Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MagSpoof: Wireless Magstrip Spoofer

github.com

Post reply on HN
Print view View original

31–40 of 105 posts

Re: MagSpoof: Wireless Magstrip Spoofer

#31

Post by cbm-vic-20 »

gambiting wrote: post #19

The american reliance on magstrips is crazy. Over here(Poland) I don't think I've seen a magstrip-compatible terminal for years, they just don't have the swipe part anymore, it's been removed from terminals and cash registers ages ago.

American here- most retail terminals here support NFC and chip- I haven't used magstrip in a retail environment for years- even mom-and-pop shops support NFC. Most gas stations accept chip, but not many accept NFC yet, though I'm seeing it more and more. Some gas stations still only accept magstrip.

We still have the stupid policy in restaurants where you hand your card to the server and they walk away with it (their terminals are usually chip), which is something that a lot of foreigners freak out about.

Re: MagSpoof: Wireless Magstrip Spoofer

#32

Post by iancarroll »

isoprophlex wrote: post #13
amluto wrote: post #11

Credit card security is comically poor. Off the top of my head: 1. An NFC-enabled EMV card will happily reveal its entire account number and expiration date over NFC with no authentication whatsoever. I don’t know whether the CVV comes along, but I wouldn’t be surprised if it did. 2. (As mentioned in the article) issuers accept transactions from EMV (chip)-capable readers that nominally originate from EMV-capable car…

> [...] found a global pattern that allows me to accurately predict American Express card numbers by knowing a full card number, even if already reported lost or stolen. > This means if I were to obtain your Amex card and you called it in as lost or stolen, the moment you get a new card, I know your new credit card number. Criminally hilarious.

Amex is already legally responsible for fraudulent charges on your card, so if they want to make the numbers predictable, why not?

Re: MagSpoof: Wireless Magstrip Spoofer

#33

Post by lxgr »

amluto wrote: post #11

Credit card security is comically poor. Off the top of my head: 1. An NFC-enabled EMV card will happily reveal its entire account number and expiration date over NFC with no authentication whatsoever. I don’t know whether the CVV comes along, but I wouldn’t be surprised if it did. 2. (As mentioned in the article) issuers accept transactions from EMV (chip)-capable readers that nominally originate from EMV-capable car…

> An NFC-enabled EMV card will happily reveal its entire account number and expiration date over NFC with no authentication whatsoever.

EMV was enabled with the intention of replacing magnetic stripe payments quickly. Together with 3DS on the online payment side, this would have effectively made a card number by itself worthless. Unfortunately this hasn't happend (except for mobile wallets using tokenization like Apple and Google Pay), but given that (at the time entirely reasonable!) assumption, I'd cut the original designers some slack.

Another reason: How would you even implement authentication? There are millions of terminals out there, operated by at least hundreds of different service providers. What key would you use for authentication and how would you hide it in a way that wouldn't eventually be leaked from legitimate terminals?

> issuers accept transactions from EMV (chip)-capable readers that nominally originate from EMV-capable cards without requiring the chip to be

Some issuers do, some don't. That's not the protocol's fault.

> 3. The information leaked in #1 is enough to buy things online (as long as the CVV2 can be found or guessed). Wtf?

At merchants not using 3DS, that is true – but these merchants also bear the full liability for any fraud happening. In the end, it's a prototypical security vs. usability/conversion tradeoff, in the same way that US credit cards don't have PINs, while almost every other market does.

Re: MagSpoof: Wireless Magstrip Spoofer

#34

Post by lxgr »

ComputerGuru wrote: post #28
gambiting wrote: post #20

Earlier quoted context omitted.

>>3. The information leaked in #1 is enough to buy things online (as long as the CVV2 can be found or guessed). Wtf? At least in EU you can't do that anymore - all online transactions are required to implement 3D secure so you have to confirm the transaction some other way in addition to your card details.

It's a legal requirement for EU vendors but the cards themselves (or at least some of them) can still be used without 3DSecure.

No, issuers need to enforce 3DS as well (for payments within the EEA), unless there is an applicable exemption.

Re: MagSpoof: Wireless Magstrip Spoofer

#35

Post by baal80spam »

cbm-vic-20 wrote: post #31
gambiting wrote: post #19

The american reliance on magstrips is crazy. Over here(Poland) I don't think I've seen a magstrip-compatible terminal for years, they just don't have the swipe part anymore, it's been removed from terminals and cash registers ages ago.

American here- most retail terminals here support NFC and chip- I haven't used magstrip in a retail environment for years- even mom-and-pop shops support NFC. Most gas stations accept chip, but not many accept NFC yet, though I'm seeing it more and more. Some gas stations still only accept magstrip. We still have the stupid policy in restaurants where you hand your card to the server and they walk away with it (their…

> We still have the stupid policy in restaurants where you hand your card to the server and they walk away with it (their terminals are usually chip), which is something that a lot of foreigners freak out about.

And rightfully so! What is stopping them from copying the PAN, expiry date and CVV2? I wouldn't give my card to anyone - that's what portable (wifi/BT) terminals are for.

Re: MagSpoof: Wireless Magstrip Spoofer

#36

Post by lxgr »

ComputerGuru wrote: post #29
Scoundreller wrote: post #23

Earlier quoted context omitted.

Yeah, whenever I try to swipe my card, it instantly tells me to use Chip and PIN. I think it's just to provide rapid localized responses, but who knows if some banks are misconfigured and overly trusted the magstripe data to block magstripe transactions.

But that's what's covered in the article. The "block transaction and require chip and PIN" flag is stored on the magtrack itself.

The bank/processor also knows it and is able to reject any modifications. Whether they do is a matter of their security posture.

Re: MagSpoof: Wireless Magstrip Spoofer

#37

Post by lxgr »

gambiting wrote: post #19

The american reliance on magstrips is crazy. Over here(Poland) I don't think I've seen a magstrip-compatible terminal for years, they just don't have the swipe part anymore, it's been removed from terminals and cash registers ages ago.

US merchants have widely accepted magnetic stripe card payments for many decades more than the rest of the world. It's a pretty typical example of a first-mover disadvantage: More legacy systems to deal with.

That said, the switch to chip and contactless is happening pretty rapidly, in my experience, with an also entirely expected long tail of merchants that will probably hold on to their legacy POSes as long as technically possible.

Re: MagSpoof: Wireless Magstrip Spoofer

#38

Post by lxgr »

amluto wrote: post #24
Scoundreller wrote: post #17

Earlier quoted context omitted.

> 2. (As mentioned in the article) issuers accept transactions from EMV (chip)-capable readers that nominally originate from EMV-capable cards without requiring the chip to be used. So what’s the point of the chip? (Note that this allows a card to be cloned without even touching the card - see #1.) I would think the issuer could refuse the transaction higher up in the process, but it's faster and fewer packets going…

That’s like saying you think a server can reject a wrong password on the backend, but it’s faster and fewer packets going back and forth if the client JavaScript just verified the password before sending POST. This is nuts. At least there’s nothing fundamentally wrong with a card reader also rejecting the transaction. (It’s also not fewer packets. Although it does require the backend to know whether the card reader c…

A better comparison would be the client JavaScript rejecting a four-character password, because it knows the backend policy requires at least eight.

Done right (without e.g. checking for "key down" events to thwart password managers...), this could could actually improve security somehwat by avoiding whatever the user entered (maybe a low-entropy PIN?) hitting the network or backend, besides providing for a faster error response and thereby nicer UX.

> It’s also not fewer packets

It avoids an entire round trip to the issuer's backend and back, which are often still somewhat expensive and slow, given the legacy systems and connections involved.

Re: MagSpoof: Wireless Magstrip Spoofer

#39

Post by atonse »

gambiting wrote: post #19

The american reliance on magstrips is crazy. Over here(Poland) I don't think I've seen a magstrip-compatible terminal for years, they just don't have the swipe part anymore, it's been removed from terminals and cash registers ages ago.

The US market has been historically different for other reasons.

The big one is liability. In the US the cardholder is rarely liable for fraud charges. Which is why the minutiae of credit card security mechanisms just kind of doesn’t matter to us.

But from my understanding, in Europe and places like India, the cardholder is usually liable. Which also explains why cardholders seem to be a lot more anxious about these things in those countries and don’t really understand how Americans don’t care too much, say, that a waiter can walk off with your credit card at a restaurant.

Not claiming one system is better than the other… actually no, maybe I’m biased but I’m happy that the US system places liability on businesses rather than consumers. Which is why most US customers don’t care about these things and freely use their cards for everything.

Re: MagSpoof: Wireless Magstrip Spoofer

#40

Post by gambiting »

cbm-vic-20 wrote: post #31
gambiting wrote: post #19

The american reliance on magstrips is crazy. Over here(Poland) I don't think I've seen a magstrip-compatible terminal for years, they just don't have the swipe part anymore, it's been removed from terminals and cash registers ages ago.

American here- most retail terminals here support NFC and chip- I haven't used magstrip in a retail environment for years- even mom-and-pop shops support NFC. Most gas stations accept chip, but not many accept NFC yet, though I'm seeing it more and more. Some gas stations still only accept magstrip. We still have the stupid policy in restaurants where you hand your card to the server and they walk away with it (their…

>>which is something that a lot of foreigners freak out about.

Well yes, we're being told by our banks specifically that if you give anyone your card and they walk away with it, they won't cover you for fraud. The card has to stay in your sight at all times. In fact if you are in EU and you find a business that does this, you can report them to Visa/Mastercard and they will get a warning if not outright lose their terminal.

Post reply on HN