Classification of Smartcard attacks

Ilhame EL FARISSI, Mostafa AZIZI and Mimoun MOUSSAOUI

Research Lab. MATSI, ESTO
Mohammed 1st University, Oujda - Morocco
{ilhame.elfarissi , mos.azizi}@gmail.com
moussaoui@est.univ-oujda.ac.ma
Abstract The classification of smartcard attacks is a
part of the learning process of different ways are used
by attackers to challenge the system security. It really
helps to enhance the smartcard security policies. In
this paper, we study some types of taxonomies but we
focus our attention upon the classification tree method
(CTM). For this case study, we apply CTM to classify
smartcard attacks by using the CTE tool.
Keywords- smartcard; attack;
taxonomy; classification

vulnerabilty;

fault;

I. INTRODUCTION:
The smart card is a plastic card with an embedded
computer chip (a processor and a memory), it is
increasingly used in different domains such as
health, social protection, communication, and
payment. So before using the smartcard or the
smartcards system, it is necessary to be sure that
the application (smartcard) responds only to
requests sent by the authorized user, ensure the
service continuity with respecting the response time
and ensure confidentiality of exchanged data. So as
in computer security, smartcard system security is
concerned by data integrity, availability of services
and confidentiality of information .The smart card
is used in different areas that are targeted by several
attackers, some ones are interested by confidential
data access, and others attack the system for
financial reasons. Their goals are not identical, but
all their attack techniques are based on the presence
of faults or vulnerabilities of the card or its system.
In order to block the attackers and resolve these
problems, we must study these attacks from
different sides, as their types, their goals, and the
system vulnerability used. In this sense, we need to
classify the attacks and their ties with
vulnerabilities. Such is the object of this paper.
The rest of this, show common smartcard flaw
characteristics and reduce the possible cases by
creation of attack classes that must contain all of
existing attacks and those that would appear later
too.
First of all and before starting the topic of attacks
classification, we must define what are the
taxonomy, vulnerability, error, faults, attacks
and then we will present some researches about

classifications, mention smartcard attacks and

finally we will classify these ones by using the
selected taxonomy.
II. DEFINITIONS:
Knowing how attackers access to the systems help
us to reinforce it, increase its security level and
reduce the risk. The attacker takes advantage of the
errors, faults, failure and vulnerability presents in
the system. Foremost, we will define these notions
to avoid any conflict of terms.
According to IEEE Standard Glossary of Software
Engineering Terminology, the following terms are
defined as:
Error is a human action that produces an
incorrect result, such as software containing
a fault ;
Fault is an incorrect step, process, or data
definition in a computer program;
Failure is the fact that a system or a
component is unable to perform its required
functions with respect to specified
performance requirements.
IFIP WG10.4 has also published definitions of
terms in this area. They define faults as the cause of
errors that may lead to failures. A system fails when
the delivered service no longer complies with the
specification.
The vulnerability of a system is considered as a
weakness that allows an unauthorized action to be
executed. Krsul [1] says that Software can be
vulnerable because of an error in its specification,
development, or configuration.
The attack is defined in [2] to be a serie of steps
taken by an attacker to achieve an unauthorized
result.
III.TAXONOMY
A. What is taxonomy?
Taxonomy is a classification scheme that partitions
a body of knowledge into disjunctive classes and
defines the relationship between these pieces.
Classification is the process of using taxonomy for
separating and ordering these pieces according to
some specific criteria.
By applying taxonomy, we try to make a
hierarchical classification of a given system. It
allows categorizing items in the objective to
simplify the identification of an object. The

978-1-61284-732-0/11/$26.00 2010 IEEE

classification must be unique; two instances of the

same object must belong to the same class, and
each member must have its unique place in the
taxonomy. Several taxonomies exist for different
domains. We are interested by those built over
computer security.
The taxonomy of intrusions is implemented to
classify the attacks, it aims to explain the cause of
the attack, to perform attack analysis, to prevent
attacks, and to provide a history and a hierarchy of
vulnerabilities that designers and providers of
applications can use to anticipate attacks and thus
eliminate them.
In the case of smartcards, there are a lot of
categories of attackers, some of them access to the
card in a precise phase of its lifecycle and others
target its software or even its hardware. So the
hackers check many ways to perform a successful
attack. Then we follow the same logic for
classifying attacks by using different criteria.
In this context, there are multiple studies that
describe the classification of attacks by specific
references that depend on the need, purpose of the
taxonomy and the application itself. For this reason,
we present below the existing classifications, we
discuss which one is suitable for our case, and we
apply it.
B. Analysis of existing taxonomies
The taxonomies that we mention here do not
concern directly the smartcards or theirs attacks, but
it is interesting to analyze them in order to decide
whether they are useful or not to the case of
smartcard attacks.
The classification of Kumar [3] is based on the
signatures of the attack, and involves four
attributes:
Existence: The fact that something existed is
sufficient to detect the intrusion attempt.
Sequence: The fact that many things happened in
strict sequence, is sufficient to specify the intrusion.
This attribute consist in two parameters: interval in
which some things happened, and its duration.
Regular expression patterns;
Other patterns: This category contains all other
intrusion signatures that cannot be represented
directly in one of the previous categories, for
example patterns that require embedded negation
and patterns that involve a generalized selection.
The taxonomy of vulnerabilities made by Bishop
(1995) [4] uses four attributes:
Nature: the nature of the flaw is described using
the Protection Analysis categories.
Time of introduction: when the vulnerability was
introduced.
Exploitation domain: what is gained through the
exploitation?

Effect domain: what can be affected by the

vulnerability?
The Howard taxonomy [5] consists in five
elements: attacker, tools, access, result, and
objective. The attacker, who is the person, tries to
have an unauthorized access to the system by using
some specific tools to get results that respond to his
objectives. Lough [6] proposed another taxonomy
called
VERDICT
(Validation
Exposure
Randomness Deallocation Improper Conditions
Taxonomy) which targeted the characteristics of
attacks. This taxonomy uses four characteristics of
attacks:
Improper validation: insufficient or incorrect
validation results in unauthorized access to
information or a system.
Improper exposure: a system or information is
improperly exposed to attack.
Improper randomness: insufficient randomness
results in exposure to attack.
Improper deallocation: information is not properly
deleted after use and thus can be vulnerable to
attack.
Hansman [7] has made several important
contributions to security taxonomies. He used four
axis; the first one is the vector which is the main
means by which the attack reaches its target.
Classification in the first dimension consists of two
options:
If the attack uses a single attack vector, then it
categorized by this vector.
Otherwise we must find the most appropriate
category, and use it.
It is very important to identify the attack vectors if
possible, because they provide the most accurate
description of an attack. For example, a virus uses
mail systems for its propagation cross the internet.
Hansman noted that if an attack vector is not
present or is too trivial, the attack can be
categorized by finding the closest category to how
the attack works. For example, if an attack runs
locally, and takes control of another process by
overflowing a buffer, then the buffer is an overflow
attack.
The second dimension covers the target(s) of the
attack. But as an attack may have multiple targets,
there may be multiple entries in this dimension. It is
important to note that targets should be specific.
The third dimension covers the vulnerabilities and
exploits that the attack uses. An attack may exploit
multiple vulnerabilities, so there may be more than
one entry in the third dimension. Entries are usually
a Common Vulnerabilities and Exposures (CVE)
entry; CVE became a standard of classification of
vulnerabilities. For this reason, it is preferable to
use it in taxonomies, but when a CVE entry does
not exist, the vulnerability is classified to be
generally as described by Howards [2]. Here, we

use Howards classification which suggests three

general types of vulnerabilities:
Vulnerability in design;
Vulnerability in implementation;
Vulnerability in configuration.
It is necessary to distinguish between the second
and third dimensions; the second dimension
categorizes what is the target, while the third
dimension categorizes what is being used to attack
the target. The fourth dimension of Hansman
informs on the effect generated by the attack, that
can be for example modification or destruction of
some system files or just an access to data without
modify it, etc. This fourth dimension consists in
five categories:
First dimension attack payload;
Corruption of information : the attacker destruct
information;
Disclosure of information;
Theft of service: the attacker uses system services
without authorization but he does not impact the use
for authorized users;
Subversion: take full control of part or the entire
target and put it under his use;
We can add other criteria of classification like time
of attack introduction, cost, damages
Knowing the vector, target, effect of attack and
vulnerability used by the attacker is significant for
classification because these attributes are sufficient
to analyze the attack and allow preventing it.
IV.SMARTCARD ATTACKS
Given the importance of their fields of use, smart
cards and their systems are very sensitive and
exposed to various threats. There are always people
/ malware trying to break their security, hoping to
gain access to confidential information, through
different type of attacks.
We will now present the attacks the most known
and used in the case of smart cards, discuss how
attackers conduct successfully attacks and classify
them according to Hansman taxonomy. For the
smartcard, there are different types of attack:
Invasive attacks;
Non-invasive attacks;
Fault attacks.
A. Invasive attacks
An invasive attack is a purely physical attack
against the smartcard chip; it destroys it or at least
leaves detectible signs. The attackers use this type
of attacks to access on-chip signals or extract data
from it.
1) Reverse engineering
In this type of attack [8], the attacker uncovers the
surface of the smartcard chip by removing gold
plate and the plastic body of the card, and using

fuming nitric acid to remove the resin used to

protect the microprocessor. Attackers are interested
in chip design in order to understand how it works.
The attacker tries to recover as much information
about the circuit to derive the algorithm used, how
they were implemented, and the system security
established, to finally try to have all or part of the
key or destroy the chip completely.
2) Probing attacks
The principle of probing attack [9] is to spy on the
electrical activity of an electronic component circuit
(cryptoprocessor) by positioning a probe
sufficiently
near
the
component.
The
implementation of this type of attack requires the
use of sophisticated equipment that allows
recovering data transmitted over a data bus and also
imposing logic values on nodes of the circuit. With
such control of environment, the attacker may be
able to deduct all or part of the secret cryptographic
circuit.
B. Non-invasive attacks
These attacks exploit covert channels of the
microprocessor by measuring a physical parameter
outside the chip during its activity [8, 10, 11].
Among these attacks, we distinguish:
1) Timing Analysis
The Timing Analysis is a non-invasive attack aimed
at the execution time of an algorithm and from
observations obtained the attacker may get results
(the data executed for example). Taking for
example a program that checks the digits of a PIN
(Personal Identification Number) one by one and
returns a negative result if one digit is wrong, using
this method, attacker can determine the number of
digits in the PIN. To resolve this problem, we can
for example implement algorithms that treat the
same operations regardless of the number of
inserted data and of the value of the used key (in the
cryptographic algorithm). As we can randomize
values, i.e., involve data or random values in the
calculation and then giving a false value of
execution time.
2) Power analysis
Power analysis is the most common form of sidechannel attack against smart cards. First, this is
measured the instantaneous power consumption of
the smartcard during treatment with an
oscilloscope, then the attacker analyzes the
differences in power consumption to finally deduce
the secrets contained in the chip (Such as the RSA
private key or PIN).
There are two types of Power analysis, the simple
Power Analysis (SPA) and Differential Power
Analysis (DPA):
a) Simple power analysis:

An attacker can attempt to determine the location of

individual functions within a command. During the
execution of DES, the attacker observes the power
consumption of a smart card. He can see for
example a pattern that repeats many times,
corresponding to the rounds that are required during
the computation of DES.
And to determine the different functions used in
each round, the attacker zooms in on a single
analysis cycle and so on.
b) Differential Power Analysis
The strategy of the DPA attack is to eliminate any
unnecessary information (measurement noise,
consumption of non-sensitive of parts of crypto
system ). DPA is based on the relationship
between the power consumption and the Hamming
weight of data being manipulated at a given point in
time. The DPA attack takes place in two stages:
data collection and data analysis: The data
collection stage consists at recovering the couples
[cryptogram - consumption] such as Data analysis;
it is a statistical analysis of measured consumption
during cryptographic calculations.
It should be noted that with this method, RSA has
broken private keys of 512 bits stored on a chip.
C. Fault attacks
After the launch of a transaction, an attacker can
interfere with the transfer channel of information,
collect the data in blocs and replace them by
another data (for example, change the mount of
transaction). So, it is necessary to crypt data before
sending it through the canal of transfer. Among this
type of attacks, we have:
1) Corruption of operations
In the case of using contactless smartcard [12], the
communication between the card and the card
reader can be interrupted any time and without
reason (for example, by moving the card or the card
reader). Therefore, auxiliary mechanisms must be
implemented and a feedback should always be
possible.
2) Denial of service
By this type of attack [13], the attacker can debit
the monetary units of the chip, or destruct the
smartcard by using inadequate electromagnetic
waves. So, this can block an authorized user to
access to the services that he has already paid.
3) Electric attack
It is an attack [13] based on the variation of the card
power. The goal is to introduce a fault without
affecting the physical integrity of the card.
4) Attack by high-frequency clock
It is based on the disruption of the clock speed that
is easily applied to the chips do not have PLL
(Phase-Locked Loop). Then, some instructions can
be affected and others not, consequently this can

provide the early execution of some instructions

and then they can use old data instead of expected
one.
5) Optic attack
By focusing light at a specific wavelength, it is
possible to reverse the contents of a memory cell.
This technique is used by attackers to modify the
contents of memory.
6) Electromagnetic attack
By creating a strong electromagnetic field near the
memory, the ions will move and therefore will lead
to its disruption
V.CLASSIFICATION CASE STUDY
Because there are many attacks that target the
smartcard and to reduce cases related to these ones,
the classification seems an appropriate solution.
Since a lot of taxonomies exist, we must choose one
that is the most relevant and meaningful in our case
and allows better classifying smartcard attacks and
then detect, eliminate and avoid them easily.
A. Selection of the taxonomy:
Beginning with Kumar's taxonomy presented
above, this taxonomy is based primarily on the
existence of the attack which is not a strong
criterion in our case. While Howard targets in his
classification the goal of the attacker. But in our
study, whatever the attacker or his goal the main
thing is to study smartcard security and reinforce it.
This is why these first two taxonomies were quickly
abandoned. The taxonomy of Hansman includes the
criteria proposed by Bishop (presented above), and
it surrounds the attack especially in terms of
vulnerability of the smartcard in which the attacker
took advantage for a successful attack. Thus,
enhancing the security by eliminating the
vulnerability will make difficult the intrusion for
the attacker even if he will use same vectors.
B. Classification of attacks:
Now, we will classify each smartcard attack
described in the previous chapter by using the
taxonomy of Hansman. Depending on the definition
and the function of the attack, we extract classes of
the five dimensions corresponding to each one. The
aim of Reverse Engineering is to find the chip
weakness by observing it under a microscope. The
attacker takes advantage of chip implementation in
the card. The attacker uses probing attacks to have
information like the key used in cryptographic
algorithm by attacking the circuit and taking
advantage of chip conception/implementation.
Timing and Power Analysis uses a physical
parameter to have information such as number of
digits used in the password. The vulnerability used
is in the conception/implementation of the
smartcard. The effect of Corruption operations is

Figure 1: Classification of Smartcard attacks using Hansmans Taxonomy

corruption of information by breaking the link

between the card and the reader. Denial of service,
Electric Attack, Attack by high frequency clock
and optic attack use different type of waves to
attack the network and the file system of smartcards
to corrupt the information and then theft the service
by making use of conception/implementation
vulnerability
Figure1 above illustrates the classification of these
attacks.
VI.CONCLUSION
Smart cards are often used in many industrial
systems in order to provide security functionality.
As there are many different types of smart cards,
with different capabilities, there are also many
different types of attack strategies. In this paper, we
highlight the importance of smart card technology
in providing security services, and also how to
protect them by studying the different types of
attacks. From the classification made, it is clear that
the vulnerability is especially in conception and
implementation parts. As perspective, we plan to
continue our research in this area in order to learn
more about new smartcard attacks and enhance
security policies.
REFERENCES
[1]
[2]
[3]

I.V.Krsul,Software Vulnerability Analysis, Purdue

University, 1998.
J.D.Howard, T.A.Longstaff, A Common Language for
Computer Security Incidents, SAND98-8667,1998.
S.Kumar, "Classification and Detection of Computer
Intrusions", Purdue University, 1995.

[4]
[5]
[6]

[7]
[8]
[9]

[10]

[11]

[12]
[13]

M.Bishop , D.Bailey, A Critical Analysis of Vulnerability

Taxonomies, CSE-96-11, 1996.
J.D.Howard, "An Analysis of Security Incidents on The
Internet",Carnegie Mellon University, 1997.
DL. Lough,A taxonomy of computer attacks with
applications to wireless networks , Virginia Polytechnic
Institute and State University, 2001.
S.Hansman, R.Hunt, A taxonomy of network and
computer attacks, Computers & Security, 2004, pp. 2-13.
X.Leng, Smart card applications and security,
information security technical report 14, 2009, pp. 3645
A.Razafindraibe, Analysis and improvement of the dual
rail logic circuit design secure , Montpellier university, p
14, 2006.
K.Makantonakis, M. Tunstall, G. Hancke, I.Askoxylakisc,
K. Mayes, Attacking smart card systems: Theory and
practice, inforation security technical report 14, 2009, pp.
4656
K.Mayes, K.Makantonakis, Smartcard, Tokens, security
and applications , Springer , ISBN-13: 978-0-387-721972, e-ISBN-13: 978-0-387-72198-9, 2008, pp. 208-211.
H. Handschuh, Contactless Technology Security Issues,
volume 9, Gemplus , 2004.
A.A.K.Sr, J.Iguchi-Cartigny, J.L.Lanet, " Automatic
detection of fault attack and countermeasures ", Proceeding
WESS '09 Proceedings of the 4th Workshop on Embedded
Systems Security, ACM New York, NY, USA 2009.