As it stands, the only way to fix this is to exchange or repair all devices in circulation.
Your spot on about the fix, though I bet you that come christmas, you could still go into a shop and see these exact models in use. That would be truely criminal, but we shall see. Though who audits/controls these things as if it was a car and a safty flaw or any consumer product then you know it would be forcebly recalled right away. Flaw in food packaging even gets recalled instantly, yet I'm not aware of any such conrols that could get this device pulled until fit for human consumption/use.
That all said I sadly feel the only way it will get changed is by active expliotation and insurance companies rasing the premiums of those poor shops using such a device.
I hope the right thing is done, but why do I have little faith in it being addressed in a timely manor, maybe historicaly alot of flaws of such types of devices are usualy patched by the manufacturer by using the denial patch, they deny its an issue and then magicly version two fix's it down the line.
Shame you can't flag a article with a revisit reminder so in 6 months time we can see how things have changed or not.
http://www.cl.cam.ac.uk/~sjm217/papers/oakland10chipbroken.p...
Ultimately, stolen credit card numbers just aren't that monetizable (they're sold for pennies on the dollar, $2-$3 per) and not enough people use their pin numbers at POS terminals. It seems more fraudsters steal using Scareware/rogue AV (its less likely to be charged back, since the victim actively entered their details).
Well-funded organized crime seems more interested in targeting bank logins, or Medicare (losses in the billions, mixed with bonafide doctor-fraud), or maybe home loans and other forms of ID theft.
From the first hit for 'credit card fraud' on google (the wikipedia page):
'The cost of card fraud in 2006 were 7 cents per 100 dollars worth of transactions (7 basis points).[2] Due to the high volume of transactions this translates to billions of dollars. In 2006, fraud in the United Kingdom alone was estimated at £535 million,[3] or US$750–830 million at prevailing 2006 exchange rates.[4]'
You can say what you like (the page does note that the incidence of fraud as compared to other types of fraud has gone down), but credit card fraud is extremely destructive and is here to stay for quite a while. Dealing with it is not cheap, or easy, or fast.
Credit card fraud is also an enormous threat to merchants due to the fact that chargebacks result in large fees and, eventually, merchant account termination. Merchants have to compensate by being extremely zealous about fraud and actively filtering out customers (legitimate or not) based on heuristics and data to try and avoid processing fraudulent payments - so for the 1% of your payments that are fraudulent, you probably have to throw out 2-5% of them, just to avoid processing the bad ones.
This is FUD, just with different actors.
"Karsten Nohl and Thomas Roth, of Security Research Labs, say that they have been in touch with VeriFone for six months and have provided technical aid to the company and a German government agency. They are now coming forward to put more pressure on the company—and to raise awareness, “preferably before any criminal can reinvent these attacks.”"
And if they had released the attack, VeriFone would have cried even louder..
