MagSpoof – wireless credit card/magstripe spoofer
1–10 of 115 posts
Re: MagSpoof – wireless credit card/magstripe spoofer
#2There's more gems in there, e.g. a couple of Amex vulnerabilities:
https://github.com/samyk/magspoof#american-express-card-numb...
> I found a global pattern that allows me to accurately predict American Express card numbers by knowing a full card number, even if already reported lost or stolen. > This means if I were to obtain your Amex card and you called it in as lost or stolen, the moment you get a new card, I know your new credit card number.
Re: MagSpoof – wireless credit card/magstripe spoofer
#3I was very surprised to learn there's no check for Chip and Pin requirements beyond what the magstripe requests. I naively assumed if the card had that feature the terminal could force it to be used. What would happen with the other fields he mentions, like whether or not you can withdraw cash with the card?
Re: MagSpoof – wireless credit card/magstripe spoofer
#4I was very surprised to learn there's no check for Chip and Pin requirements beyond what the magstripe requests. I naively assumed if the card had that feature the terminal could force it to be used. What would happen with the other fields he mentions, like whether or not you can withdraw cash with the card?
IIRC from some resarch I did, a decent card provider will reject a magstripe transaction from a terminal with EMV capability if a card is known to also be EMV capable... At least, it could in theory.
Re: MagSpoof – wireless credit card/magstripe spoofer
#5It's stunning how bad many card issuing systems are (as noted in the post, AmEx et al). When I was in college all of the administrative buildings, student common areas as well as many of the student housing areas were controlled by magstripe. Meals were also kept track of by card.
I knew from people losing their cards which continued working some places but not others there was a relationship in the issuing. I got a reader, decoded the card (zeropadded student ID, issue number, and XOR checksum).
I found other places to find the student ID number, and could enumerate a few issue numbers. I built this spoofer: http://www.instructables.com/id/Arduino-Magstripe-Emulator/ Then I could get into my friend's apartments (as a POC with their permission of course).
I disclosed and got a thank you (I built a good relationship with my IT dept over the years), but never figured out if they fixed it.
Re: MagSpoof – wireless credit card/magstripe spoofer
#6This is how Samsung Pay works, right?
edit: And LoopPay which I guess Samsung acquired.
Re: MagSpoof – wireless credit card/magstripe spoofer
#7There's more gems in there, e.g. a couple of Amex vulnerabilities: https://github.com/samyk/magspoof#american-express-card-numb... > I found a global pattern that allows me to accurately predict American Express card numbers by knowing a full card number, even if already reported lost or stolen. > This means if I were to obtain your Amex card and you called it in as lost or stolen, the moment you get a new card, I kn…
This makes sense. I've had my Amex replaced several times due to detected fraud, and the last digits are always incremented in a predictable pattern.
Re: MagSpoof – wireless credit card/magstripe spoofer
#8This is how Samsung Pay works, right? edit: And LoopPay which I guess Samsung acquired.
IIRC all these payment solutions work with NFC communications. I have a couple of NFC-compatible banking cards.
Re: MagSpoof – wireless credit card/magstripe spoofer
#9I was very surprised to learn there's no check for Chip and Pin requirements beyond what the magstripe requests. I naively assumed if the card had that feature the terminal could force it to be used. What would happen with the other fields he mentions, like whether or not you can withdraw cash with the card?
IIRC from some resarch I did, a decent card provider will reject a magstripe transaction from a terminal with EMV capability if a card is known to also be EMV capable... At least, it could in theory.
I live in Canada and that's what happens with all of my visa/debit chip cards. If you attempt to swipe your card and it, as well as the terminal, are chip enabled then it gives you an error and asks you to insert your card into the terminal.
Re: MagSpoof – wireless credit card/magstripe spoofer
#10Earlier quoted context omitted.
IIRC from some resarch I did, a decent card provider will reject a magstripe transaction from a terminal with EMV capability if a card is known to also be EMV capable... At least, it could in theory.
I live in Canada and that's what happens with all of my visa/debit chip cards. If you attempt to swipe your card and it, as well as the terminal, are chip enabled then it gives you an error and asks you to insert your card into the terminal.
That is triggered by the magstripe though. The point here is you can trick the reader by turning off that feature on the magstripe and the reader doesn't do any additional check on whether EMV should be required.