Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MagSpoof – wireless credit card/magstripe spoofer

github.com

Post reply on HN
Print view View original

41–50 of 115 posts

Re: MagSpoof – wireless credit card/magstripe spoofer

#41

Post by slirpee »

sliverstorm wrote: post #27
brokentone wrote: post #5

It's stunning how bad many card issuing systems are (as noted in the post, AmEx et al). When I was in college all of the administrative buildings, student common areas as well as many of the student housing areas were controlled by magstripe. Meals were also kept track of by card. I knew from people losing their cards which continued working some places but not others there was a relationship in the issuing. I got a…

It could have been "good enough". Remember the whole "keeps an honest man honest" bit. Retooling their security system might cost a lot more than some spoofed meals, and we all know doors & tumbler locks are never impervious.

Yeah, until a man gains easy access to 17-year-old girls' housing, then everyone will flip out. I mean, it's one thing to break stuff to get in, or conspicuously pick a lock, it's another to casually slide a card like everyone else and leave no trail other than maybe video surveillance or access logs showing the same card being used at two ends of campus faster than possible (which nobody will check until something bad happens and they go looking at that data.)

I had a similar experience at my university. I found easy unauthenticated sourcing of most of the data needed to clone the card of anybody by name. The issue number was the only thing to guess, but easy to bruteforce on something low-stakes like vending machines. The card was used for food, a debit-card-like system, automated door locks to semi-public buildings and on-campus housing.

With the permission and cooperation of the university security, I made a card of a high-level security guy (who could have been targeted using the public/semi-public org chart) and swiped into their datacenter where all the university data is hosted, along with that of some partners with sensitive data. Luckily the innermost parts need an RFID or something which I didn't have access to, but potentially I could have tailgated or social-engineered my way into that. They weren't interested in letting me research whether I could crack the RFID. :(

I was told my demo made a big splash, but IIRC I checked a year or two later and my source for the ID data was still wide open. There's having imperfect locks and then there's leaving all your keys out in public.

Re: MagSpoof – wireless credit card/magstripe spoofer

#42

Post by peteretep »

One day in the future, Samy (the creator of this) will stop being the coolest person on the internet, but today isn't that day. Previous projects include:

The Samy MySpace worm: https://en.wikipedia.org/wiki/Samy_%28computer_worm%29

EverCookies: http://samy.pl/evercookie/

SkyJack: https://en.wikipedia.org/wiki/SkyJack

And so much more... http://samy.pl/ https://en.wikipedia.org/wiki/Samy_Kamkar

Re: MagSpoof – wireless credit card/magstripe spoofer

#43

Post by saganus »

peteretep wrote: post #42

One day in the future, Samy (the creator of this) will stop being the coolest person on the internet, but today isn't that day. Previous projects include: The Samy MySpace worm: https://en.wikipedia.org/wiki/Samy_%28computer_worm%29 EverCookies: http://samy.pl/evercookie/ SkyJack: https://en.wikipedia.org/wiki/SkyJack And so much more... http://samy.pl/ https://en.wikipedia.org/wiki/Samy_Kamkar

Oh wow... shit... it's the same guy for all of these indeed. I think I would've been super proud of myself just for accomplishing even one of these things...

I guess these are the type of guys that would start to approach the definition of a modern polymath maybe?

Not saying he is one necessarily (or that he isn't), but what would examples of modern polymaths are there? considering a lot of the fields to be mastered need enough detail and knowledge that it seems hard to find one.

Re: MagSpoof – wireless credit card/magstripe spoofer

#44

Post by Johnny555 »

pornel wrote: post #2

There's more gems in there, e.g. a couple of Amex vulnerabilities: https://github.com/samyk/magspoof#american-express-card-numb... > I found a global pattern that allows me to accurately predict American Express card numbers by knowing a full card number, even if already reported lost or stolen. > This means if I were to obtain your Amex card and you called it in as lost or stolen, the moment you get a new card, I kn…

I got a replacement Amex card (after some fraudulent charges) 4 or 5 months ago, and it had an all new number, not just a few digits.

This card also had the embedded chip, so that may be why it had the new number.

Re: MagSpoof – wireless credit card/magstripe spoofer

#45

Post by seanp2k2 »

Strilanc wrote: post #36
chrisfosterelli wrote: post #15

Earlier quoted context omitted.

The terminal has no method to determine if the card is Chip and Pin enabled aside from the magstripe. Sure it could check for the actual chip, but credit card fraudsters aren't creating fake cards that include the chip so that wouldn't help either. I would argue the way they should implement it is such that the bank itself rejects the transaction if it knows the card is chip enabled and the terminal is as well.

I always assumed that chip/pin being used was at least checked by the credit card company. The machine should be telling them if it supports chip/pin, and the cc company independently knows all the information about your card, so... urrrrgh.

What's also interesting about our chip readers here in the US is that they only do chip + signature for credit cards, so they're not adding anything if someone physically has your card (I've had the ones they auto-reissue, which Chase claims they cannot stop in their system, stolen from my mailbox).

Re: MagSpoof – wireless credit card/magstripe spoofer

#48

Post by negativity »

peteretep wrote: post #42

One day in the future, Samy (the creator of this) will stop being the coolest person on the internet, but today isn't that day. Previous projects include: The Samy MySpace worm: https://en.wikipedia.org/wiki/Samy_%28computer_worm%29 EverCookies: http://samy.pl/evercookie/ SkyJack: https://en.wikipedia.org/wiki/SkyJack And so much more... http://samy.pl/ https://en.wikipedia.org/wiki/Samy_Kamkar

  SkyJack is a drone engineered to autonomously seek out, 
  hack, and wirelessly take over other drones within wifi 
  distance, creating an army of zombie drones under your 
  control.
...and then:

  No authentication or encryption is used by the Parrot 
  to secure the connection with the pilot.
Well, there's your problem!

Re: MagSpoof – wireless credit card/magstripe spoofer

#50

Post by halviti »

JaggedJax wrote: post #3

I was very surprised to learn there's no check for Chip and Pin requirements beyond what the magstripe requests. I naively assumed if the card had that feature the terminal could force it to be used. What would happen with the other fields he mentions, like whether or not you can withdraw cash with the card?

The problem of tricking the reader will be solved in the US the same way the rest of the world solved the problem. You stop using magnetic stripes.

For the longest time, chip-and-pin readers in most european countries would let you just swipe the magnetic card if you didn't have a chip.. this allowed americans (and whoever else still uses this technology) to be able to shop when they travel.

Unfortunately a disproportionate amount of theft occurs by bypassing the chip-and-pin system. Many european countries and banks finally had enough and said "no more loopholes, chip-and-pin only" and set a date.

Lo and behold this spurred the US banks to finally start releasing chip-and-pin enabled cards, otherwise their clients would find themselves unable to buy things overseas.

The deadlines have come and went in my country, and today it is literally impossible to buy anything with just a magnetic stripe.

I imagine the US will solve the problem the same way.. by no longer allowing magnetic stripes to be used.

Post reply on HN