Decimalisation Table Attacks for PIN Cracking
Authors: Mike Bond, Piotr Zielinski

Date: February 2003
Publication: University of Cambridge Technical Report #560
Source 1:

Abstract or Summary:
We present an attack on hardware security modules used by retail banks for the secure storage and verification of customer PINs in ATM (cash machine) infrastructures. By using adaptive decimalisation tables and guesses, the maximum amount of information is learnt about the true PIN upon each guess. It takes an average of 15 guesses to determine a four digit PIN using this technique, instead of the 5000 guesses intended. In a single 30 minute lunch-break, an attacker can thus discover approximately 7000 PINs rather than 24 with the brute force method. With a 300 withdrawal limit per card, the potential bounty is raised from 7200 to 2.1 million and a single motivated attacker could withdraw 3050 thousand of this each day. This attack thus presents a serious threat to bank security.

Do you have additional information to contribute regarding this research paper? If so, please email with the details.

<-- Back to Authentication Research Paper Index

[Home] [About Us] [News] [Research]

Copyright © 2019