Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MagSpoof – wireless credit card/magstripe spoofer

github.com

Post reply on HN
Print view View original

111–115 of 115 posts

Re: MagSpoof – wireless credit card/magstripe spoofer

#111

Post by JimmaDaRustla »

JaggedJax wrote: post #3

I was very surprised to learn there's no check for Chip and Pin requirements beyond what the magstripe requests. I naively assumed if the card had that feature the terminal could force it to be used. What would happen with the other fields he mentions, like whether or not you can withdraw cash with the card?

There is a sentinel character on the mag stripe which identifies the card as chip and pin. As mentioned in the README of this repo, it can be disabled - for the purposes of backwards compatibility, this is a necessary evil.

Fortunately, it is easy to detect! The terminal will send the magstripe data online when authorizing the transaction, and the backend systems will identify the corruption in magstripe data and identify it as fraud.

Re: MagSpoof – wireless credit card/magstripe spoofer

#112

Post by maaarghk »

pornel wrote: post #2

There's more gems in there, e.g. a couple of Amex vulnerabilities: https://github.com/samyk/magspoof#american-express-card-numb... > I found a global pattern that allows me to accurately predict American Express card numbers by knowing a full card number, even if already reported lost or stolen. > This means if I were to obtain your Amex card and you called it in as lost or stolen, the moment you get a new card, I kn…

This also happens for me, UK, Bank of Scotland. Actually I find it to be a feature as I have my card number memorized and whenever I need a replacement I only need to remember 5 or maybe 6 new digits (including the three CV2 digits). I wouldn't really call it a vulnerability due to the CV2 being randomized and the fact we have chip and PIN over here.

Re: MagSpoof – wireless credit card/magstripe spoofer

#114

Post by rconti »

dylz wrote: post #92
pjc50 wrote: post #90

Earlier quoted context omitted.

You're a US resident with a US card? As a UK resident with a UK card it's been a long time since I swiped or signed. I think you must have the "require signature always" bit set on your cards because someone in the issuing chain doesn't trust EMV.

IIRC, US uses chip and signature 99% of the time, not chip and pin. I don't think I have a single card that supports pin.

Correct. I HAVE a PIN for purchasing, but the card is set to prefer signature so I end up having to sign unless I'm purchasing somewhere without signature capability (eg, an automated kiosk). And yeah, US resident, US card.

Re: MagSpoof – wireless credit card/magstripe spoofer

#115

Post by rconti »

celticninja wrote: post #100
rconti wrote: post #79

Earlier quoted context omitted.

I can't claim to spend a ton of time in a huge variety of countries, but in the past year I've been to Iceland, England, Wales, Scotland, Italy, France, and New Zealand, and I can't remember anywhere I had to use the EMV chip in my credit cards except places like parking garages that didn't have the physical facility for a mag stripe swipe. Every retailer terminal could read a magstripe. More annoyingly, whether I sw…

not sure where in the UK you were spending/shopping but I live in the UK and all card readers require chip and pin and there is no signature required. Whilst the readers have a swipe facility if your card has a chip you are required to use it. Perhaps because you were using an international card it allowed you to use the swipe facility although I have no idea why you would choose that as it is significantly slower.

It's the signature that's the slow part. The swipe takes, what, 1/4 second vs perhaps 2 seconds for the dip?
Post reply on HN