← Payment Systems: Magstripe, Tokenization, NFC and EMV
Level 3 · Operator120 min
Cloning, replay and downgrade attacks
Reversing transactions to understand attacks seen in the wild, and building proofs of concept for each.
Enrolment required
Module 1 of this course is free to read. The rest needs an enrolment — and so does nothing else on this site: the workbench, the APDU decoder and the whole capture corpus stay open to everyone, signed in or not.
What this module covers
- 01Three different things called cloning
- 02Cloning: copying what nothing protects
- 03The chip carries the stripe around inside it
- 04Fallback: the downgrade you perform with tape
- 05Downgrade: telling the terminal the chip is not there
- 06The same trick on the chip: the AIP
- 07Cloning a transaction, not a card
- 08Replay, and why the counter matters
- 09The PIN retry counter
- 10What actually stops each of these
- 11How to reason about a new one