The document discusses UL's advancements in transaction security through innovative techniques and testing methodologies to counteract emerging risks posed by hackers. It highlights efforts in mobile payments, smart card technologies, and the development of tools like the brand test tool, smartwave box, and tsm test suite to ensure security and interoperability across payment systems. UL collaborates with various financial institutions and stakeholders to promote effective countermeasures and facilitate the adoption of new technologies globally.

1. NEW SCIENCE
Transaction Security
JOURNAL
ul.com/newscience

2. NEW CHALLENGES
CALL FOR NEW SCIENCE
Progress is an unstoppable, transformative force. New technologies,
product advances and globalization are arriving one on top of another
at a dizzying pace. Innovation makes us more efficient, more productive
and more connected. But there is a cost, and that cost is risk. To help
mitigate the emerging risks, UL is developing New Science. Through
fundamental discovery, testing methodologies and equipment,
procedures, software and standards, UL is creating new and important
ways to make the world safer.

3. Transaction Security
OVERVIEW
UL Transaction Security is advancing into new and important areas to
better enable safe, efficient and seamless delivery. For mobile payments
and chip and PIN technologies, UL is innovating new techniques and
tests to provide greater reliability, security and interoperability. We also
continuously develop aggressive attack approaches, utilizing advanced
statistical analyses on cryptographic algorithms. Understanding
how to get past a system’s security allows us to identify effective
countermeasures and to stay ahead of the hackers. UL is also part of the
Biometric Alliance Initiative, helping define regulatory and proprietary
compliance requirements and producing test specifications to facilitate
complete user acceptance of this technology in the fields of wireless
communication, payment applications and security.
TRANSACTION SECURITY JOURNAL 3

4. Vulnerability analysis
BRAND test tool
smartwave box
tsm test suite

5. context
The direct costs associated with global consumer hacking are calculated at $110 billion
over the past 12 months.1 It is a massive issue for the individuals targeted as well as for
financial institutions and governments. Advanced smart cards that use chip and PIN
technology are not immune to the predations of hackers. Maintaining the cryptographic
security of the smart credit and debit cards that carry this technology is critical to
protecting individuals and to promoting the adoption of more advanced mobile
payment technologies. The UL Security Lab is focused on staying one step ahead of
hackers in order to help protect the security of transactions.
What did UL do?
UL uses advanced simulation to test chip security on credit cards by subjecting chips to
multiple types of attacks. Specifically, we examine whether the cryptographic algorithm
implementations achieve a high standard of security. This requires us to continually
monitor the latest scientific advances in the field of cryptographic security and stay
on top of the most recent attack techniques and the corresponding countermeasures.
We do this to assess the cryptographic algorithms executed on smart cards and secure
devices. UL researchers and scientists use observation techniques from the collection
of physical signals during the cryptography execution or innovative fault-induction
attacks. The aim is to malevolently extract the confidential information from the secure
device or to compromise the defenses of the secure application.
The UL Security Lab is focused on
staying one step ahead of hackers in
order to help protect the security of
payment and other technologies.
TRANSACTION SECURITY JOURNAL / VULNERABILITY ANALYSIS 5

6. To effectively attack sensitive application security, it is necessary to take into
consideration the fact that the code is hardware-processed. Some attacks have been
developed to take advantage of the physical aspect of the hardware processing,
defeating the apparent robustness of specifications or designs. To investigate potential
attacks, we employ two primary methods:
• Observation analyses can use hardware to understand internal processing and
potentially modify code execution, and it can result in the disclosure of confidential
data through analysis of inevitable hardware leakages.
• Fault-injection attacks take advantage of errors induced during a code execution
in order to reveal secrets or to change the device behavior to mitigate the security.
For these attacks, the most advanced techniques are being used to stress the
robustness of a secure code. Innovative techniques such as laser systems can be
used to stress a secure chip with the highest level of accuracy and power.
Every day, UL develops new ways to attack and defeat security. We use these techniques
on smart cards, terminals and mobile phones. Hackers will continue to find ways to
breach security. Our work is to get there first so we can help financial institutions
develop effective countermeasures.
IMPACT
UL is working with most of the large banks, credit card companies and standards
agencies, and is playing an important role in facilitating the adoption of chip and PIN
technology in the U.S. and in advanced mobile technologies globally.
Hackers will continue to find ways
to breach security. Our work is to get there
first so we can help financial institutions
develop effective countermeasures.
TRANSACTION SECURITY JOURNAL / VULNERABILITY ANALYSIS 6

7. Vulnerability analysis
Brand test tool
smartwave box
tsm test suite

8. context
Consumers expect their credit or debit cards to work wherever they are and whenever
they need them: in stores and restaurants at the point of sale, at ATMs and online. UL
researchers recently developed an innovative Brand Test Tool to make it easier and more
efficient for financial organizations to provide trouble-free transactions within their
entire payment infrastructures.
What did ul do?
UL developed a unique testing device that enables terminal acquirers and vendors
to validate the payment brand testing of their Europay, MasterCard, Visa terminals
at a POS or an ATM. Brand testing is a vital component of the overall certification
process. Its core purpose is to validate payment brand compliancy of EMV terminals.
These brands include associations such as Visa, MasterCard and American Express, as
well as domestic scheme operators such as Interac in Canada and Hipercard in Brazil.
The Brand Test Tool automates the required tests, enabling a shorter time to market
and allowing a user to determine that a terminal is EMV-compliant and payment With the proliferation of credit
association-certified.2 and debit cards as well as
POS/ATM devices around the world,
interoperability is a significant
Why It Matters
and growing requirement.
With the proliferation of credit and debit cards as well as POS/ATM devices around
the world, interoperability is a significant and growing requirement. If interoperability
is not reliable, there is a risk that the customer’s card will not be accepted, which will
impact both customer satisfaction and loyalty.
IMpact
The Brand Test Tool enables a terminal to be tested within the environment of use and
within the brand settings that will be used in the field. More important, the Brand Test
Tool can detect interoperability issues before new terminals are released in the field.
This creates greater efficiencies, minimizes system errors, saves money in the long term
and delivers a more reliable process when the terminals go live.3
TRANSACTION SECURITY JOURNAL / BRAND TEST TOOL 8

9. Vulnerability analysiS
BRAND test tool
smartwave box
tsm test suite

10. context
Contactless smart chip technology is rapidly coming into use globally in a wide range
of applications. This includes delivering fast, secure transactions with credit and
debit cards as well as transit fare payment cards. It encompasses protecting personal
information on government and corporate identification cards, electronic passports and
visas. Contactless smart chip technology improves speed, convenience and security but
is a highly complex technology, particularly regarding implementation. Testing is crucial
to show that contactless smart cards, e-identification documents and terminals/readers
work correctly and reliably.
What did ul do?
UL researchers in Europe recently developed an innovative hardware device that
functions as a complete testing tool. The SmartWave Box reads and simulates
contactless smart cards and e-identification documents. The Box also analyzes the
communication between a contactless card and a terminal or reader.
09
93
05 9
With its various modes of operation, the SmartWave Box is the most versatile tool 40
50 05930
04 44050
03 0 09
0593
available today for contactless testing. The Box can operate in active, passive or 22
23 303
00 0202303 04
00
4050
10 0 2
001 10
0
intercept mode in order to allow stakeholders to spy on and analyze the communication
between a smart card and a terminal. The Box can also simulate all the interactions
across the relevant infrastructure players. In both cases, the SmartWave Box identifies
interoperability and security issues prior to system implementation.4
The SmartWave Box reads and
simulates contactless smart cards
Why It Matters
and e-identification documents.
Contactless technology has the ability to revolutionize payments and identification,
but the technology and its supporting infrastructure are complex. There are numerous
stakeholders with differing needs and capabilities. With its innovative SmartWave Box,
UL makes implementation smarter, more efficient and easier.
IMpact
The SmartWave Box is an easy-to-use tool that facilitates interoperability across
a contactless infrastructure and reduces implementation costs by providing error
detection during system development. In so doing, the SmartWave Box is paving the
way for a migration to contactless technologies.
TRANSACTION SECURITY JOURNAL / SMARTWAVE BOX 10

11. Vulnerability analysis
Brand test tool
smartwave box
tsm test suite

12. context
With the advent of mobile payments, consumers are using smart phones as virtual
payment cards. It is imperative that interoperability and security be certified to link all
the stakeholders that must cooperate as part of a near field communication ecosystem
for mobile payments to work.
What did ul do?
UL developed first-of-its-kind research to simulate all the stakeholders in an NFC
ecosystem so interoperability and security can be validated in advance of system
rollout. The TSM Test Suite covers complete functional groups and checks compliance
with GlobalPlatform Messaging Specifications and GP Card Specifications.
The use of the Test Suite’s innovative built-in simulators allows dependencies to be
solved during development. This innovation reduces time-to-market in the complex
NFC/TSM infrastructure.5
38%
35 MILLION
OF SMART PHONE USERS HAVE
NFC ENABLED SMART PHONES
PURCHASED SOMETHING
USING THEIR PHONE
7
SHIPPED IN 2011 6
Why It Matters
Mobile payments are the wave of the future, a natural extension of smart phone usage.
But setting up systems to promote interoperability and security across the NFC
ecosystem is complex and could hinder the growth and acceptance of mobile payments.
IMpact
The TSM Test Suite is a state-of-the-art tool that assists key audiences in the NFC
ecosystem to determine the suitability of their mobile payments implementation by
providing validation as well as simulation. For companies interested in participating
in mobile payments, the Test Suite helps them determine that their infrastructure can
connect to a TSM in a straightforward manner.
TRANSACTION SECURITY JOURNAL / TSM TEST SUITE 12

13. sources
1 “2012 Norton Study: Consumer Cybercrime Estimated at $110 Billion Annually,” Press Release, 5 Sept. 2012,
Web: 12 Oct.2012. http://www.symantec.com/about/news/release/article.jsp?prid=20120905_02.
2 “Collis Brand Test Tool,” Collis Sell Sheet.
3 “Collis Brand Test Tool,” Collis Sell Sheet.
4 “Collis SmartWave Box,” Collis Sell Sheet.
5 “Collis TSM Test Suite,” Collis Sell Sheet.
6 “The growth of mobile commerce: infographic,”Econsultancy, 4 Apr. 2012, Web: 12 Oct. 2012. http://
econsultancy.com/us/blog/9527-the-growth-of-mobile-commerce-infographic.
7 “Will m-commerce overtake e-commerce?” Bigcommerce, n.d., 12 Oct. 2012. http://www.bigcommerce.
com/infographics/will-m-commerce-overtake-e-commerce/.
TRANSACTION SECURITY JOURNAL / SOURCES 13

14. NEW CHALLENGES. NEW RISKS. NEW SCIENCE.
WANT TO LEARN MORE? Download THE OTHER JOURNALS
IN OUR NEW SCIENCE SERIES at UL.com/newscience
NEWSCIENCE@UL.COM
+1 847.664.2040
New Science Transaction Security cannot be copied, reproduced,
distributed or displayed without UL’s express written permission. V.18.
UL and the UL logo are trademarks of UL, LLC © 2012