementers often used counters, timestamps or home-grown algorithms to supply the nonce. We describe the survey methodology we developed to chart the scope of this weakness, evidence from ATM and terminal experiments in the field, and our proof-of-concept attack implementation. Finally, we explore why these flaws evaded detection until now

    Mutations in pericentrin cause Seckel syndrome with defective ATR-dependent DNA damage signaling

    Get PDF
    Large brain size is one of the defining characteristics of modern humans. Seckel syndrome (MIM 210600), a disorder of markedly reduced brain and body size, is associated with defective ATR-dependent DNA damage signaling. Only a single hypomorphic mutation of ATR has been identified in this genetically heterogeneous condition. We now report that mutations in the gene encoding pericentrin (PCNT)--resulting in the loss of pericentrin from the centrosome, where it has key functions anchoring both structural and regulatory proteins--also cause Seckel syndrome. Furthermore, we find that cells of individuals with Seckel syndrome due to mutations in PCNT (PCNT-Seckel) have defects in ATR-dependent checkpoint signaling, providing the first evidence linking a structural centrosomal protein with DNA damage signaling. These findings also suggest that other known microcephaly genes implicated in either DNA repair responses or centrosomal function may act in common developmental pathways determining human brain and body size

    Genomic hallmarks and therapeutic implications of G0 cell cycle arrest in cancer

    Get PDF
    BACKGROUND: Therapy resistance in cancer is often driven by a subpopulation of cells that are temporarily arrested in a non-proliferative G0 state, which is difficult to capture and whose mutational drivers remain largely unknown. RESULTS: We develop methodology to robustly identify this state from transcriptomic signals and characterise its prevalence and genomic constraints in solid primary tumours. We show that G0 arrest preferentially emerges in the context of more stable, less mutated genomes which maintain TP53 integrity and lack the hallmarks of DNA damage repair deficiency, while presenting increased APOBEC mutagenesis. We employ machine learning to uncover novel genomic dependencies of this process and validate the role of the centrosomal gene CEP89 as a modulator of proliferation and G0 arrest capacity. Lastly, we demonstrate that G0 arrest underlies unfavourable responses to various therapies exploiting cell cycle, kinase signalling and epigenetic mechanisms in single-cell data. CONCLUSIONS: We propose a G0 arrest transcriptional signature that is linked with therapeutic resistance and can be used to further study and clinically track this state

    Transmembrane helix dynamics of bacterial chemoreceptors supports a piston model of signalling.

    Get PDF
    Transmembrane Ξ±-helices play a key role in many receptors, transmitting a signal from one side to the other of the lipid bilayer membrane. Bacterial chemoreceptors are one of the best studied such systems, with a wealth of biophysical and mutational data indicating a key role for the TM2 helix in signalling. In particular, aromatic (Trp and Tyr) and basic (Arg) residues help to lock Ξ±-helices into a membrane. Mutants in TM2 of E. coli Tar and related chemoreceptors involving these residues implicate changes in helix location and/or orientation in signalling. We have investigated the detailed structural basis of this via high throughput coarse-grained molecular dynamics (CG-MD) of Tar TM2 and its mutants in lipid bilayers. We focus on the position (shift) and orientation (tilt, rotation) of TM2 relative to the bilayer and how these are perturbed in mutants relative to the wildtype. The simulations reveal a clear correlation between small (ca. 1.5 Γ…) shift in position of TM2 along the bilayer normal and downstream changes in signalling activity. Weaker correlations are seen with helix tilt, and little/none between signalling and helix twist. This analysis of relatively subtle changes was only possible because the high throughput simulation method allowed us to run large (nβ€Š=β€Š100) ensembles for substantial numbers of different helix sequences, amounting to ca. 2000 simulations in total. Overall, this analysis supports a swinging-piston model of transmembrane signalling by Tar and related chemoreceptors

    Clinical decision support tools: analysis of online drug information databases

    Get PDF
    BACKGROUND: Online drug information databases are used to assist in enhancing clinical decision support. However, the choice of which online database to consult, purchase or subscribe to is likely made based on subjective elements such as history of use, familiarity, or availability during professional training. The purpose of this study was to evaluate clinical decision support tools for drug information by systematically comparing the most commonly used online drug information databases. METHODS: Five commercially available and two freely available online drug information databases were evaluated according to scope (presence or absence of answer), completeness (the comprehensiveness of the answers), and ease of use. Additionally, a composite score integrating all three criteria was utilized. Fifteen weighted categories comprised of 158 questions were used to conduct the analysis. Descriptive statistics and Chi-square were used to summarize the evaluation components and make comparisons between databases. Scheffe's multiple comparison procedure was used to determine statistically different scope and completeness scores. The composite score was subjected to sensitivity analysis to investigate the effect of the choice of percentages for scope and completeness. RESULTS: The rankings for the databases from highest to lowest, based on composite scores were Clinical Pharmacology, Micromedex, Lexi-Comp Online, Facts & Comparisons 4.0, Epocrates Online Premium, RxList.com, and Epocrates Online Free. Differences in scope produced three statistical groupings with Group 1 (best) performers being: Clinical Pharmacology, Micromedex, Facts & Comparisons 4.0, Lexi-Comp Online, Group 2: Epocrates Premium and RxList.com and Group 3: Epocrates Free (p < 0.05). Completeness scores were similarly stratified. Collapsing the databases into two groups by access (subscription or free), showed the subscription databases performed better than the free databases in the measured criteria (p < 0.001). CONCLUSION: Online drug information databases, which belong to clinical decision support, vary in their ability to answer questions across a range of categories
    • …
    corecore