PCSC/CCID interface for the Smart Card Detective (low-level programming)

As part of my MPhil project in 2009/2019 I made an EMV interceptor device, called the Smart Card Detective (see details here). This device is based on an ATMEL AVR 8-bit microcontroller (AT90USB1287) and can be used to intercept communications between a smartcard and a terminal (a typical Chip and PIN transaction). With this device I have been able to show a protection against relay attacks, as demonstrated by Drimer et al. (paper here), prove in a real environment the NO PIN vulnerability discovered by Steven Murdoch and perform some other experiments.

One of the things that would make this device more useful is to implement the PCSC standard to access the Smart Card Detective (SCD) using existing drivers and applications. Since the micro-controller used for the SCD has a USB controller, it would be even better to implement the CCID device driver.

In order to make yourself an idea of the code that you will have to write, I recommend looking at the Google Code repository for the SCD. In particular have a look at the current USB communication implementation available under lufa_usb_virtual_serial/. However that is very hand crafted and I did my own protocol to send commands between a computer and the SCD (see the tools/pytools folder).

I think LUFA should provide enough base code to get this through, see here.

There is some open source work for CCID, here and here.

You should also become familiar with the AVR architecture, as the SCD uses an AVR (at90usb1287). The specs for this microcontroller are here. This is an excellent resource for AVRs.

I believe that building the CCID device driver for AVRs will not only be useful for the SCD but you will contribute a great piece in the overall LUFA project and AVR code base. Also Dean Camera (LUFA's developer) might be happy to include your driver with LUFA.

As verification of success, I would try to create a simple EMV terminal application (I can send you a few scripts on this) that uses perhaps the pyscard or/and pcsclite.

The EMV specs describing commands and responses between a reader and a card that implements a payment application (you don't need to know these for the project but may be useful to skim through) are here.

If all of the above are still not enough, I would encourage you to find possible extensions in the standard, or commands which are not used for the EMV protocol in order to perform additional tasks with the SCD (e.g. talk to a terminal or display text on the LCD - since the SCD is more than just a smart card reader).

And of course during the work on this project I will give you one SCD to test your work.


Wireless EMV interceptor (hardware and RF experience required)

As part of my MPhil project in 2009/2019 I made an EMV interceptor device, called the Smart Card Detective (see details here). This device is based on an ATMEL AVR 8-bit microcontroller (AT90USB1287) and can be used to intercept communications between a smartcard and a terminal (a typical Chip and PIN transaction). With this device I have been able to show a protection against relay attacks, as demonstrated by Drimer et al. (paper here), prove in a real environment the NO PIN vulnerability discovered by Steven Murdoch and perform some other experiments.

One of the things that would make this device much more interesting is to have a wireless card that is inserted in the terminal and which communicates with the SCD. Having such a card would eliminate the very unconfortable wire between the SCD and the ID-1 card. It will also allow a wider use of the SCD as it would be much easier to use.

This project will involve some hardware development, as you will need to find a suitable RF chip (there are some available) and integrate it within an ID-1 form factor card. You will also need to modify the existing hardware in the SCD in order to communicate wirelessly with the card side and. Also you will need to think about the timing constraints impossed by the ISO-7816 protocl that is used by EMV (see specs here).