Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MagSpoof: Wireless Magstrip Spoofer

github.com

Post reply on HN
Print view View original

51–60 of 105 posts

Re: MagSpoof: Wireless Magstrip Spoofer

#51

Post by amluto »

lxgr wrote: post #38
amluto wrote: post #24

Earlier quoted context omitted.

That’s like saying you think a server can reject a wrong password on the backend, but it’s faster and fewer packets going back and forth if the client JavaScript just verified the password before sending POST. This is nuts. At least there’s nothing fundamentally wrong with a card reader also rejecting the transaction. (It’s also not fewer packets. Although it does require the backend to know whether the card reader c…

A better comparison would be the client JavaScript rejecting a four-character password, because it knows the backend policy requires at least eight. Done right (without e.g. checking for "key down" events to thwart password managers...), this could could actually improve security somehwat by avoiding whatever the user entered (maybe a low-entropy PIN?) hitting the network or backend, besides providing for a faster er…

> It avoids an entire round trip to the issuer's backend and back, which are often still somewhat expensive and slow, given the legacy systems and connections involved.

Not if done both client-side and server-side.

Right now, if I swipe my magnetic stripe, then terminal will reject it if the stripe has the magic bit set. If the magic bit is clear, the terminal will (eventually, but usually while the customer waits) send a message to the network saying that the card was present and asking for authorization. The network responds. No additional round trip would be needed for the network to deny authorization if the chip was not used.

Re: MagSpoof: Wireless Magstrip Spoofer

#52

Post by iudqnolq »

grishka wrote: post #45
amluto wrote: post #11

Credit card security is comically poor. Off the top of my head: 1. An NFC-enabled EMV card will happily reveal its entire account number and expiration date over NFC with no authentication whatsoever. I don’t know whether the CVV comes along, but I wouldn’t be surprised if it did. 2. (As mentioned in the article) issuers accept transactions from EMV (chip)-capable readers that nominally originate from EMV-capable car…

> 2. (As mentioned in the article) issuers accept transactions from EMV (chip)-capable readers that nominally originate from EMV-capable cards without requiring the chip to be used. Last time I tried swiping my card — and that was ages ago — the terminal displayed something to the effect of "this card has a chip, please insert the chip". > 3. The information leaked in #1 is enough to buy things online (as long as the…

> Last time I tried swiping my card — and that was ages ago — the terminal displayed something to the effect of "this card has a chip, please insert the chip".

I think it's configurable depending on merchant risk tolerance. I've seen cases where the terminal lets you swipe after three failed chip reads, for example.

Re: MagSpoof: Wireless Magstrip Spoofer

#53

Post by monocularvision »

espenwa wrote: post #49
ford wrote: post #5

I long for the day I can carry my phone or watch without needing keys or wallet. The fact that most adults carry at least 3 things (keys/phone/wallet) at all times in 2022 is crazy.

Can’t help you with the keys or ID (yet), but I exclusively use the stored cards on my Apple Watch for payment. It is so reliable (in Norway) that I haven’t brought my wallet on normal days in 2+ years. Even on vacation in Northern Europe (Belgium, Netherlands, France, Germany) and on a business trip to the US (California+Texas) this year, I very rarely had to use the physical cards. NFC just works. Everywhere. I sti…

NFC adoption has been improving in the US but still far too many big retailers that still won’t accept it, even when they have the equipment.

Re: MagSpoof: Wireless Magstrip Spoofer

#54

Post by pinko »

iudqnolq wrote: post #52
grishka wrote: post #45

Earlier quoted context omitted.

> 2. (As mentioned in the article) issuers accept transactions from EMV (chip)-capable readers that nominally originate from EMV-capable cards without requiring the chip to be used. Last time I tried swiping my card — and that was ages ago — the terminal displayed something to the effect of "this card has a chip, please insert the chip". > 3. The information leaked in #1 is enough to buy things online (as long as the…

> Last time I tried swiping my card — and that was ages ago — the terminal displayed something to the effect of "this card has a chip, please insert the chip". I think it's configurable depending on merchant risk tolerance. I've seen cases where the terminal lets you swipe after three failed chip reads, for example.

Almost every terminal will fall back to mag-swipe if the chip fails to read 3 times. I had an Amex with a faulty chip and had to do this every time. Terminal (every single one) would refuse to allow me to pay with a swipe initially, insisting on chip -- but once the chip failed 3 times, they'd all happily take the swipe.

Re: MagSpoof: Wireless Magstrip Spoofer

#55

Post by FPGAhacker »

You can see whole credit card number in the iron oxide encoding in the picture of the whole backside of the card with electrical tape covering the signature. The author seems to have wiped away the iron oxide but enough residue is left behind that you can still read it.

Re: MagSpoof: Wireless Magstrip Spoofer

#56

Post by robertlagrant »

wiml wrote: post #42
baal80spam wrote: post #35

Earlier quoted context omitted.

> We still have the stupid policy in restaurants where you hand your card to the server and they walk away with it (their terminals are usually chip), which is something that a lot of foreigners freak out about. And rightfully so! What is stopping them from copying the PAN, expiry date and CVV2? I wouldn't give my card to anyone - that's what portable (wifi/BT) terminals are for.

What stops a server with a good memory from looking at your card as they put it in their terminal and remembering it for the 30 seconds it takes to walk away and note it down? They already reliably remember fairly complicated table orders which have got to have more bits of entropy than a credit card number. Credit cards handle risk very differently than we do for account passwords. They expect numbers to leak regula…

Nothing stops them. It's just harder, so fewer people could do it.

Re: MagSpoof: Wireless Magstrip Spoofer

#57

Post by anamexis »

FPGAhacker wrote: post #55

You can see whole credit card number in the iron oxide encoding in the picture of the whole backside of the card with electrical tape covering the signature. The author seems to have wiped away the iron oxide but enough residue is left behind that you can still read it.

The card expired in 2017, and is not an American Express, so I imagine it is not a concern.

Re: MagSpoof: Wireless Magstrip Spoofer

#58

Post by frosted-flakes »

wiml wrote: post #42
baal80spam wrote: post #35

Earlier quoted context omitted.

> We still have the stupid policy in restaurants where you hand your card to the server and they walk away with it (their terminals are usually chip), which is something that a lot of foreigners freak out about. And rightfully so! What is stopping them from copying the PAN, expiry date and CVV2? I wouldn't give my card to anyone - that's what portable (wifi/BT) terminals are for.

What stops a server with a good memory from looking at your card as they put it in their terminal and remembering it for the 30 seconds it takes to walk away and note it down? They already reliably remember fairly complicated table orders which have got to have more bits of entropy than a credit card number. Credit cards handle risk very differently than we do for account passwords. They expect numbers to leak regula…

Here in Canada, servers never touch your payment cards. They hand you the wireless card terminal and you insert it yourself. Or you pay on your way out at the front counter at a standard terminal.

Even at drive-through restaurants, the cashier hands you the entire corded terminal through the window (well, most of the time contactless payments are used, in which case they simply hold it out for you to tap your card until they hear a beeeep). During Covid, most places mounted them on the end of a stick, and that practice has continued even once social distancing requirements were lifted.

Re: MagSpoof: Wireless Magstrip Spoofer

#59

Post by 0x457 »

monocularvision wrote: post #53
espenwa wrote: post #49

Earlier quoted context omitted.

Can’t help you with the keys or ID (yet), but I exclusively use the stored cards on my Apple Watch for payment. It is so reliable (in Norway) that I haven’t brought my wallet on normal days in 2+ years. Even on vacation in Northern Europe (Belgium, Netherlands, France, Germany) and on a business trip to the US (California+Texas) this year, I very rarely had to use the physical cards. NFC just works. Everywhere. I sti…

NFC adoption has been improving in the US but still far too many big retailers that still won’t accept it, even when they have the equipment.

Or they accept it in theory, but it's not working for some reason. It's so silly.

Re: MagSpoof: Wireless Magstrip Spoofer

#60

Post by twelvedogs »

wiml wrote: post #42
baal80spam wrote: post #35

Earlier quoted context omitted.

> We still have the stupid policy in restaurants where you hand your card to the server and they walk away with it (their terminals are usually chip), which is something that a lot of foreigners freak out about. And rightfully so! What is stopping them from copying the PAN, expiry date and CVV2? I wouldn't give my card to anyone - that's what portable (wifi/BT) terminals are for.

What stops a server with a good memory from looking at your card as they put it in their terminal and remembering it for the 30 seconds it takes to walk away and note it down? They already reliably remember fairly complicated table orders which have got to have more bits of entropy than a credit card number. Credit cards handle risk very differently than we do for account passwords. They expect numbers to leak regula…

I use my phone it doesn't even show the number, but you can cover the number in case of random servers who can remember 16 digits effortlessly in 2 second

No security is perfect but that's no reason to skip basic easy precautions

Post reply on HN