MagSpoof: Wireless Magstrip Spoofer • Hacker News Board

Re: MagSpoof: Wireless Magstrip Spoofer

#11

Post by amluto » Sat, Dec 03, 2022, 8:33 PM UTC

Credit card security is comically poor. Off the top of my head:

1. An NFC-enabled EMV card will happily reveal its entire account number and expiration date over NFC with no authentication whatsoever. I don’t know whether the CVV comes along, but I wouldn’t be surprised if it did.

2. (As mentioned in the article) issuers accept transactions from EMV (chip)-capable readers that nominally originate from EMV-capable cards without requiring the chip to be used. So what’s the point of the chip? (Note that this allows a card to be cloned without even touching the card - see #1.)

3. The information leaked in #1 is enough to buy things online (as long as the CVV2 can be found or guessed). Wtf?

4. For some reason I can’t fathom (presumably just laziness), if your card number is stolen, the chip stops working until a replacement shows up.

5. Fancy merchants can arrange a subscription that survives a lost card or even a fraud report against that merchant. But these subscriptions can’t be seen or cancelled on the cardholder website or even by customer service.

But somehow all this comes with fairly stringent PCI requirements, which supposedly represent best practices, despite the entire system design being a case study on worst practices.

Re: MagSpoof: Wireless Magstrip Spoofer

#12

Post by petesergeant » Sat, Dec 03, 2022, 8:38 PM UTC

Samy is still my hero

Re: MagSpoof: Wireless Magstrip Spoofer

#13

Post by isoprophlex » Sat, Dec 03, 2022, 8:42 PM UTC

amluto wrote: post #11

Credit card security is comically poor. Off the top of my head: 1. An NFC-enabled EMV card will happily reveal its entire account number and expiration date over NFC with no authentication whatsoever. I don’t know whether the CVV comes along, but I wouldn’t be surprised if it did. 2. (As mentioned in the article) issuers accept transactions from EMV (chip)-capable readers that nominally originate from EMV-capable car…

> [...] found a global pattern that allows me to accurately predict American Express card numbers by knowing a full card number, even if already reported lost or stolen.

> This means if I were to obtain your Amex card and you called it in as lost or stolen, the moment you get a new card, I know your new credit card number.

Criminally hilarious.

Re: MagSpoof: Wireless Magstrip Spoofer

#14

Post by notme1234 » Sat, Dec 03, 2022, 8:43 PM UTC

This is less useful nowdays, since magstrip are deprecated (at least in most developed countries).

Re: MagSpoof: Wireless Magstrip Spoofer

#15

Post by cowsup » Sat, Dec 03, 2022, 8:45 PM UTC

throwawaaarrgh wrote: post #10

ford wrote: post #5

I long for the day I can carry my phone or watch without needing keys or wallet. The fact that most adults carry at least 3 things (keys/phone/wallet) at all times in 2022 is crazy.

I agree it would be convenient. But consider the new dangers: 1) pickpocketing would suddenly be 3x as profitable and 3x as easy, 2) lose one thing and you've lost everything, 3) if one thing stops working, everything stops working, 4) venues where you have to give up your phone means carrying extra cash in.... a wallet, 5) cybercriminals can now steal much more from you without ever getting near you, 6) I imagine th…

I can theoretically leave my home with just my smartphone. I can use it to pay fare at the local train station, get directions to restaurants, read the news, pay for food and coffee, and even lock / unlock my apartment.

I do still bring my wallet and keys, because I'd hate to run into a scenario where my phone does get lost, stolen, or damaged, leaving me stranded without a way to get home. But the concept is definitely there, and for someone less paranoid than I, it's definitely possible to live a life of convenience.

Re: MagSpoof: Wireless Magstrip Spoofer

#16

Post by [deleted] » Sat, Dec 03, 2022, 8:48 PM UTC

throwawaaarrgh wrote: post #10

ford wrote: post #5

I long for the day I can carry my phone or watch without needing keys or wallet. The fact that most adults carry at least 3 things (keys/phone/wallet) at all times in 2022 is crazy.

I agree it would be convenient. But consider the new dangers: 1) pickpocketing would suddenly be 3x as profitable and 3x as easy, 2) lose one thing and you've lost everything, 3) if one thing stops working, everything stops working, 4) venues where you have to give up your phone means carrying extra cash in.... a wallet, 5) cybercriminals can now steal much more from you without ever getting near you, 6) I imagine th…

[deleted]

Re: MagSpoof: Wireless Magstrip Spoofer

#17

Post by Scoundreller » Sat, Dec 03, 2022, 8:54 PM UTC

amluto wrote: post #11

Credit card security is comically poor. Off the top of my head: 1. An NFC-enabled EMV card will happily reveal its entire account number and expiration date over NFC with no authentication whatsoever. I don’t know whether the CVV comes along, but I wouldn’t be surprised if it did. 2. (As mentioned in the article) issuers accept transactions from EMV (chip)-capable readers that nominally originate from EMV-capable car…

> 2. (As mentioned in the article) issuers accept transactions from EMV (chip)-capable readers that nominally originate from EMV-capable cards without requiring the chip to be used. So what’s the point of the chip? (Note that this allows a card to be cloned without even touching the card - see #1.)

I would think the issuer could refuse the transaction higher up in the process, but it's faster and fewer packets going back and forth if the POS terminal could reject the swipe up-front and tell you to insert the chip.

Re: MagSpoof: Wireless Magstrip Spoofer

#18

Post by amluto » Sat, Dec 03, 2022, 8:55 PM UTC

isoprophlex wrote: post #13

amluto wrote: post #11

Credit card security is comically poor. Off the top of my head: 1. An NFC-enabled EMV card will happily reveal its entire account number and expiration date over NFC with no authentication whatsoever. I don’t know whether the CVV comes along, but I wouldn’t be surprised if it did. 2. (As mentioned in the article) issuers accept transactions from EMV (chip)-capable readers that nominally originate from EMV-capable car…

> [...] found a global pattern that allows me to accurately predict American Express card numbers by knowing a full card number, even if already reported lost or stolen. > This means if I were to obtain your Amex card and you called it in as lost or stolen, the moment you get a new card, I know your new credit card number. Criminally hilarious.

> Criminally hilarious.

ISTM it’s only criminally hilarious if you catch Amex doing something fraudulent or illegal themselves. But it sure would be entertaining to have a big civil lawsuit on the basis of incompetent security practices.

Re: MagSpoof: Wireless Magstrip Spoofer

#19

Post by gambiting » Sat, Dec 03, 2022, 8:55 PM UTC

The american reliance on magstrips is crazy. Over here(Poland) I don't think I've seen a magstrip-compatible terminal for years, they just don't have the swipe part anymore, it's been removed from terminals and cash registers ages ago.

Re: MagSpoof: Wireless Magstrip Spoofer

#20

Post by gambiting » Sat, Dec 03, 2022, 8:56 PM UTC

amluto wrote: post #11

Credit card security is comically poor. Off the top of my head: 1. An NFC-enabled EMV card will happily reveal its entire account number and expiration date over NFC with no authentication whatsoever. I don’t know whether the CVV comes along, but I wouldn’t be surprised if it did. 2. (As mentioned in the article) issuers accept transactions from EMV (chip)-capable readers that nominally originate from EMV-capable car…

>>3. The information leaked in #1 is enough to buy things online (as long as the CVV2 can be found or guessed). Wtf?

At least in EU you can't do that anymore - all online transactions are required to implement 3D secure so you have to confirm the transaction some other way in addition to your card details.