MagSpoof: Wireless Magstrip Spoofer • Hacker News Board

Re: MagSpoof: Wireless Magstrip Spoofer

#61

Post by jeffbee » Sat, Dec 03, 2022, 11:31 PM UTC

isoprophlex wrote: post #13

amluto wrote: post #11

Credit card security is comically poor. Off the top of my head: 1. An NFC-enabled EMV card will happily reveal its entire account number and expiration date over NFC with no authentication whatsoever. I don’t know whether the CVV comes along, but I wouldn’t be surprised if it did. 2. (As mentioned in the article) issuers accept transactions from EMV (chip)-capable readers that nominally originate from EMV-capable car…

> [...] found a global pattern that allows me to accurately predict American Express card numbers by knowing a full card number, even if already reported lost or stolen. > This means if I were to obtain your Amex card and you called it in as lost or stolen, the moment you get a new card, I know your new credit card number. Criminally hilarious.

I don't see how this is specific to AMEX. When my USAA Visa got cancelled because of yet another merchant system leak, they sent me another card that was just sequential with the cancelled one up to the 15th digit (the 16th is a check digit).

Re: MagSpoof: Wireless Magstrip Spoofer

#62

Post by p_l » Sat, Dec 03, 2022, 11:35 PM UTC

amluto wrote: post #50

lxgr wrote: post #33

Earlier quoted context omitted.

> An NFC-enabled EMV card will happily reveal its entire account number and expiration date over NFC with no authentication whatsoever. EMV was enabled with the intention of replacing magnetic stripe payments quickly. Together with 3DS on the online payment side, this would have effectively made a card number by itself worthless. Unfortunately this hasn't happend (except for mobile wallets using tokenization like App…

> I'd cut the original designers some slack. I'm willing to cut the original designers some slack. I'm not really willing to cut the industry slack for not fixing it. It's been years. Heck, EMV had been widely deployed in Europe for years before it showed up in the US. > Another reason: How would you even implement authentication? There are millions of terminals out there, operated by at least hundreds of different s…

I do not recall all details, but EMV implementation in USA was different in terms of configuration applied, especially in terms of what data was required to auth the transaction, mainly due to some intercorporate politics iirc

Re: MagSpoof: Wireless Magstrip Spoofer

#63

Post by bloggie » Sat, Dec 03, 2022, 11:54 PM UTC

ford wrote: post #5

I long for the day I can carry my phone or watch without needing keys or wallet. The fact that most adults carry at least 3 things (keys/phone/wallet) at all times in 2022 is crazy.

I’ve long wanted to do this, as a kid I added NFC (at the time, simply RFID) door locking to my 1989 jetta so I didn’t have to fumble for keys. It turns out I do live in the future. I don’t lock my house, so that’s one less key right away, but there are some keyless door locks on the market if you still need them, and those could probably be automated with something like home assistant. I have a tesla that uses a phone for a key. Work has a key card, it’s a proprietary system but I could shrink one into a ring or something. I don’t carry cash, but instead use a magnetic wallet on my phone from popsockets (apple makes one too) for physical cards, although I mostly use apple pay. No digital driver’s license here yet however, so I needed a place to keep cards anyway. In Seoul the metro pass is a simple NFC sticker that you place on the back of your phone. So, no keys for me! Everything is built around the phone, which is fine until I lose access to it…

Re: MagSpoof: Wireless Magstrip Spoofer

#64

Post by themagician » Sun, Dec 04, 2022, 12:14 AM UTC

amluto wrote: post #11

Credit card security is comically poor. Off the top of my head: 1. An NFC-enabled EMV card will happily reveal its entire account number and expiration date over NFC with no authentication whatsoever. I don’t know whether the CVV comes along, but I wouldn’t be surprised if it did. 2. (As mentioned in the article) issuers accept transactions from EMV (chip)-capable readers that nominally originate from EMV-capable car…

For #5, AMEX asks you if you want to override this, at least for business cards. It’s all or nothing though. But if you want all subs or recurring billing to terminate on a lost or stolen card it is an option.

Re: MagSpoof: Wireless Magstrip Spoofer

#65

Post by hamburglar » Sun, Dec 04, 2022, 12:16 AM UTC

grishka wrote: post #45

amluto wrote: post #11

Credit card security is comically poor. Off the top of my head: 1. An NFC-enabled EMV card will happily reveal its entire account number and expiration date over NFC with no authentication whatsoever. I don’t know whether the CVV comes along, but I wouldn’t be surprised if it did. 2. (As mentioned in the article) issuers accept transactions from EMV (chip)-capable readers that nominally originate from EMV-capable car…

> 2. (As mentioned in the article) issuers accept transactions from EMV (chip)-capable readers that nominally originate from EMV-capable cards without requiring the chip to be used. Last time I tried swiping my card — and that was ages ago — the terminal displayed something to the effect of "this card has a chip, please insert the chip". > 3. The information leaked in #1 is enough to buy things online (as long as the…

> Last time I tried swiping my card — and that was ages ago — the terminal displayed something to the effect of "this card has a chip, please insert the chip".

The problem is that the way the terminal knows "this card has a chip" is that information is encoded on the magstripe. So rewriting the magstripe can just disable that functionality. I assume the merchant could configure their terminals to insist on using the chip no matter what, but it's extremely rare in the US.

One thing I don't get is how other countries require chip+pin for all transactions, but a high percentage of the US terminals I read are comically unreliable for using the chip. If we switched to "always require chip", half my typical transactions would fail because of broken chip readers. Why is there such a discrepancy in the quality of the terminals here vs elsewhere?

Re: MagSpoof: Wireless Magstrip Spoofer

#66

Post by oceanplexian » Sun, Dec 04, 2022, 12:30 AM UTC

ford wrote: post #5

I long for the day I can carry my phone or watch without needing keys or wallet. The fact that most adults carry at least 3 things (keys/phone/wallet) at all times in 2022 is crazy.

It’s a great idea until the battery in your devices fail and you’re stranded somewhere with no ID, no way to communicate, and no money for a train ticket.

Re: MagSpoof: Wireless Magstrip Spoofer

#67

Post by brysonreece » Sun, Dec 04, 2022, 12:54 AM UTC

bloggie wrote: post #63

ford wrote: post #5

I long for the day I can carry my phone or watch without needing keys or wallet. The fact that most adults carry at least 3 things (keys/phone/wallet) at all times in 2022 is crazy.

I’ve long wanted to do this, as a kid I added NFC (at the time, simply RFID) door locking to my 1989 jetta so I didn’t have to fumble for keys. It turns out I do live in the future. I don’t lock my house, so that’s one less key right away, but there are some keyless door locks on the market if you still need them, and those could probably be automated with something like home assistant. I have a tesla that uses a pho…

My personal example of this, allowing me to cut down on my daily carry:

- Cards stored in Apple Wallet

- Health/Vehicle insurance card available via an app

- Driver's License available via state-issued app

- FlexNT NFC implants located in both of my middle fingers, allowing me to lock/unlock my house using Home Assistant + a scanner I built based on an ESP32 & PN532.

Sure, I'm more reliant on the device in my pocket - which can definitely be an issue if it's dead. However, I work from home and am rarely in situations where that predicament would arise.

Re: MagSpoof: Wireless Magstrip Spoofer

#68

Post by lxgr » Sun, Dec 04, 2022, 1:12 AM UTC

amluto wrote: post #51

lxgr wrote: post #38

Earlier quoted context omitted.

A better comparison would be the client JavaScript rejecting a four-character password, because it knows the backend policy requires at least eight. Done right (without e.g. checking for "key down" events to thwart password managers...), this could could actually improve security somehwat by avoiding whatever the user entered (maybe a low-entropy PIN?) hitting the network or backend, besides providing for a faster er…

> It avoids an entire round trip to the issuer's backend and back, which are often still somewhat expensive and slow, given the legacy systems and connections involved. Not if done both client-side and server-side. Right now, if I swipe my magnetic stripe, then terminal will reject it if the stripe has the magic bit set. If the magic bit is clear, the terminal will (eventually, but usually while the customer waits) s…

And that is exactly what happens :)

Re: MagSpoof: Wireless Magstrip Spoofer

#69

Post by grishka » Sun, Dec 04, 2022, 1:30 AM UTC

hamburglar wrote: post #65

grishka wrote: post #45

Earlier quoted context omitted.

> 2. (As mentioned in the article) issuers accept transactions from EMV (chip)-capable readers that nominally originate from EMV-capable cards without requiring the chip to be used. Last time I tried swiping my card — and that was ages ago — the terminal displayed something to the effect of "this card has a chip, please insert the chip". > 3. The information leaked in #1 is enough to buy things online (as long as the…

> Last time I tried swiping my card — and that was ages ago — the terminal displayed something to the effect of "this card has a chip, please insert the chip". The problem is that the way the terminal knows "this card has a chip" is that information is encoded on the magstripe. So rewriting the magstripe can just disable that functionality. I assume the merchant could configure their terminals to insist on using the…

Huh? I don't know what's the situation now because I hardly use the chip any more, I mostly tap (the card itself, we no longer have Google Pay), but I don't remember a single time when the chip wouldn't work. The terminals around here look like any mass-produced electronic device, nothing special about them. Though they are old — I do sometimes see newer fancier all-touchscreen ones when I travel to other countries.

There's also one weird model with a secondary keypad on a curly cable that they usually put on the counter, with the main unit somewhere out of sight. It has a small screen and can accept taps. But if you want to use the chip, you have to hand your card over to the cashier to have them insert it into the main unit.

> So rewriting the magstripe can just disable that functionality.

That feels strange to me. If I were designing this protocol, it'd have to first ask the issuing bank whether using the magstripe is ok.

Re: MagSpoof: Wireless Magstrip Spoofer

#70

Post by atyppo » Sun, Dec 04, 2022, 1:47 AM UTC

Scoundreller wrote: post #21

isoprophlex wrote: post #13

Earlier quoted context omitted.

> [...] found a global pattern that allows me to accurately predict American Express card numbers by knowing a full card number, even if already reported lost or stolen. > This means if I were to obtain your Amex card and you called it in as lost or stolen, the moment you get a new card, I know your new credit card number. Criminally hilarious.

I suspect this has already been exploited in South America with at least one North American banks' Amex cards. Can't get into too much detail, but the pieces fit.

They wouldn’t have fixed this since 2015? Seems highly dubious to me.