Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Target's EasySweep – Simplifying Skimmer Detection

tech.target.com

Post reply on HN
Print view View original

71–80 of 151 posts

Re: Target's EasySweep – Simplifying Skimmer Detection

#71

Post by MBCook »

gorkish wrote: post #66
adrianmonk wrote: post #38

Could payment terminals be made with built-in physical countermeasures for detection? Ideas: (1) Terminal has a scale built into its feet/mount. It periodically weighs itself, and if (ignoring fluctuations) it weighs too much, it shuts down. It's hard to build a skimmer that weighs 0 grams. (2) Proximity sensors in key locations on the housing. My smartphone can disable its touchscreen when I hold it against my face,…

Alternatively they could just remove the slot and require self-pay terminals to be contactless. It really makes no sense to me why merchants don't already do this proactively; they are well incentivized: 1) Contactless merchant fees are lower than dip or swipe 2) Payment terminals are cheaper 3) Less fraud/shrink This hunk of plastic from Target is a solution looking for a problem.

They’re not looking for a problem. The problem exists.

“Just use contactless” doesn’t work in the US.

Just yesterday a friend was commenting that he got a new credit card (old card expired) and the new one still doesn’t have contactless. Seems his bank decided it wasn’t worth it.

But that’s not all. Target gift cards don’t have contactless. Don’t think Visa/MC/AmEx gift cards do either. I bet EBT cards don’t, I think a rule requiring them to have chips was just passed.

I know other countries are ahead of us, and that major banks have been issuing chip cards for a while. But there are still a lot of people that leaves out.

And target wants to sell to them.

Re: Target's EasySweep – Simplifying Skimmer Detection

#72

Post by chiph »

CharlesW wrote: post #9
noodlesUK wrote: post #6

How do these skimmers work with chip&pin? I understand how magstripe skimmers work, but my understanding is that chip&pin is an active challenge response protocol. I’d love to hear more.

> How do these skimmers work with chip&pin? My understanding is: They don’t. If you stick to contactless payments, you’re not at risk.

You'll want an RFID blocking wallet or sleeve to supplement this plan. Thieves will use an RFID skimmer and just wave it near your pocket to grab the info off the card when it responds.

Re: Target's EasySweep – Simplifying Skimmer Detection

#73

Post by dotBen »

Dah00n wrote: post #42
thetwentyone wrote: post #24

Since it's only implied how it works and there seems to be some confusion in the comments. It seems like the technique is to simply create a very form-fitting insert which won't fit properly if some device is overlaid onto the machine. The insert is not left in the device, but is just used for a quick in-and-out check.

And it is patented..

This is a good thing, some troll could patent it and then deny anyone else the right to use it.

Re: Target's EasySweep – Simplifying Skimmer Detection

#74

Post by Terr_ »

whoopdedo wrote: post #69
js2 wrote: post #16

Earlier quoted context omitted.

Even with EMV transactions, they are apparently able to get the card # which is transmitted in clear text by the chip. And the PIN from the keyboard overlay for debit transactions. Later they can clone the card # onto a fake mag stripe card and use the fake card for card-present purchases. They probably cannot make card-not-present (online) purchases since I don't think they can get the CVV. https://krebsonsecurity.c…

Some skimmers have a camera to capture an image of the card's CVV as well as another copy of the name/number/date.

Here I was thinking that my near-illegibly worn-away CVV was a reason to get a replacement card... but instead it's a surprise security bonus! :p

Actually, I spoke too soon... the signature-strip has been worn away too and now that I really look at it, I can make out the word "Void" underneath.

Re: Target's EasySweep – Simplifying Skimmer Detection

#75

Post by MBCook »

loeg wrote: post #54
kotaKat wrote: post #11

Earlier quoted context omitted.

The US still has a heavy reliance on magstripe, even though we rolled out EMV, and many cards still have it, and you can just take a stripe dump regardless. The actual user of the stolen card dump will cause the terminal to allow a magstripe fallback (typically with a bad chip on a fake card that won't read) -- "aw jeez my stupid chip isn't reading" is still every much a valid excuse to a cashier to go to magstripe.

I think there are also just lots of POS systems in the US that aren't on EMV yet. Major retailers are on EMV but random old rural businesses probably aren't.

Plus lots of cards without EMV at all, usually gift cards or until recently EBT.

Re: Target's EasySweep – Simplifying Skimmer Detection

#76

Post by gorkish »

loeg wrote: post #55
delfinom wrote: post #43

Earlier quoted context omitted.

I would imagine there's something wrong with it if Target isn't just buying it Though it could just be cost given that Target could just pay for a plastic injection mold overseas and then pay peanuts yearly to make a 60k batch for their yearly renewal they mention, compared to $20*60k each time

Yeah. $8-24 a unit vs "under $1." Although 60,000 x 8 still isn't a huge amount of money.

This little micro-arms-race to develop and patent a plastic wedge that doesn't need to exist in the first place is ridiculous. The irony is that there is something of a perverse incentive not to solve the actual problem now that such a big industry has emerged to to combat it. If they wanted to build secure card payment terminals they would build them.

Re: Target's EasySweep – Simplifying Skimmer Detection

#77

Post by hackmiester »

callalex wrote: post #65
whartung wrote: post #40

Earlier quoted context omitted.

It annoys me that none of the gas stations I use have the "tap to pay" that actually works. They seem to have the sensor on the pumps, but they never work.

My pet theory is that transitioning to wireless payment also opens up user expectations for the vendor to participate in way more payment networks than just Visa/MC/Discover/AmEx. If you have a wireless reader but no agreement with Apple Pay, or Google Pay, or Samsung Pay, or WePay, or WhateverSomeNewMBACrap users will start putting in reports that the reader is “broken”.

You don't have to have an agreement with Apple or Google to accept Apple Pay or Google Pay. If the customer holds a Visa then the phone presents a Visa to the reader. There is no special thing you have to do to accept those payments.

Re: Target's EasySweep – Simplifying Skimmer Detection

#78

Post by MBCook »

chiph wrote: post #72
CharlesW wrote: post #9

Earlier quoted context omitted.

> How do these skimmers work with chip&pin? My understanding is: They don’t. If you stick to contactless payments, you’re not at risk.

You'll want an RFID blocking wallet or sleeve to supplement this plan. Thieves will use an RFID skimmer and just wave it near your pocket to grab the info off the card when it responds.

Has anyone ever shown a practical attack for EMV contactless?

I know the old mag stripe emulation was vulnerable, but EMV contactless shouldn’t hand out the card number and uses cryptographic signatures. You’d have to capture and play back a transaction (not randomly scan a card) and there are time stamps and transaction counters that would be wrong and the terminal ID wouldn’t match.

Re: Target's EasySweep – Simplifying Skimmer Detection

#79

Post by gorkish »

MBCook wrote: post #71
gorkish wrote: post #66

Earlier quoted context omitted.

Alternatively they could just remove the slot and require self-pay terminals to be contactless. It really makes no sense to me why merchants don't already do this proactively; they are well incentivized: 1) Contactless merchant fees are lower than dip or swipe 2) Payment terminals are cheaper 3) Less fraud/shrink This hunk of plastic from Target is a solution looking for a problem.

They’re not looking for a problem. The problem exists. “Just use contactless” doesn’t work in the US. Just yesterday a friend was commenting that he got a new credit card (old card expired) and the new one still doesn’t have contactless. Seems his bank decided it wasn’t worth it. But that’s not all. Target gift cards don’t have contactless. Don’t think Visa/MC/AmEx gift cards do either. I bet EBT cards don’t, I think…

I was suggesting "Just use contactless" for customer accessible payment terminals. Want to use something less secure and more likely to result in fraud? You can hand your card to the cashier or walk inside instead of paying at the pump, just like you do with any non-card payment already.

The EBT, gift card, and lazy small banks would get their act together pretty damn quick, I'd wager.

Re: Target's EasySweep – Simplifying Skimmer Detection

#80

Post by MBCook »

js2 wrote: post #16
noodlesUK wrote: post #6

How do these skimmers work with chip&pin? I understand how magstripe skimmers work, but my understanding is that chip&pin is an active challenge response protocol. I’d love to hear more.

Even with EMV transactions, they are apparently able to get the card # which is transmitted in clear text by the chip. And the PIN from the keyboard overlay for debit transactions. Later they can clone the card # onto a fake mag stripe card and use the fake card for card-present purchases. They probably cannot make card-not-present (online) purchases since I don't think they can get the CVV. https://krebsonsecurity.c…

EMV doesn’t transmit the full card number in the clear. I don’t know how they’d get it. IIRC the track data is sanitized, but maybe it wasn’t always. I’m not even sure all cards give it in a modern EMV transaction.

The old mag stripe emulation mode of contactless did, but that’s legacy and many places won’t accept it and cards won’t do it.

However the good old “break the slot or chip reader so they have to use mag stripe and scan the card things the old fashioned way” technique still works great.

Post reply on HN