sPACE Attack: Spoofing eID’s Password Authenticated Connection Establishment(ctrlalt.medium.com) |
sPACE Attack: Spoofing eID’s Password Authenticated Connection Establishment(ctrlalt.medium.com) |
Tapping your card and entering your PIN in a compromised app/on a compromised device has the same (and to me expected) result as tapping it on a fraudster’s device directly and providing them the PIN.
The terminal used the PIN for three transactions: The original sign-in process, the attacker's ID verification process for the bank, and a "Selbstauskunft" which essentially is an echo service that returns data read from the card back to the user.
It's not a very performant process and needs to happen near real time.
So on a phone, with every layer of the communication in just software, not hardware, that is inheritly unsafe? (On e.g. Apple phones a security chip could work to increase security, but if a prompt is faked, the PIN can still be exfiltrated.)
[1]: Free RFID USB readers were given out at every local agency in germany, but those were the cheap models, without a numeric input.
What might work today is a Bluetooth-capable smartcard reader with a PIN pad and display for secure transaction confirmation ("enter your PIN to open a bank account with bank xyz" vs "enter your PIN to confirm that you own a valid driver's license for the purpose of renting a car" etc.), but even that is a stretch and will probably only ever see very low adoption.
It would be great to have it as an option supported by the official reader app, though!
The vulnerability has the CVE-ID CVE-2024–23674 and a CVSS rating of 9.7 (Critical)
A bank account has been successfully opened in the name of a victim at a major German bank.