Mifare, Oyster and ITSO Cards Hacked Smart Card & Identity News

In Germany, almost all banks and bank organisations have converted to modern PIN production methods.
Here the following techniques are used:
1. Thermo Sealing® - The single form is printed on special paper,
folded and thermo sealed and therewith becomes a casing ready for
dispatch, but which can also be put in envelopes. This method
means up to 60% less paper, no elaborate handling, and no
outdated technology, significantly less time, effort and waste. Data
security is provided through a perfect thermo lock which cannot be
opened without visible damage.
2. Single label – The back side of the printed paper has a special
matrix making the PIN invisible. One or more security labels can
be attached to the letter. These labels can have special security
features like void effects or holograms and can either be peel-off
labels or special scratch labels where the customer uses his
fingernail or a coin to visualize his PIN. All these labels are
designed to show attempts of manipulation. The final product
could be either in the same size of the old fashioned “Dot.Matrix”
solution or an A4 letter size which is folded.
Scratch label with
void effect Peel-off label Double label with
hologram
3. Double label – The letter is printed and the first label is applied. Then the
PIN is printed on the label. Immediately after printing the PIN the
second label is applied so that the PIN becomes invisible. This sandwich
technology has the highest security level of all processes used today.
4. Combination of Thermo Sealing® and label – In this case the PIN is
hidden by a security label and then the product is sealed. This
solution offers double protection of the PIN and is the most
widespread form of PIN protection in Germany.
A key point in using such systems is the security of the process. All described systems were supplied by Otto
Künnecke – specialists for card mailing and high security systems.
The machines use special black covers and a special security lock which does not enable the operator to open
any cover. In case of machine problems the covers can only be opened by an operator and a supervisor. The
machines can be integrated in existing HSM surroundings or could be equipped with special encryption and
decryption hard and software. When designing a PIN mailer one key point is that the file sent to the printer
encrypts, the PIN at the latest stage and that these PINs are not visible in any software, audit files or at any
device in this process.
OK offers modularly extendable systems in different security levels. Due to high demand and the excellent
cost-benefit-ratio these applications are marketed worldwide. Several banks from all parts of the world want
to follow the German example and use more modern, secure and economic PIN letters. The OK systems are
available with and without security software like HSM.
Smart Card & Identity News • January 2008
10