PINATA: PIN Automatic Try Attack (Live)
Salvador Mendoza presents the live demonstration of PINATA, an automated hardware rig executing rapid PIN brute-force attacks on flawed EMV smart cards.
Summary
The Limits of EMV Smart Card Protections
While EMV payment cards enforce PIN Try Counters (PTC) to block brute force discovery, improper counter persistence across power resets creates critical attack vectors.
Demonstrating the PINATA Hardware Rig Live
Salvador Mendoza presents the live in-person demonstration of PINATA, an automated hardware attack rig that injects PIN attempts and cycles card power lines.
Bypassing Applet Retry Counters in Sub-Seconds
Mendoza demonstrates exhausting 4-digit PIN keyspaces on vulnerable banking applets, illustrating why cards must enforce non-volatile write updates.
Remediation for Payment Applet Developers
The author provides banking institutions and smart card manufacturers with secure non-volatile memory transaction standards.
Related talks
Main Stage·38 min
Salvador Mendoza
Salvador Mendoza introduces PINATA, a hardware attack tool executing extreme brute force attacks against flawed 4-digit PIN verification routines on EMV smart cards.
Wireless Village·33 min
Travis Goodspeed
Travis Goodspeed provides an update on the Goodwatch open-source wrist-worn RF radio hacking and packet manipulation platform.
Main Stage·43 min
Yaniv Balmas · Lior Oppenheim
Yaniv Balmas and Lior Oppenheim demonstrate reverse engineering KVM switch firmware, subverting the 8051 microcontroller to install an undetectable, persistent hardware keylogger.