MagSpoof – wireless credit card/magstripe spoofer • Hacker News Board

Re: MagSpoof – wireless credit card/magstripe spoofer

#61

Post by bro-stick » Wed, Nov 25, 2015, 4:49 AM UTC

dragonwriter wrote: post #58

driverdan wrote: post #55

Earlier quoted context omitted.

When I was in school our student IDs were our social security numbers and encoded directly on our ID cards. Grades were left in folders outside the department office with our full SSNs on them. You could easily take someone else's grades, encode their SSN onto a card, and spend their money.

I'm pretty sure that, aside from the magstripe security issue, that practice (grades left in public identified by SSNs and/or student ID #s) has been a FERPA violation forever. Or since the 1970s, at least.

Nope. SSNs were commonly used as ID numbers in K-12 and community colleges up until about the late 1990's, until they were forced to change.

Re: MagSpoof – wireless credit card/magstripe spoofer

#62

Post by bro-stick » Wed, Nov 25, 2015, 4:54 AM UTC

Johnny555 wrote: post #44

pornel wrote: post #2

There's more gems in there, e.g. a couple of Amex vulnerabilities: https://github.com/samyk/magspoof#american-express-card-numb... > I found a global pattern that allows me to accurately predict American Express card numbers by knowing a full card number, even if already reported lost or stolen. > This means if I were to obtain your Amex card and you called it in as lost or stolen, the moment you get a new card, I kn…

I got a replacement Amex card (after some fraudulent charges) 4 or 5 months ago, and it had an all new number, not just a few digits. This card also had the embedded chip, so that may be why it had the new number.

The chip is being rolled out to keep up with VISA/Mastercard's deployment of chip. Note however that chip transactions are far slower than proximity or magstripe uses, making it completely redundant except for a malfunctioning magstripe reader.

It would have been as much software update to have implemented PIN and would've brought security to the level of ATM cards.

The generation and provisioning of card numbers is limited by other systems which includes fraud detection, account processing, auditing and other backend systems.

Re: MagSpoof – wireless credit card/magstripe spoofer

#63

Post by sliverstorm » Wed, Nov 25, 2015, 4:55 AM UTC

slirpee wrote: post #41

sliverstorm wrote: post #27

Earlier quoted context omitted.

It could have been "good enough". Remember the whole "keeps an honest man honest" bit. Retooling their security system might cost a lot more than some spoofed meals, and we all know doors & tumbler locks are never impervious.

Yeah, until a man gains easy access to 17-year-old girls' housing, then everyone will flip out. I mean, it's one thing to break stuff to get in, or conspicuously pick a lock, it's another to casually slide a card like everyone else and leave no trail other than maybe video surveillance or access logs showing the same card being used at two ends of campus faster than possible (which nobody will check until something b…

it's another to casually slide a card like everyone else

How about to casually insert a duplicated key like everyone else?

Re: MagSpoof – wireless credit card/magstripe spoofer

#64

Post by guruslead » Wed, Nov 25, 2015, 4:58 AM UTC

need a hacker? for hacking of mails, grades, records, credit, facebook, whatsapp, and all forms of hacking, contact the hack guru on his email. demon_teco@gmx.com

Re: MagSpoof – wireless credit card/magstripe spoofer

#65

Post by artursapek » Wed, Nov 25, 2015, 4:59 AM UTC

peteretep wrote: post #42

One day in the future, Samy (the creator of this) will stop being the coolest person on the internet, but today isn't that day. Previous projects include: The Samy MySpace worm: https://en.wikipedia.org/wiki/Samy_%28computer_worm%29 EverCookies: http://samy.pl/evercookie/ SkyJack: https://en.wikipedia.org/wiki/SkyJack And so much more... http://samy.pl/ https://en.wikipedia.org/wiki/Samy_Kamkar

He was banned from using computers for 3 years as a result of the MySpace worm? That's ridiculous.

Re: MagSpoof – wireless credit card/magstripe spoofer

#66

Post by guruslead » Wed, Nov 25, 2015, 5:01 AM UTC

Need a hacker?For your hacking of grades, database, fixing of credit, whatsapp, facebook, clearing of criminal records, contact the hack guru demon_teco@gmx.com dude is good.

Re: MagSpoof – wireless credit card/magstripe spoofer

#67

Post by artursapek » Wed, Nov 25, 2015, 5:04 AM UTC

UnoriginalGuy wrote: post #19

guyzero wrote: post #6

This is how Samsung Pay works, right? edit: And LoopPay which I guess Samsung acquired.

Yes. And Samsung is really in a panic right now since the chip & pin rollout is going to effectively nullify their investment. Initially they can just strip the "require pin" flag from the magstripe, but eventually opt-out won't be supported. So Samsung is investing massively into Samsung Pay adverts and promotions in order to get people using it, with the hope that once this functionality breaks that people will con…

Couldn't they have thought of a more creative name for their payment service than "s/Apple/Samsung"?

Re: MagSpoof – wireless credit card/magstripe spoofer

#68

Post by amydav » Wed, Nov 25, 2015, 5:19 AM UTC

this is not an advert, but contact waltsteph82@gmail.com for your hacking related issues or text 601 866 5203

Re: MagSpoof – wireless credit card/magstripe spoofer

#69

Post by guruslead » Wed, Nov 25, 2015, 5:24 AM UTC

Need a hacker?For your hacking of grades, database, fixing

of credit, whatsapp, facebook, clearing of criminal

records, contact the hack guru demon_teco@gmx.com . we

also track cheating spouses, locations, messages, call

records and all forms of hacking demon_teco@gmx.com

Re: MagSpoof – wireless credit card/magstripe spoofer

#70

Post by dfox » Wed, Nov 25, 2015, 5:34 AM UTC

Strilanc wrote: post #36

chrisfosterelli wrote: post #15

Earlier quoted context omitted.

The terminal has no method to determine if the card is Chip and Pin enabled aside from the magstripe. Sure it could check for the actual chip, but credit card fraudsters aren't creating fake cards that include the chip so that wouldn't help either. I would argue the way they should implement it is such that the bank itself rejects the transaction if it knows the card is chip enabled and the terminal is as well.

I always assumed that chip/pin being used was at least checked by the credit card company. The machine should be telling them if it supports chip/pin, and the cc company independently knows all the information about your card, so... urrrrgh.

The card company checks whether the card and terminal are EMV capable. But, the whole card system is not built on absolute security but on risk-management and fraud detection, that is somehow balanced with customer convenience. In effects this means that only thing that is absolutely needed for transaction to be authorized is card number, what other data have to be provided and what checks have to pass is function of trustworthiness of various parties involved (mainly of the merchant).

(for example, the EMV standard explicitly handles various failure modes like "PIN-pad is broken", "card holder does not remember PIN" and so on, and allows configurations that accept such transactions)