References

Where module 7's worked example comes from: real published Terminal Action Codes, the zero floor limit, and the Terminal Type values. A rare case of a scheme showing its actual configuration rather than describing one.

The normative source for almost every byte in this course: the TVR bit meanings in Annex C5, the CVM codes and conditions in Annex C3, the cryptogram coding in Table 14, and the command definitions. Where a lesson states what a bit means, it means this.

SDA, DDA and CDA, the certificate chain, and the data elements that go into an application cryptogram. Read alongside Book 3 rather than instead of it.

Presented three weeks before this page was written. Expiry is enforced as a terminal policy check rather than a property of the card, and in the Visa configuration tested that date was not covered by the card's signature — so two phones and a relay revived an expired card at a real terminal. Read it against module 7, where the terminal writes exactly that judgement into the TVR.

The best single starting point if you are new to this field. It organises the whole literature into seven attack vectors across three areas — application selection, cardholder verification, and transaction authorisation — which is close to how this course is sequenced, and it compares Visa and Mastercard side by side.

What happens when several parties each retrofit a feature onto EMV independently — offline reader restrictions, transit modes, regional high-value rules. The attacks come from the interactions, not from any one feature, and one of them got a terminal to accept a fraudulent £25,000 payment.

The measurements behind modules 16 and 17: real Level 1 and Level 3 round-trip times, why Visa's L1SessionParameter is not distance bounding, and the L1RP proposal. The source for the sentence that corrected this course — there is no round-trip timing measurement within Visa's protocol.

A Tamarin model of EMV, and the flaws it found. Its companion result — the card brand mixup, which makes a terminal run the wrong kernel — is the step that removes mandatory CDA in the wallet attacks of module 10.

Terminals whose unpredictable number was a counter, and what that makes possible. Module 14 is built on it. It began with a disputed transaction and a bank that, unusually, produced its logs.

The man-in-the-middle that makes a terminal believe a PIN verified while telling the card no PIN was attempted. Module 6 is built on it, and its central observation — that the PIN verification step is never explicitly authenticated — is still the clearest statement of why this class of attack keeps returning.

How to build the hardware that sits between a card and a terminal, from someone who did. Around a hundred pounds of parts, and the reason several results in this course could be demonstrated at all.

Module 10. Transit mode pays from a locked phone, and flipping one byte of tag 9F27 turned the wallet's refusal into an authorisation — the Cryptogram Confusion attack.

Module 15. Six cards, five banks, and the cumulative-limit counter reset without ever knowing a PIN — while the card's own IAD said the offline PIN had not been performed.

Eleven cards, ten issuers, and the finding that four of them let a counterfeit magnetic stripe authorise a swipe. The magstripe half of module 13, and the reason module 3 is not history.

Module 13's spine, and the source of its framing: you cannot economically clone a card, but you can clone a transaction — and legacy support is what makes that true.

A device the size of a card that emulates a magnetic stripe wirelessly, by switching the polarity of a coil until a reader's head sees a swipe. Worth building, and worth reading for the service-code observation in module 3. Kamkar removed the chip-disabling function before release, and says plainly that it does not let you use cards you are not authorised to use.