[deleted]
MagSpoof – wireless credit card/magstripe spoofer
31–40 of 115 posts
Re: MagSpoof – wireless credit card/magstripe spoofer
#32Earlier quoted context omitted.
IIRC from some resarch I did, a decent card provider will reject a magstripe transaction from a terminal with EMV capability if a card is known to also be EMV capable... At least, it could in theory.
They could definitely do this, but I don't think any of them do (or will for quite a while). It's perfectly acceptable for a business to continue sending magstripe transactions if they want. The business just takes the responsibility for chargebacks. This would just look like a transaction where either the reader didn't have the functionality or the merchant decided not to use it.
The business has an interest in using chip & PIN. I forget the details of the contracts they have with the banks, but the chip adds extra protection to the credit card company, and the PIN adds extra protection to the business. Which is why people are annoyed that the credit card companies want to stop at chip & signature.
Re: MagSpoof – wireless credit card/magstripe spoofer
#33Earlier quoted context omitted.
The terminal has no method to determine if the card is Chip and Pin enabled aside from the magstripe. Sure it could check for the actual chip, but credit card fraudsters aren't creating fake cards that include the chip so that wouldn't help either. I would argue the way they should implement it is such that the bank itself rejects the transaction if it knows the card is chip enabled and the terminal is as well.
> Sure it could check for the actual chip, but credit card fraudsters aren't creating fake cards that include the chip so that wouldn't help either. Should that read 'credit card fraudsters are creating fake cards that include the chip' ?
No, what he wrote makes sense as written in this context.
Re: MagSpoof – wireless credit card/magstripe spoofer
#34There's more gems in there, e.g. a couple of Amex vulnerabilities: https://github.com/samyk/magspoof#american-express-card-numb... > I found a global pattern that allows me to accurately predict American Express card numbers by knowing a full card number, even if already reported lost or stolen. > This means if I were to obtain your Amex card and you called it in as lost or stolen, the moment you get a new card, I kn…
This is by design: https://en.wikipedia.org/wiki/Bank_card_number
I don't see how this is by design since it only seems to be a vulnerability with Amex and your link doesn't really talk about it.
Re: MagSpoof – wireless credit card/magstripe spoofer
#35There's more gems in there, e.g. a couple of Amex vulnerabilities: https://github.com/samyk/magspoof#american-express-card-numb... > I found a global pattern that allows me to accurately predict American Express card numbers by knowing a full card number, even if already reported lost or stolen. > This means if I were to obtain your Amex card and you called it in as lost or stolen, the moment you get a new card, I kn…
Someone I know said they had their card cloned and when the CSR went to reissue there were already attempts to use the new number, so it seems like this may have already been known by fraudsters.
It's known, I know someone that has experienced the same issue.
Re: MagSpoof – wireless credit card/magstripe spoofer
#36I was very surprised to learn there's no check for Chip and Pin requirements beyond what the magstripe requests. I naively assumed if the card had that feature the terminal could force it to be used. What would happen with the other fields he mentions, like whether or not you can withdraw cash with the card?
The terminal has no method to determine if the card is Chip and Pin enabled aside from the magstripe. Sure it could check for the actual chip, but credit card fraudsters aren't creating fake cards that include the chip so that wouldn't help either. I would argue the way they should implement it is such that the bank itself rejects the transaction if it knows the card is chip enabled and the terminal is as well.
I always assumed that chip/pin being used was at least checked by the credit card company. The machine should be telling them if it supports chip/pin, and the cc company independently knows all the information about your card, so... urrrrgh.
Re: MagSpoof – wireless credit card/magstripe spoofer
#37This is how Samsung Pay works, right? edit: And LoopPay which I guess Samsung acquired.
Yup, however Samsung Pay/LoopPay keep the chip bit meaning you need to bring your cards with you when they require Chip, where MagSpoof can disable the bit, allowing you to leave your cards at home.
Re: MagSpoof – wireless credit card/magstripe spoofer
#38Earlier quoted context omitted.
This makes sense. I've had my Amex replaced several times due to detected fraud, and the last digits are always incremented in a predictable pattern.
If it's the same as it was back in the days of Credit Master 4 for DOS, it bumps up by eights and sixteens.
I just got an Amex replaced about a week ago and the 4th digit from the end was the one incremented.
Re: MagSpoof – wireless credit card/magstripe spoofer
#39It's stunning how bad many card issuing systems are (as noted in the post, AmEx et al). When I was in college all of the administrative buildings, student common areas as well as many of the student housing areas were controlled by magstripe. Meals were also kept track of by card. I knew from people losing their cards which continued working some places but not others there was a relationship in the issuing. I got a…
It could have been "good enough". Remember the whole "keeps an honest man honest" bit. Retooling their security system might cost a lot more than some spoofed meals, and we all know doors & tumbler locks are never impervious.
I think the problem with these systems is that "good enough" should be much more "gooder" than it is, due to being a solved problem for most cases.
For example, if you happen to need a unique ID for each card, and you roll your own "random id generator" you might happen to encounter pitfalls that would've been solved by using UUIDs.
Or you try to get some sort of hash value from the card info (to verify validity or whatever) and instead of using a known hashing algorithm you try to roll your own.
And I would guess a long list of etceteras.
So when a system that should be for the most part trivial to implement correctly is full of these holes then people like GP will start poking around and ultimately start finding a lot of issues that would make it actually not "good enough".
I mean sure, keys are just there to keep honest people out, but if you can use a standard key that would foil both honest AND a few opportunistic dishonest people then why are you instead trying to use your own "custom key" that happens to be much easier to defeat? Especially if said standard key is not really that much harder to implement.
Re: MagSpoof – wireless credit card/magstripe spoofer
#40Hmm, I'm very surprised that magstripe readers don't have sensors that detect physical presence of a card, even to this date. But regardless, the main point for me was how trivially one could downgrade the security by setting the bit about Chip/PIN capability off.