Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MagSpoof – wireless credit card/magstripe spoofer

github.com

Post reply on HN
Print view View original

51–60 of 115 posts

Re: MagSpoof – wireless credit card/magstripe spoofer

#51

Post by eggy »

saganus wrote: post #43
peteretep wrote: post #42

One day in the future, Samy (the creator of this) will stop being the coolest person on the internet, but today isn't that day. Previous projects include: The Samy MySpace worm: https://en.wikipedia.org/wiki/Samy_%28computer_worm%29 EverCookies: http://samy.pl/evercookie/ SkyJack: https://en.wikipedia.org/wiki/SkyJack And so much more... http://samy.pl/ https://en.wikipedia.org/wiki/Samy_Kamkar

Oh wow... shit... it's the same guy for all of these indeed. I think I would've been super proud of myself just for accomplishing even one of these things... I guess these are the type of guys that would start to approach the definition of a modern polymath maybe? Not saying he is one necessarily (or that he isn't), but what would examples of modern polymaths are there? considering a lot of the fields to be mastered…

Yes, he has quite a resume there. However, maybe I'm just older, but my ideal polymath is not just coding/hacking electronics. I personally think it should be those plus knowing more diverse fields and skills such as: applied mathematics, celestial navigation, biohacking, chemistry, milling/lathe work, building machinery from scratch by smelting and casting [1], animatronics, boatbuilding, horology, mechatronics, music, languages etc... I picked these things, because they are things I personally strive to keep learning. They are not everybody's list. I guess today the emphasis is on coding/small electronics because of the world it opens up to you (except those things that are purely mechanical or require other skills). In any case, my hat is off to him. Impressive!

   [1] http://gingerybooks.com/

Re: MagSpoof – wireless credit card/magstripe spoofer

#53

Post by chrsstrm »

peteretep wrote: post #42

One day in the future, Samy (the creator of this) will stop being the coolest person on the internet, but today isn't that day. Previous projects include: The Samy MySpace worm: https://en.wikipedia.org/wiki/Samy_%28computer_worm%29 EverCookies: http://samy.pl/evercookie/ SkyJack: https://en.wikipedia.org/wiki/SkyJack And so much more... http://samy.pl/ https://en.wikipedia.org/wiki/Samy_Kamkar

He's got a one-page profile in the Star Wars issue of Wired that I read today (probably the December issue)

Re: MagSpoof – wireless credit card/magstripe spoofer

#54

Post by viraptor »

sjtgraham wrote: post #16
pornel wrote: post #2

There's more gems in there, e.g. a couple of Amex vulnerabilities: https://github.com/samyk/magspoof#american-express-card-numb... > I found a global pattern that allows me to accurately predict American Express card numbers by knowing a full card number, even if already reported lost or stolen. > This means if I were to obtain your Amex card and you called it in as lost or stolen, the moment you get a new card, I kn…

Anyone who has an Amex would notice this immediately. The last digit is the Luhn check digit and the digit before that increments each time a card is issued, starting from 0.

Either it's only a specific kind of amex, or it's not starting from 0, or this is incorrect information.

I've got 2 AMEX cards - one reissued and ends with 0, another issued the first time and ends with non-0. (I'm ignoring the check digit)

Re: MagSpoof – wireless credit card/magstripe spoofer

#55

Post by driverdan »

brokentone wrote: post #5

It's stunning how bad many card issuing systems are (as noted in the post, AmEx et al). When I was in college all of the administrative buildings, student common areas as well as many of the student housing areas were controlled by magstripe. Meals were also kept track of by card. I knew from people losing their cards which continued working some places but not others there was a relationship in the issuing. I got a…

When I was in school our student IDs were our social security numbers and encoded directly on our ID cards. Grades were left in folders outside the department office with our full SSNs on them. You could easily take someone else's grades, encode their SSN onto a card, and spend their money.

Re: MagSpoof – wireless credit card/magstripe spoofer

#56

Post by TeMPOraL »

JaggedJax wrote: post #10
stanmancan wrote: post #9

Earlier quoted context omitted.

I live in Canada and that's what happens with all of my visa/debit chip cards. If you attempt to swipe your card and it, as well as the terminal, are chip enabled then it gives you an error and asks you to insert your card into the terminal.

That is triggered by the magstripe though. The point here is you can trick the reader by turning off that feature on the magstripe and the reader doesn't do any additional check on whether EMV should be required.

Not in all cases, I believe. For instance, to use my debit card in China, where a lot of payments is still done via magstripe, I have to call my bank and ask them to enable magstripe transactions for me in their system. Otherwise, the bank will keep rejecting transaction attempts.

Re: MagSpoof – wireless credit card/magstripe spoofer

#57

Post by sjtgraham »

viraptor wrote: post #54
sjtgraham wrote: post #16

Earlier quoted context omitted.

Anyone who has an Amex would notice this immediately. The last digit is the Luhn check digit and the digit before that increments each time a card is issued, starting from 0.

Either it's only a specific kind of amex, or it's not starting from 0, or this is incorrect information. I've got 2 AMEX cards - one reissued and ends with 0, another issued the first time and ends with non-0. (I'm ignoring the check digit)

I've just pulled a load of expired my Amex cards. It looks like I got the incrementing digit wrong. On my cards it's the 4th from last that increments. UK Amex FWIW.

Re: MagSpoof – wireless credit card/magstripe spoofer

#58

Post by dragonwriter »

driverdan wrote: post #55
brokentone wrote: post #5

It's stunning how bad many card issuing systems are (as noted in the post, AmEx et al). When I was in college all of the administrative buildings, student common areas as well as many of the student housing areas were controlled by magstripe. Meals were also kept track of by card. I knew from people losing their cards which continued working some places but not others there was a relationship in the issuing. I got a…

When I was in school our student IDs were our social security numbers and encoded directly on our ID cards. Grades were left in folders outside the department office with our full SSNs on them. You could easily take someone else's grades, encode their SSN onto a card, and spend their money.

I'm pretty sure that, aside from the magstripe security issue, that practice (grades left in public identified by SSNs and/or student ID #s) has been a FERPA violation forever. Or since the 1970s, at least.

Re: MagSpoof – wireless credit card/magstripe spoofer

#60

Post by mistercow »

> What's incredible is that the magstripe reader requires no form of wireless receiver, NFC, or RFID

Another way of looking at it is that the magstripe reader is a wireless receiver. It just usually works with signals so weak that they can only be transmitted a miniscule distance.

Post reply on HN