可以克隆EMV
我看到很多视频显示了带有克隆EMV卡（如Code 201）等ATM的提款，所以 当卡使用dda（动态键）的另一个问题时，如何才能克隆卡片，因为它未加密，甚至是EMV芯片
I see a lot of videos showing withdrawals from ATMs with cloned EMV cards like code 201 so
how can be possible when a card uses DDA (dynamic keys) another question is cloned card just for magstripe because it is unencrypted or even EMV chip
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
这个问题并非真正属于这个问题，并且由于您要问的内容的性质，您可能不会收到详细的答案。我仍然会尝试的。
首先，ATM是仅在线设备，它们不需要任何形式的离线数据身份验证，因此DDA与正常情况无关（像往常一样，此规则有例外）。
尽管如此，仍然有动态键，旨在提供安全性。标准对称键算法用于生成在线加密图，并由发行人验证。对称键是每个特定卡的个体，并且不容易提取（当然，没有什么可以将其视为100％安全的，但是需要复杂的硬件攻击才能从一张卡中提取钥匙）。
我认为您关于服务代码2XX，5XX或6XX的问题主要围绕MagStripe数据旋转，而无需使用芯片数据。在某些情况下（即静音时）可能会发生磁带交易的后备。通常，无人看管的设备应该阻止此选项并拒绝这种尝试，但我不会敢打赌，世界上没有这样的设备。您还需要考虑仍然有一些不符合EMV的设备。
当涉及MagStripe数据时，尽管应检测到该修改，但可以轻松修改它们（例如更改服务代码）。在magstripe上使用EMV轨道等效数据也是如此。在这两种情况下，发行人都能够通过使用CVC/CVV来检测数据的修改或在不同界面上使用它，而CVC/CVV则在轨道上编码并创建以在轨道上保护轨道数据的完整性。但是，这需要在发行人方面进行适当的实施，以检测和拒绝此类尝试，而从CVV或密码图不正确的加密数据。
It is a question that does not really belong to SO and due to the nature of what you are asking about, you may not receive a detailed answer. I will still try.
First of all, ATMs are online-only devices that do not need any form of Offline Data Authentication so DDA has little to do with them normally (there are exceptions from this rule, as usual).
There are still dynamic keys that are meant to provide security, nevertheless. A standard symmetric-key algorithm is used to generate online cryptogram and it is validated by the issuer. Symmetric keys are individual to each specific card and are not easily extracted (of course, nothing can be ever treated as 100% secure, but it would require a complex hardware attack to extract keys from a single card).
I assume your question about Service code 2xx, 5xx or 6xx is mostly revolving around magstripe data with no chip data available. In some situations (i.e. when card is mute) a fallback to magstripe transaction may happen. Normally, unattended devices should have this option blocked and decline such attempts but I would not bet there are no such devices around the world. You also need to consider that there are still devices that are not EMV-capable.
When it comes to magstripe data, they can be easily modified (for instance changing the service code) although such modification should be detectable. Same goes for using EMV track equivalent data on magstripe. In both cases, issuer is capable of detecting modification of the data or using it on different interface through the use of CVC/CVV which is encoded on a track and is created to cryptographically protect integrity of the track data. However, this requires to have proper implementation on the issuer side to detect and decline such attempts where cryptographic data from CVV or cryptogram are incorrect.
有人告诉我，提取ATM的芯片信息。我在佛罗伦萨的ATM上提取了一次，ATM进行了四次尝试，同时在ATM 13分钟外进行了一次撤军。该技术一定已经提前了。
I am being told that an atm withdrawal had my exact chip information. I made a withdrawal at an atm in Florence , the atm took four tries, and at the same time another withdrawal was being made at atm 13 minutes away. The technology must have advanced.