Laser-printed PIN Mailer Vulnerability Report

Transcription

1 Laser-printed PIN Mailer Vulnerability Report Mike Bond, Steven J. Murdoch, and Jolyon Clulow Computer Laboratory, University of Cambridge, JJ Thomson Av., CB3 0FD, UK {Mike.Bond, Steven.Murdoch, Abstract. Tamper-evident PIN mailers are used by banks and other institutions to issue PINs and other secrets to individuals in a secure manner. Any process which can yield the PIN contained in the mailer should leave evidence of tampering. We show that PIN mailers used by at least four major UK banks are vulnerable to trivial attacks that reveal the PIN without tampering. One such scheme is the Hydalam PIN mailer. The PIN is printed using a dither pattern onto a plastic coated section of the paper, with a masking pattern on a removable tab behind the plastic. However, the toner appears as significantly darker colour than the masking pattern, and with some mailers the PIN can be read by direct inspection. Holding the mailer at an angle to a light source causes the plastic to reflect the light, whilst the toner does not, revealing the PIN clearly. Some Hydalam mailers use an etched pattern to create glare, preventing the latter technique from being used. However, this countermeasure can be defeated with the aid of a PC by scanning the mailer and performing a threshold operation to separate the toner ink from the background. All laser-printed mailers examined so far have been shown insecure. 1 Laser-printed PIN Mailers The stock used by at least three UK banks is easily identifiable to have the Hydalam brand. A fourth bank uses a stock from an as yet unconfirmed manufacturer. 1.1 Hydalam Hydalam PIN mailers [2] are designed to allow tamper-evident PIN mailers to be produced using a conventional laser printer. The special mailer stock has a plastic region that has a masking pattern printed underneath, on a removable tab. The bonding between plastic and tab is such that it is difficult to reattach the tab after removal without leaving tamper evidence the plastic acquires a milky-white characteristic after the tab is removed. An instruction box on the back of the PIN mailer advises customers how to detect tampering of their mailer.

2 The laser printer renders the PIN onto the plastic region, in black and white using a dither pattern, resulting in a series of fine dots of toner. Figure 1 shows an example of the plastic regions of untampered and tampered mailers. Fig. 1. Untampered and tampered mailers from a UK bank using Hydalam stock The Hydalam mailers we examined bore the following patent numbers: Australian Patent #686557, # U.S. Patent 6,220633, 6,231,082 and application # 09/183,116 European Patent and application # U.K. Patent Application # German Utility Model Other Manufacturers We examined stock from one UK bank that bore no identification as to the mailer design, though works in an almost identical manner to the Hydalam mailer scheme. A removable tab conceals a scratch-away coating, which once removed allows the laser-printed PIN to become visible. A sample of this stock is shown in figure 2; it closely resembles the stock described by the manufacturer Paragon [3].

3 Fig. 2. Scratch-away tab PIN mailer stock 2 Direct Inspection Attack If the dither pattern is coarse, the PIN can be read by careful, direct visual inspection, with the eye at a perpendicular angle to the mailer. Digits rendered with a fine pattern can often be read by individuals with good eyesight. We experimented with this on a number of samples: some individuals were able to make entirely correct predictions by direct inspection, others gave close matches, and some were unable. Accuracy of digit recognition is significantly improved by knowledge of the font used to render the PIN. For example, observation that a 0 digit is visibly narrower than an 8 or 9 digit can resolve the ambiguity between these digits (see figure 4 in the final section of the paper for an example of the font in question). 3 Angled Light Attack The plastic surface and toner have different reflective properties. Holding the mailer with the eye at about 10 degrees from parallel, with a light source at the same angle opposite causes the plastic to become highly reflective. The difference between the toner and plastic becomes obvious, and the PIN is easily read even by individuals with poorer eyesight. Figure 3 was taken substituting a digital camera for the human eye, and clearly shows the effect. More secure Hydalam branded mailers have fine lines etched in the plastic surface. When held at an angle, these lines are highly reflective, and defeat the angled light attack. The Hydalam patent holder claims that the correct choice of font and dither pattern is sufficient to defeat this attack [1].

4 Fig. 3. The PIN clearly visible on Hydalam PIN mailer with gloss toner 4 Image Processing Attack When the dither pattern is too fine to read the digits with accuracy by direct inspection, and the angled light attack countermeasure is used, simple image processing tools can aid a human to make PIN identification viable. The mailer we attacked had the PIN printed using a fine dither pattern, and had etching in place to defeat the angled light attack. We scanned the mailer at 1200dpi in colour and greyscale using a flatbed scanner, illuminated from the front by the scanning mechanism, and from behind using a desk lamp. We also repeated the experiment substituting a digital camera in macro mode for the scanner (a digital camera would be easier to smuggle We analysed the images using the freely available image-editing tool GIMP. We also experimented with Adobe Photoshop and Paintshop Pro. We applied a colour intensity threshold function, adjusting the threshold manually, whilst standing one to two metres away from the screen. When the threshold is set between the intense black of the toner and the dark grey of the masking pattern, the PIN becomes visible. Once we had chosen the optimal threshold, we applied a gaussian blurring filter to assist our eyes with recognition of the digits. The top image in figure 4 shows the PIN revealed using this method. When the font is unknown there can be ambiguity about some digits. However, if the PIN is used in an ATM system, for example, this ambiguity can be resolved within the typical retry limit of three attempts.

5 Fig. 4. PINs revealed using the image processing attack We believe the basic technique of image capture, then threshold then blur can be optimised and automated to recover PINs from a wide number of variants of laser-printed PIN mailers. The latter image shows a PIN revealed using an optimised method, though still working within the confines of standard functionality of image-editing packages. The image processing attack has been shown effective against all stock analysed so far, regardless of manufacturer. The Hydalam patent holder acknowledges the effectiveness of this attack with respect to their current stock, and we are working on establishing communication with other vendors. 5 Conclusions The combination of PIN mailer and printing techniques used by several major UK banks is not tamper-evident. All mailers examined so far can be defeated by trivial human inspection if the dither pattern is too coarse, or if the wrong toner is used, and by straightforward computer-aided attack in all cases examined so far. In the short term, users of laser-printed mailer stock should check that etching is used to defeat the angled light attack, and that their dither pattern is sufficiently fine to the make direct inspection attack more difficult. In the mid term, an improvement to the laser-printed technology, or an alternative PIN mailer technology should be sought. The Hydalam patent owners

6 advise that they have just completed development of a new stock which will be more resistant to the image processing attack, as it has a new construction which will minimise the colour difference between the toner and the masking pattern. We hope to analyse the new stock in due course once it becomes available. Alternatives to laser-printed technology are limited. Impact printed mailers are subject to different vulnerablities caused by the impressions made by the printing process, and the tamper-evidence of the envelope sealing. Glue-based laser-printed mailers can be unsealed and resealed with relative ease. However, substantially different forms of PIN issue systems have been proposed, for instance PIN solicitation mailers, where the threat model for mailer interception is rather different. A combination of improved tamper-evidence technology and a revision of PIN issue strategy could yield a long term solution. References 1. Joel Van Boom, Hydalam Patent Holder. Personal Communication. 2. Hydalam Mailer Technology