MagSpoof – wireless credit card/magstripe spoofer • Hacker News Board

Re: MagSpoof – wireless credit card/magstripe spoofer

#11

Post by JaggedJax » Tue, Nov 24, 2015, 10:52 PM UTC

q3k wrote: post #4

JaggedJax wrote: post #3

I was very surprised to learn there's no check for Chip and Pin requirements beyond what the magstripe requests. I naively assumed if the card had that feature the terminal could force it to be used. What would happen with the other fields he mentions, like whether or not you can withdraw cash with the card?

IIRC from some resarch I did, a decent card provider will reject a magstripe transaction from a terminal with EMV capability if a card is known to also be EMV capable... At least, it could in theory.

They could definitely do this, but I don't think any of them do (or will for quite a while). It's perfectly acceptable for a business to continue sending magstripe transactions if they want. The business just takes the responsibility for chargebacks. This would just look like a transaction where either the reader didn't have the functionality or the merchant decided not to use it.

Re: MagSpoof – wireless credit card/magstripe spoofer

#12

Post by anonova » Tue, Nov 24, 2015, 10:55 PM UTC

mschuster91 wrote: post #8

guyzero wrote: post #6

This is how Samsung Pay works, right? edit: And LoopPay which I guess Samsung acquired.

IIRC all these payment solutions work with NFC communications. I have a couple of NFC-compatible banking cards.

Samsung Pay's pitch is that it is (mostly) backwards compatible with existing card readers. When NFC fails, it does fallback to magnetic strip emulation.

Re: MagSpoof – wireless credit card/magstripe spoofer

#13

Post by loueed » Tue, Nov 24, 2015, 10:57 PM UTC

guyzero wrote: post #6

This is how Samsung Pay works, right? edit: And LoopPay which I guess Samsung acquired.

Same Idea, It was Samsung's effort at getting ahead of Apple Pay seen as it's compatible with non-nfc terminals.

Re: MagSpoof – wireless credit card/magstripe spoofer

#14

Post by [deleted] » Tue, Nov 24, 2015, 10:59 PM UTC

anonova wrote: post #12

mschuster91 wrote: post #8

Earlier quoted context omitted.

IIRC all these payment solutions work with NFC communications. I have a couple of NFC-compatible banking cards.

Samsung Pay's pitch is that it is (mostly) backwards compatible with existing card readers. When NFC fails, it does fallback to magnetic strip emulation.

[deleted]

Re: MagSpoof – wireless credit card/magstripe spoofer

#15

Post by chrisfosterelli » Tue, Nov 24, 2015, 11:04 PM UTC

JaggedJax wrote: post #3

I was very surprised to learn there's no check for Chip and Pin requirements beyond what the magstripe requests. I naively assumed if the card had that feature the terminal could force it to be used. What would happen with the other fields he mentions, like whether or not you can withdraw cash with the card?

The terminal has no method to determine if the card is Chip and Pin enabled aside from the magstripe.

Sure it could check for the actual chip, but credit card fraudsters aren't creating fake cards that include the chip so that wouldn't help either.

I would argue the way they should implement it is such that the bank itself rejects the transaction if it knows the card is chip enabled and the terminal is as well.

Re: MagSpoof – wireless credit card/magstripe spoofer

#16

Post by sjtgraham » Tue, Nov 24, 2015, 11:04 PM UTC

pornel wrote: post #2

There's more gems in there, e.g. a couple of Amex vulnerabilities: https://github.com/samyk/magspoof#american-express-card-numb... > I found a global pattern that allows me to accurately predict American Express card numbers by knowing a full card number, even if already reported lost or stolen. > This means if I were to obtain your Amex card and you called it in as lost or stolen, the moment you get a new card, I kn…

Anyone who has an Amex would notice this immediately. The last digit is the Luhn check digit and the digit before that increments each time a card is issued, starting from 0.

Re: MagSpoof – wireless credit card/magstripe spoofer

#17

Post by onewaystreet » Tue, Nov 24, 2015, 11:07 PM UTC

pornel wrote: post #2

There's more gems in there, e.g. a couple of Amex vulnerabilities: https://github.com/samyk/magspoof#american-express-card-numb... > I found a global pattern that allows me to accurately predict American Express card numbers by knowing a full card number, even if already reported lost or stolen. > This means if I were to obtain your Amex card and you called it in as lost or stolen, the moment you get a new card, I kn…

This is by design: https://en.wikipedia.org/wiki/Bank_card_number

Re: MagSpoof – wireless credit card/magstripe spoofer

#18

Post by atrilumen » Tue, Nov 24, 2015, 11:07 PM UTC

[deleted] wrote: post #14

anonova wrote: post #12

Earlier quoted context omitted.

Samsung Pay's pitch is that it is (mostly) backwards compatible with existing card readers. When NFC fails, it does fallback to magnetic strip emulation.

[deleted]

Sounds like you didn't read the post.

Re: MagSpoof – wireless credit card/magstripe spoofer

#19

Post by UnoriginalGuy » Tue, Nov 24, 2015, 11:10 PM UTC

guyzero wrote: post #6

This is how Samsung Pay works, right? edit: And LoopPay which I guess Samsung acquired.

Yes.

And Samsung is really in a panic right now since the chip & pin rollout is going to effectively nullify their investment. Initially they can just strip the "require pin" flag from the magstripe, but eventually opt-out won't be supported.

So Samsung is investing massively into Samsung Pay adverts and promotions in order to get people using it, with the hope that once this functionality breaks that people will continue using it via NFC supported terminals.

I believe they give you $50-100 just to use Samsung Pay right now for one example.

Re: MagSpoof – wireless credit card/magstripe spoofer

#20

Post by JaggedJax » Tue, Nov 24, 2015, 11:10 PM UTC

chrisfosterelli wrote: post #15

JaggedJax wrote: post #3

I was very surprised to learn there's no check for Chip and Pin requirements beyond what the magstripe requests. I naively assumed if the card had that feature the terminal could force it to be used. What would happen with the other fields he mentions, like whether or not you can withdraw cash with the card?

The terminal has no method to determine if the card is Chip and Pin enabled aside from the magstripe. Sure it could check for the actual chip, but credit card fraudsters aren't creating fake cards that include the chip so that wouldn't help either. I would argue the way they should implement it is such that the bank itself rejects the transaction if it knows the card is chip enabled and the terminal is as well.

Agreed. I think for it to truly work it would require support from the terminal in the form of letting the processor know if the terminal does or doesn't support chip & pin.

If the terminal doesn't support it the processor always lets it through. If the terminal does support it the processor only lets it through if using chip and pin. Then again, maybe there won't be non chip and pin terminal much longer so that won't matter.