Relaying EMV Contactless Transactions Using Off-The-Shelf Android Devices
summary
Demonstrates a working relay that uses two off-the-shelf Android devices (KitKat HCE) to forward EMV contactless NFC between card-in-pocket and a shop terminal, achieving successful payments and measured timings where optimized relays beat some direct-card transactions — for certain bank cards the relay is faster than a direct transaction. Shows practical mitigations fail: common terminals permit 52 seconds allowed by terminals, contactless limits (two × €25/day) and PIN capture remain the real constraints.
AI-written summary · about
chapters (23)
- 0:00Introduction
- 1:05What is EMV
- 3:14EMV specification complexity
- 4:41EMV contactless flow
- 7:09EMV relay attacks
- 8:56Relay attack demo
- 10:42Live relay with Android
- 12:10Relay attack history
- 13:56Host card emulation in Android
- 15:03Relay attack performance
- 17:15NFC transaction protocol
- 19:40Optimizing relay protocol
- 22:09Bypassing power delays
- 23:54Reducing cryptogram data
- 25:20Relay method comparison
- 26:23Relay setup limits
- 27:04Obtaining PIN codes
- 29:11Testing infrared PIN detection
- 32:09EMV contact security flaws
- 33:55Optimizing fraud detection
- 36:44Geolocation fraud prevention
- 37:06Conclusion
- 39:14Q&A
related talks
45mNot Just Two Bytes: Emulating Contactless Cards on Mobile Devices
40mEasy NFC Life with Host-based Card Emulation
32mWorking with NFC and smart cards
37mFirst Contact - Vulnerabilities in Contactless Payments
45mAndroid as the Basis for Implementing a Mobile Passport
34mJourney to the Heart of Contactless Payment
25mHands-On with Host Card Emulation
01h 14mMigrating a Payment Terminal from Linux to Android