Citibank gags crypto researchers
The High Court in London has imposed an injunction on Cambridge University security experts who claim to have uncovered serious failings in the system banks use to secure ATM PIN codes.
The gagging order, preventing public disclosure of cryptographic vulnerabilities, was made at the request of CitiBank and Diners' Club against experts due to testify in a 'phantom withdrawal' case to be heard in the South African High Court next month.
South African couple Anil and Vanita Singh say that £50,000 withdrawn through the Diners' Club account through British ATMs in March 2000 was never made by them. Diners Club say that its systems are secure, so the money must have been withdrawn by the Singhs.
The Singhs' solicitors have drafted in noted encryption expert Ross Anderson, of Cambridge University, along with his PhD students Mike Bond and Richard Clayton, to act as defence witnesses in the case.
In working on the case, Mike Bond discovered potentially serious vulnerabilities in the equipment used to protect PINs.
[ Read more ]