4.6 Social Engineering
All changes in this version
Title changed
Before · SP 800-116
Social Engineering
After · SP 800-116 Rev. 1
Social Engineering
Control changed
Before · SP 800-116
If an attacker persuaded the cardholder to give them possession of the PIV Card, the attacker could quickly insert the card into a contact reader and copy all of the information available as free-read (the CHUID, the security object, the Card Capability Container, and the certificates) over the contact interface. An attacker could also attempt a remote attack similar to well-known phishing attacks by creating a web page that asks the subject to “insert their PIV Card and enter their PIN” for an apparently legitimate purpose. If the cardholder complies, under some assumptions the attacker could capture the cardholder’s PIN and all of the readable PIV data objects, including the CHUID. The PIV Card mitigates the risk of social engineering attacks by blocking the release of all private and secret keys, and by requiring two-factor authentication (PIV Card and PIN) to perform cryptographic operations with the PIV Authentication Key. Moreover, the PIV Card is blocked upon exceeding the allocated number of bad PIN tries. Additional technical and procedural controls may be needed to counter PIV phishing.
4 CHUID is one of the data elements of PIV credentials that uniquely identifies the PIV cardholder. CHUID stands for Cardholder Unique Identifier. See the latest version of NIST SP 800-73 for a complete definition.
After · SP 800-116 Rev. 1
If an attacker persuaded the cardholder to give them possession of the PIV Card, the attacker could quickly insert the card into a contact reader and copy all of the information available as free-read (the CHUID, the security object, the Card Capability Container, and the certificates) over the contact interface. An attacker could also attempt a remote attack similar to well-known phishing attacks by creating a web page that asks the subject to “insert their PIV Card and enter their PIN” for an apparently legitimate purpose. If the cardholder complies, under some assumptions the attacker could capture the cardholder’s PIN and all of the readable PIV data objects, including the CHUID. The PIV Card mitigates the risk of social engineering attacks by blocking the release of all private and secret keys, and by requiring two-factor authentication (PIV Card and PIN) to perform cryptographic operations with the PIV Authentication Key. Moreover, the PIV Card is blocked upon exceeding the allocated number of bad PIN tries. Additional technical and procedural controls may be needed to counter PIV phishing.
4 CHUID is one of the data elements of PIV credentials that uniquely identifies the PIV cardholder. CHUID stands for Cardholder Unique Identifier. See the latest version of NIST SP 800-73 for a complete definition.