- In NFC, there's an element called the secure element
and it's basically a secure microprocessor
or a smart card chip that includes a cryptographic processor
to facilitate the transaction authentication and security
of those NFC transactions.
It also provides secure memory
for storing payment applications
and can also support other types of secure transactions
such as transit payment and ticketing,
building access or secure identification.
There's another entity called the acquirer
and the acquirer is responsible
for handling financial acquisitions in payment systems.
That is, it facilitates the placement of the terminals
at the retail locations
and the communications of payment transactions
to the payment networks for authorization and settlements.
So to support NFC transactions the acquirer terminals,
the merchant customer location
they need to support NFC contactless transactions.
Of course, you also have the actual payment network
that facilitates the authorization processing
and the settlement of bank card transactions.
And of course, in the back end
you have the actual bank that holds the funding account
for the consumer payment.
Here I'm showing the high level architecture
of the NFC payment scheme for your reference.
In NFC, you have different tags and to be exact
there are four different tag types.
Often a URL is embedded in an NFC tag
and neurals take up only a small amount of memory
which actually lowers the production cost of the NFC tags.
And these tags can hold nearly any type of information
depending on the memory that those tags have.
So the more memory, the more expensive those tags can be.
Let's review the actual NFC tag types.
So type one, they have a collision protection
and can be set to either read or rewrite
or also read only mode.
So read only programming prevents the information
from being changed or altered.
Then you also have type two,
which also have data collisions protection
and also they can be re-writable or read only.
And they start at 48 bytes of memory,
which is half of the bytes that the type one tags
can hold,
but can expand to be as large as type one tags as well.
So again, little bit less memory,
but the same functionality.
Now, you also have type three tags,
which are also equipped with data collision and protections
and have a larger memory footprint.
And they also have faster speeds than tag types one and two.
Then lastly you have type four NFC tags
that can actually use either NFC-A or NFC-B communication
and have data collision protection as well.
And the tag is actually set to either be re-writeable
or read only whenever they are manufactured
and the setting can not be changed by the user.
So unlike the other NFC tags
which can be altered at a later date,
these ones at the moment that they're manufactured
they're actually set either to read only
or to be re-writable.
Now, these type four NFC tags
can hold 32 kilobytes of memory.
And they're way faster than all the other previous tags.
Now going back to NFC payments
or any other NFC transaction attacks,
there are several possible security attacks against NFC.
So this includes eavesdropping, data corruption
or modification, interception attacks
and also physical thefts.
Now eavesdropping is one of the most common concerns
in NFC technology.
So it occurs whenever a third party intercepts a signal
between the two devices.
And if that third party intercepted a data transmission
between let's say a smartphone or credit card reader
then they can have access to that personal card information
if they're not encrypted properly.
They may also pick up on other personal information
passed between the two smartphones
or the two devices as well.
So there are two methods that can prevent eavesdropping.
So one is to maintain the range of the NFC itself
at a very close proximity.
And another way is to establish a secure channel.
When the secure channel is established,
the information is encrypted
and only authorized devices can decode it.
Now, another security concern
is data manipulation or corruption.
And this happens whenever the attacker or the third party
intercepts the signal that is being sent
between the two devices and it changes it
and then sends that information back to the victim.
An intersection attack
is actually similar to data manipulation
and an attacker can act as a middleman
between two NFC devices
and then receive and alter the information
as it passes between them.
And this type of attack is very difficult and less common.
Now to prevent it, the device should be
in active/passive pairing.
This means that only one device receives information
and the other one sends the information
instead of both devices receiving and passing information
simultaneously.
Let's actually take a look at a case study
of an NFC relay attack
that was documented by an anonymous author
in a white paper that I uploaded to our GitHub repository.
In that paper, the author shows how to perform
these relay attacks using Android devices.
They prove the feasibility
of using off the shelf NFC enabled Android devices
with no custom firmware
or even without requiring you to route the device.
So I posted the details of that research
in the GitHub repository
that we have for the course for your reference.