		<div class="wpcnt">
			<div class="wpa">
				<span class="wpa-about">Advertisements</span>
				<div class="u top_amp">
							<amp-ad width="300" height="265"
		 type="pubmine"
		 data-siteid="111265417"
		 data-section="2">
		</amp-ad>
				</div>
			</div>
		</div><p><a href="http://londonglossy.com/wp-content/uploads/2010/12/row-over-bank-card-loophole-thesis.jpg"><img class="alignnone size-full" title="A row has erupted over an academic thesis which examines an apparent loophole in chip and PIN technology" src="http://londonglossy.com/wp-content/uploads/2010/12/min-row-over-bank-card-loophole-thesis.jpg" alt="A row has erupted over an academic thesis which examines an apparent loophole in chip and PIN technology"/></a></p>
<p>A Cambridge University professor has accused the bank cards industry of making a &#8220;very nasty attempt at censorship&#8221; over a flaw in chip and PIN technology.</p>
<p>The UK Cards Association (UKCA), which represents the country&#8217;s biggest banks, wrote to the university to try to remove the online publication of research which shows how a £20 hand-held device could be used to buy goods without entering the correct PIN.</p>
<p>Ross Anderson, professor of security engineering at Cambridge University&#8217;s Computer Laboratory, said: &#8220;This was absolutely unacceptable. It was a very, very nasty attempt at censorship.&#8221;</p>
<p>Melanie Johnson, a former Labour Treasury minister who is now chair of the UKCA, wrote to the university&#8217;s director of communications earlier this month saying the publication &#8220;oversteps the boundaries of what constitutes responsible disclosure&#8221;.</p>
<p>She said the paper, The Smart Card Detective, by MPhil research student Omar Choudary, &#8220;places in the public domain a blueprint for building a device which purports to exploit a loophole in the security of chip and PIN&#8221;. She said the type of attack described was &#8220;difficult to undertake&#8221; and &#8220;unlikely to interest genuine fraudsters&#8221; but said the &#8220;level of detail&#8221; published was worrying and asked for the research to be removed and said police had expressed concern the student &#8220;was allowed to falsify a transaction in a shop in Cambridge without first warning the merchant&#8221;.</p>
<p>But Mr Anderson said exposing vulnerabilities in the system was an example of &#8220;responsible disclosure&#8221; and said the industry had been guilty of &#8220;sitting on their butts and doing nothing&#8221; since he and fellow scientists first revealed the flaw in late 2009.</p>
<p>In a response letter, he wrote: &#8220;You seem to think that we might censor a student&#8217;s thesis, which is lawful and already in the public domain, simply because a powerful interest finds it inconvenient. This shows a deep misconception of what universities are and how we work. Cambridge is the University of Erasmus, of Newton, and of Darwin; censoring writings that offend the powerful is offensive to our deepest values.&#8221;</p>
<p>He continued: &#8220;You complain that our work may undermine public confidence in the payments system. What will support public confidence in the payments system is evidence that the banks are frank and honest in admitting its weaknesses when they are exposed, and diligent in effecting the necessary remedies. Your letter shows that, instead, your member banks do their lamentable best to deprecate the work of those outside their cosy club, and indeed to censor it.&#8221;</p>
<p>Prof Anderson said he had authorised the thesis to be issued as a Computer Laboratory technical report. He said there was no basis for police concern as there was no intent to commit fraud, as the card holder gave his consent and the merchant was paid. He added that Barclays Bank did appear to have closed the technological loophole although other banks were yet to fix the problem.</p>
<p>A UKCA spokeswoman said: &#8220;The UK Cards Association has written to Cambridge not to challenge the work of the university&#8217;s security academics but only to challenge whether publishing explicit details of how to attempt a fraud &#8211; specifically one which there is no evidence of a fraudster yet undertaking &#8211; is necessary and serving the public&#8217;s best interest. We remain hopeful that the academics concerned will work with us rather than against us to help defeat the fraudsters &#8211; as unfortunately it is only the fraudsters who stand to gain from any lack of cooperation between us.&#8221;</p>
			<div style="padding-bottom:15px;" class="wordads-tag" data-slot-type="belowpost">
				<div id="atatags-dynamic-belowpost-69e33d129373d">
					<script type="text/javascript">
						window.getAdSnippetCallback = function () {
							if ( false === ( window.isWatlV1 ?? false ) ) {
								// Use Aditude scripts.
								window.tudeMappings = window.tudeMappings || [];
								window.tudeMappings.push( {
									divId: 'atatags-dynamic-belowpost-69e33d129373d',
									format: 'belowpost',
								} );
							}
						}

						if ( document.readyState === 'loading' ) {
							document.addEventListener( 'DOMContentLoaded', window.getAdSnippetCallback );
						} else {
							window.getAdSnippetCallback();
						}
					</script>
				</div>
			</div>
Discover more from London Glossy Post
Subscribe to get the latest posts sent to your email.
