25 ms·

MagSpoof – wireless credit card/magstripe spoofer

541 points by pornel 11y ago

Smushman 11y ago
This is too damn cool to pass up - talk about convenience... I would have been willing to pay for such an item! Yes everyone is going to run around and scream 'security!!' when they realize how ridiculously trivial this process always has been, but it does not change facts - it has always been this easy, but this is a new way to highlight that fact.
pornel 11y ago
There's more gems in there, e.g. a couple of Amex vulnerabilities: https://github.com/samyk/magspoof#american-express-card-number-prediction https://github.com/samyk/magspoof#american-express-card-numb... > I found a global pattern that allows me to accurately predict American Express card numbers by knowing a full card number, even if already reported lost or stolen. > This means if I were to obtain your Amex card and you called it in as lost or stolen, the moment you get a new card, I know your new credit card number.
- toomuchtodo 11y ago
  This makes sense. I've had my Amex replaced several times due to detected fraud, and the last digits are always incremented in a predictable pattern.
  - nailer 11y ago
    If it's the same as it was back in the days of Credit Master 4 for DOS, it bumps up by eights and sixteens.
    - rbritton 11y ago
      I just got an Amex replaced about a week ago and the 4th digit from the end was the one incremented.
- sjtgraham 11y ago
  Anyone who has an Amex would notice this immediately. The last digit is the Luhn check digit and the digit before that increments each time a card is issued, starting from 0.
  - viraptor 11y ago
    Either it's only a specific kind of amex, or it's not starting from 0, or this is incorrect information. I've got 2 AMEX cards - one reissued and ends with 0, another issued the first time and ends with non-0. (I'm ignoring the check digit)
    - sjtgraham 11y ago
      I've just pulled a load of expired my Amex cards. It looks like I got the incrementing digit wrong. On my cards it's the 4th from last that increments. UK Amex FWIW.
- onewaystreet 11y ago
  This is by design: https://en.wikipedia.org/wiki/Bank_card_number https://en.wikipedia.org/wiki/Bank_card_number
  - mynameisvlad 11y ago
    I don't see how this is by design since it only seems to be a vulnerability with Amex and your link doesn't really talk about it.
- ryan-c 11y ago
  Someone I know said they had their card cloned and when the CSR went to reissue there were already attempts to use the new number, so it seems like this may have already been known by fraudsters.
  - segmondy 11y ago
    It's known, I know someone that has experienced the same issue.
- Johnny555 11y ago
  I got a replacement Amex card (after some fraudulent charges) 4 or 5 months ago, and it had an all new number, not just a few digits. This card also had the embedded chip, so that may be why it had the new number.
  - bro-stick 11y ago
    The chip is being rolled out to keep up with VISA/Mastercard's deployment of chip. Note however that chip transactions are far slower than proximity or magstripe uses, making it completely redundant except for a malfunctioning magstripe reader. It would have been as much software update to have implemented PIN and would've brought security to the level of ATM cards. The generation and provisioning of card numbers is limited by other systems which includes fraud detection, account processing, auditing and other backend systems.
    - codfrantic 11y ago
      Most places where you can use a credit card in Europe require you to use the chip (usually with a PIN).
      - Johnny555 11y ago
        I wouldn't say "most places" -- after a recent trip to Europe (Ireland, England and France), the only place we couldn't use our "signature-only" card was a train ticket vending machine, every business we went to had a magnetic stripe reader and knew they had to use it when the card had no chip. (my wife's no-foreign-transaction-fee card had no chip, so we tried to use that one as much as possible) In every case were I used a USA chip card (with no PIN), the card reader prompted for a signature, so it was no problem. Though I really don't understand why USA issuers and merchants went with a chip-only system, seems like it would have been trivial to allow PIN too. Though even Chip and PIN only fights a small portion of the fraud - every time I've experienced credit card fraud, it's been with internet purchases. Amex used to let me generate a temporary card number for each merchant, I used that all the time, but they dropped the service for some reason.
    - 11y ago
- maaarghk 11y ago
  This also happens for me, UK, Bank of Scotland. Actually I find it to be a feature as I have my card number memorized and whenever I need a replacement I only need to remember 5 or maybe 6 new digits (including the three CV2 digits). I wouldn't really call it a vulnerability due to the CV2 being randomized and the fact we have chip and PIN over here.
JaggedJax 11y ago
I was very surprised to learn there's no check for Chip and Pin requirements beyond what the magstripe requests. I naively assumed if the card had that feature the terminal could force it to be used. What would happen with the other fields he mentions, like whether or not you can withdraw cash with the card?
- q3k 11y ago
  IIRC from some resarch I did, a decent card provider will reject a magstripe transaction from a terminal with EMV capability if a card is known to also be EMV capable... At least, it could in theory.
  - stanmancan 11y ago
    I live in Canada and that's what happens with all of my visa/debit chip cards. If you attempt to swipe your card and it, as well as the terminal, are chip enabled then it gives you an error and asks you to insert your card into the terminal.
    - JaggedJax 11y ago
      That is triggered by the magstripe though. The point here is you can trick the reader by turning off that feature on the magstripe and the reader doesn't do any additional check on whether EMV should be required.
      - noddingham 11y ago
        Based upon my knowledge of EMV liability, the merchant would still be clear from fraudulent charges if they had an EMV reader. If the device tells the reader it can't do chip & pin, then the buyer is the least secure part of the transaction.
      - TeMPOraL 11y ago
        Not in all cases, I believe. For instance, to use my debit card in China, where a lot of payments is still done via magstripe, I have to call my bank and ask them to enable magstripe transactions for me in their system. Otherwise, the bank will keep rejecting transaction attempts.
brokentone 11y ago
It's stunning how bad many card issuing systems are (as noted in the post, AmEx et al). When I was in college all of the administrative buildings, student common areas as well as many of the student housing areas were controlled by magstripe. Meals were also kept track of by card. I knew from people losing their cards which continued working some places but not others there was a relationship in the issuing. I got a reader, decoded the card (zeropadded student ID, issue number, and XOR checksum). I found other places to find the student ID number, and could enumerate a few issue numbers. I built this spoofer: http://www.instructables.com/id/Arduino-Magstripe-Emulator/ http://www.instructables.com/id/Arduino-Magstripe-Emulator/ Then I could get into my friend's apartments (as a POC with their permission of course). I disclosed and got a thank you (I built a good relationship with my IT dept over the years), but never figured out if they fixed it.
- sliverstorm 11y ago
  It could have been "good enough". Remember the whole "keeps an honest man honest" bit. Retooling their security system might cost a lot more than some spoofed meals, and we all know doors & tumbler locks are never impervious.
  - saganus 11y ago
    I think the problem with these systems is that "good enough" should be much more "gooder" than it is, due to being a solved problem for most cases. For example, if you happen to need a unique ID for each card, and you roll your own "random id generator" you might happen to encounter pitfalls that would've been solved by using UUIDs. Or you try to get some sort of hash value from the card info (to verify validity or whatever) and instead of using a known hashing algorithm you try to roll your own. And I would guess a long list of etceteras. So when a system that should be for the most part trivial to implement correctly is full of these holes then people like GP will start poking around and ultimately start finding a lot of issues that would make it actually not "good enough". I mean sure, keys are just there to keep honest people out, but if you can use a standard key that would foil both honest AND a few opportunistic dishonest people then why are you instead trying to use your own "custom key" that happens to be much easier to defeat? Especially if said standard key is not really that much harder to implement.
guyzero 11y ago
This is how Samsung Pay works, right? edit: And LoopPay which I guess Samsung acquired.
- mschuster91 11y ago
  IIRC all these payment solutions work with NFC communications. I have a couple of NFC-compatible banking cards.
  - anonova 11y ago
    Samsung Pay's pitch is that it is (mostly) backwards compatible with existing card readers. When NFC fails, it does fallback to magnetic strip emulation.
    - deleted 11y ago
      [deleted]
      - atrilumen 11y ago
        Sounds like you didn't read the post.
      - anonova 11y ago
        It's pretty much the same as what's being described in the article. Samsung calls it Magnetic Secure Transmission (MST): http://www.samsung.com/us/support/answer/ANS00043865/997410383/ http://www.samsung.com/us/support/answer/ANS00043865/9974103...
        leni536 11y ago
        > Magnetic Secure Transmission They dare to call this secure...
        the_mitsuhiko 11y ago
        It is because it uses a token not the PAN
deleted 11y ago
[deleted]
oxplot 11y ago
Hmm, I'm very surprised that magstripe readers don't have sensors that detect physical presence of a card, even to this date. But regardless, the main point for me was how trivially one could downgrade the security by setting the bit about Chip/PIN capability off.
- rplnt 11y ago
  I'm surprised magstripe readers still exist. I don't think I've used one in years. They are often there.. but I don't see their purpose. Last non-chip card I've seen was maybe 12 years ago.
  - fluxquanta 11y ago
    You're obviously not in America, then. Out of the 6 cards in my wallet only 2 even have a chip yet (my bank promises my most frequently used card has a chip equivalent in the mail).
peteretep 11y ago
One day in the future, Samy (the creator of this) will stop being the coolest person on the internet, but today isn't that day. Previous projects include: The Samy MySpace worm: https://en.wikipedia.org/wiki/Samy_%28computer_worm%29 https://en.wikipedia.org/wiki/Samy_%28computer_worm%29 EverCookies: http://samy.pl/evercookie/ http://samy.pl/evercookie/ SkyJack: https://en.wikipedia.org/wiki/SkyJack https://en.wikipedia.org/wiki/SkyJack And so much more... http://samy.pl/ http://samy.pl/ https://en.wikipedia.org/wiki/Samy_Kamkar https://en.wikipedia.org/wiki/Samy_Kamkar
- saganus 11y ago
  Oh wow... shit... it's the same guy for all of these indeed. I think I would've been super proud of myself just for accomplishing even one of these things... I guess these are the type of guys that would start to approach the definition of a modern polymath maybe? Not saying he is one necessarily (or that he isn't), but what would examples of modern polymaths are there? considering a lot of the fields to be mastered need enough detail and knowledge that it seems hard to find one.
  - eggy 11y ago
    Yes, he has quite a resume there. However, maybe I'm just older, but my ideal polymath is not just coding/hacking electronics. I personally think it should be those plus knowing more diverse fields and skills such as: applied mathematics, celestial navigation, biohacking, chemistry, milling/lathe work, building machinery from scratch by smelting and casting [1], animatronics, boatbuilding, horology, mechatronics, music, languages etc... I picked these things, because they are things I personally strive to keep learning. They are not everybody's list. I guess today the emphasis is on coding/small electronics because of the world it opens up to you (except those things that are purely mechanical or require other skills). In any case, my hat is off to him. Impressive! [1] http://gingerybooks.com/
    - saganus 11y ago
      Do you have any examples of someone that would fit this description? I think a modern polymath could look a bit different than the ones in the classical sense. To be able to make contributions to the fields you mentioned, I guess you would need more years of study than anyone could dedicate to, just because those fields seem to be very hard, especially considering the degree at which nowadays we would consider someone proficient in any of these. Well, I'm not sure, I'm actually wondering. For your particular definition, or something close to it, who would you say it gets close?
Animats 11y ago
It should be possible to detect this with a reader firmware upgrade, if the reader reads more than one track on the card. If both read heads are showing similar signals, the signal isn't coming from a normal card.
- dfox 11y ago
  That depends on whether the terminal has physical capability to read more than one track of card data. I have Ingenico Alphira terminal in my junk box and from casual inspection it looks like the magnetic head has two coils, but while there are footprints for two sense amplifiers, only one is populated.
xseven 11y ago
So much for Coin
- scentedmeat 11y ago
  It's actually mentioned that this was to overcome poor performance with Coin.
0x2015 11y ago
I recall people demonstrating something similar this with passports at defcon some years back from quite the distance. Picking up credit card data and ids wirelessly is definitely not new. This is why I use small magnetic / RFID blocking case while traveling.
- corin_ 11y ago
  This submission isn't about that.
vermilingua 11y ago
Can anyone explain the legality of building and using one of these (for your own cards, obviously)? I know there are similar appliances, but do they need to be accredited?
mistercow 11y ago
> What's incredible is that the magstripe reader requires no form of wireless receiver, NFC, or RFID Another way of looking at it is that the magstripe reader is a wireless receiver. It just usually works with signals so weak that they can only be transmitted a miniscule distance.
guruslead 11y ago
need a hacker? for hacking of mails, grades, records, credit, facebook, whatsapp, and all forms of hacking, contact the hack guru on his email. demon_teco@gmx.com
guruslead 11y ago
Need a hacker?For your hacking of grades, database, fixing of credit, whatsapp, facebook, clearing of criminal records, contact the hack guru demon_teco@gmx.com dude is good.
amydav 11y ago
this is not an advert, but contact waltsteph82@gmail.com for your hacking related issues or text 601 866 5203
guruslead 11y ago
Need a hacker?For your hacking of grades, database, fixing of credit, whatsapp, facebook, clearing of criminal records, contact the hack guru demon_teco@gmx.com . we also track cheating spouses, locations, messages, call records and all forms of hacking demon_teco@gmx.com
the_mitsuhiko 11y ago
The shitty thing is that because of Samsung Pay it's impossible for a merchant to distinguish a cloned magstripe from a legitimate samsung pay transaction using MST. I wrote a bit about this a few months ago: http://lucumr.pocoo.org/2015/8/31/the-thing-about-samsung-pay/ http://lucumr.pocoo.org/2015/8/31/the-thing-about-samsung-pa...
deutronium 11y ago
I wrote a little tool that decodes the data optically from a credit card, using a photo of the credit card and an iron solution. https://www.anfractuosity.com/projects/optical-magnetic-stripe-reading/ https://www.anfractuosity.com/projects/optical-magnetic-stri... I'm planning on seeing if I can decode data from higher density mediums with the same approach, when I can get my hands on some iron nanoparticles.
JimmaDaRustla 11y ago
It mentions "disabling chip and pin", meaning it will convert the sentinel character on the magnetic stripe which tells the terminal that it is a chip card. By disabling the sentinel character and using this on a chip enabled terminal, the financial institute (BASE24) SHOULD decline the transaction because the Track 2 data will be incorrect. Edit: I meant on an EMV compliant terminal. Edit: Also, that is considered fraud and your best not testing it, unless you like the prison environment.
Justin_K 11y ago
I found Josh's code a couple years ago and had this very project working. Not as well documented but the concept has been around for some time. https://github.com/joshlf/magspoof https://github.com/joshlf/magspoof

541 points by pornel 11y ago

This is too damn cool to pass up - talk about convenience... I would have been willing to pay for such an item! Yes everyone is going to run around and scream 'security!!' when they realize how ridiculously trivial this process always has been, but it does not change facts - it has always been this easy, but this is a new way to highlight that fact.

pornel 11y ago

There's more gems in there, e.g. a couple of Amex vulnerabilities: https://github.com/samyk/magspoof#american-express-card-number-prediction https://github.com/samyk/magspoof#american-express-card-numb... > I found a global pattern that allows me to accurately predict American Express card numbers by knowing a full card number, even if already reported lost or stolen. > This means if I were to obtain your Amex card and you called it in as lost or stolen, the moment you get a new card, I know your new credit card number.

toomuchtodo 11y ago
This makes sense. I've had my Amex replaced several times due to detected fraud, and the last digits are always incremented in a predictable pattern.
- nailer 11y ago
  If it's the same as it was back in the days of Credit Master 4 for DOS, it bumps up by eights and sixteens.
  - rbritton 11y ago
    I just got an Amex replaced about a week ago and the 4th digit from the end was the one incremented.
sjtgraham 11y ago
Anyone who has an Amex would notice this immediately. The last digit is the Luhn check digit and the digit before that increments each time a card is issued, starting from 0.
- viraptor 11y ago
  Either it's only a specific kind of amex, or it's not starting from 0, or this is incorrect information. I've got 2 AMEX cards - one reissued and ends with 0, another issued the first time and ends with non-0. (I'm ignoring the check digit)
  - sjtgraham 11y ago
    I've just pulled a load of expired my Amex cards. It looks like I got the incrementing digit wrong. On my cards it's the 4th from last that increments. UK Amex FWIW.
onewaystreet 11y ago
This is by design: https://en.wikipedia.org/wiki/Bank_card_number https://en.wikipedia.org/wiki/Bank_card_number
- mynameisvlad 11y ago
  I don't see how this is by design since it only seems to be a vulnerability with Amex and your link doesn't really talk about it.
ryan-c 11y ago
Someone I know said they had their card cloned and when the CSR went to reissue there were already attempts to use the new number, so it seems like this may have already been known by fraudsters.
- segmondy 11y ago
  It's known, I know someone that has experienced the same issue.
Johnny555 11y ago
I got a replacement Amex card (after some fraudulent charges) 4 or 5 months ago, and it had an all new number, not just a few digits. This card also had the embedded chip, so that may be why it had the new number.
- bro-stick 11y ago
  The chip is being rolled out to keep up with VISA/Mastercard's deployment of chip. Note however that chip transactions are far slower than proximity or magstripe uses, making it completely redundant except for a malfunctioning magstripe reader. It would have been as much software update to have implemented PIN and would've brought security to the level of ATM cards. The generation and provisioning of card numbers is limited by other systems which includes fraud detection, account processing, auditing and other backend systems.
  - codfrantic 11y ago
    Most places where you can use a credit card in Europe require you to use the chip (usually with a PIN).
    - Johnny555 11y ago
      I wouldn't say "most places" -- after a recent trip to Europe (Ireland, England and France), the only place we couldn't use our "signature-only" card was a train ticket vending machine, every business we went to had a magnetic stripe reader and knew they had to use it when the card had no chip. (my wife's no-foreign-transaction-fee card had no chip, so we tried to use that one as much as possible) In every case were I used a USA chip card (with no PIN), the card reader prompted for a signature, so it was no problem. Though I really don't understand why USA issuers and merchants went with a chip-only system, seems like it would have been trivial to allow PIN too. Though even Chip and PIN only fights a small portion of the fraud - every time I've experienced credit card fraud, it's been with internet purchases. Amex used to let me generate a temporary card number for each merchant, I used that all the time, but they dropped the service for some reason.
  - 11y ago
maaarghk 11y ago
This also happens for me, UK, Bank of Scotland. Actually I find it to be a feature as I have my card number memorized and whenever I need a replacement I only need to remember 5 or maybe 6 new digits (including the three CV2 digits). I wouldn't really call it a vulnerability due to the CV2 being randomized and the fact we have chip and PIN over here.

JaggedJax 11y ago

I was very surprised to learn there's no check for Chip and Pin requirements beyond what the magstripe requests. I naively assumed if the card had that feature the terminal could force it to be used. What would happen with the other fields he mentions, like whether or not you can withdraw cash with the card?

q3k 11y ago
IIRC from some resarch I did, a decent card provider will reject a magstripe transaction from a terminal with EMV capability if a card is known to also be EMV capable... At least, it could in theory.
- stanmancan 11y ago
  I live in Canada and that's what happens with all of my visa/debit chip cards. If you attempt to swipe your card and it, as well as the terminal, are chip enabled then it gives you an error and asks you to insert your card into the terminal.
  - JaggedJax 11y ago
    That is triggered by the magstripe though. The point here is you can trick the reader by turning off that feature on the magstripe and the reader doesn't do any additional check on whether EMV should be required.
    - noddingham 11y ago
      Based upon my knowledge of EMV liability, the merchant would still be clear from fraudulent charges if they had an EMV reader. If the device tells the reader it can't do chip & pin, then the buyer is the least secure part of the transaction.
    - TeMPOraL 11y ago
      Not in all cases, I believe. For instance, to use my debit card in China, where a lot of payments is still done via magstripe, I have to call my bank and ask them to enable magstripe transactions for me in their system. Otherwise, the bank will keep rejecting transaction attempts.

brokentone 11y ago

It's stunning how bad many card issuing systems are (as noted in the post, AmEx et al). When I was in college all of the administrative buildings, student common areas as well as many of the student housing areas were controlled by magstripe. Meals were also kept track of by card. I knew from people losing their cards which continued working some places but not others there was a relationship in the issuing. I got a reader, decoded the card (zeropadded student ID, issue number, and XOR checksum). I found other places to find the student ID number, and could enumerate a few issue numbers. I built this spoofer: http://www.instructables.com/id/Arduino-Magstripe-Emulator/ http://www.instructables.com/id/Arduino-Magstripe-Emulator/ Then I could get into my friend's apartments (as a POC with their permission of course). I disclosed and got a thank you (I built a good relationship with my IT dept over the years), but never figured out if they fixed it.

sliverstorm 11y ago
It could have been "good enough". Remember the whole "keeps an honest man honest" bit. Retooling their security system might cost a lot more than some spoofed meals, and we all know doors & tumbler locks are never impervious.
- saganus 11y ago
  I think the problem with these systems is that "good enough" should be much more "gooder" than it is, due to being a solved problem for most cases. For example, if you happen to need a unique ID for each card, and you roll your own "random id generator" you might happen to encounter pitfalls that would've been solved by using UUIDs. Or you try to get some sort of hash value from the card info (to verify validity or whatever) and instead of using a known hashing algorithm you try to roll your own. And I would guess a long list of etceteras. So when a system that should be for the most part trivial to implement correctly is full of these holes then people like GP will start poking around and ultimately start finding a lot of issues that would make it actually not "good enough". I mean sure, keys are just there to keep honest people out, but if you can use a standard key that would foil both honest AND a few opportunistic dishonest people then why are you instead trying to use your own "custom key" that happens to be much easier to defeat? Especially if said standard key is not really that much harder to implement.

guyzero 11y ago

This is how Samsung Pay works, right? edit: And LoopPay which I guess Samsung acquired.

mschuster91 11y ago
IIRC all these payment solutions work with NFC communications. I have a couple of NFC-compatible banking cards.
- anonova 11y ago
  Samsung Pay's pitch is that it is (mostly) backwards compatible with existing card readers. When NFC fails, it does fallback to magnetic strip emulation.
  - deleted 11y ago
    [deleted]
    - atrilumen 11y ago
      Sounds like you didn't read the post.
    - anonova 11y ago
      It's pretty much the same as what's being described in the article. Samsung calls it Magnetic Secure Transmission (MST): http://www.samsung.com/us/support/answer/ANS00043865/997410383/ http://www.samsung.com/us/support/answer/ANS00043865/9974103...
      - leni536 11y ago
        > Magnetic Secure Transmission They dare to call this secure...
        the_mitsuhiko 11y ago
        It is because it uses a token not the PAN

deleted 11y ago

[deleted]

oxplot 11y ago

Hmm, I'm very surprised that magstripe readers don't have sensors that detect physical presence of a card, even to this date. But regardless, the main point for me was how trivially one could downgrade the security by setting the bit about Chip/PIN capability off.

rplnt 11y ago
I'm surprised magstripe readers still exist. I don't think I've used one in years. They are often there.. but I don't see their purpose. Last non-chip card I've seen was maybe 12 years ago.
- fluxquanta 11y ago
  You're obviously not in America, then. Out of the 6 cards in my wallet only 2 even have a chip yet (my bank promises my most frequently used card has a chip equivalent in the mail).

peteretep 11y ago

One day in the future, Samy (the creator of this) will stop being the coolest person on the internet, but today isn't that day. Previous projects include: The Samy MySpace worm: https://en.wikipedia.org/wiki/Samy_%28computer_worm%29 https://en.wikipedia.org/wiki/Samy_%28computer_worm%29 EverCookies: http://samy.pl/evercookie/ http://samy.pl/evercookie/ SkyJack: https://en.wikipedia.org/wiki/SkyJack https://en.wikipedia.org/wiki/SkyJack And so much more... http://samy.pl/ http://samy.pl/ https://en.wikipedia.org/wiki/Samy_Kamkar https://en.wikipedia.org/wiki/Samy_Kamkar

saganus 11y ago
Oh wow... shit... it's the same guy for all of these indeed. I think I would've been super proud of myself just for accomplishing even one of these things... I guess these are the type of guys that would start to approach the definition of a modern polymath maybe? Not saying he is one necessarily (or that he isn't), but what would examples of modern polymaths are there? considering a lot of the fields to be mastered need enough detail and knowledge that it seems hard to find one.
- eggy 11y ago
  Yes, he has quite a resume there. However, maybe I'm just older, but my ideal polymath is not just coding/hacking electronics. I personally think it should be those plus knowing more diverse fields and skills such as: applied mathematics, celestial navigation, biohacking, chemistry, milling/lathe work, building machinery from scratch by smelting and casting [1], animatronics, boatbuilding, horology, mechatronics, music, languages etc... I picked these things, because they are things I personally strive to keep learning. They are not everybody's list. I guess today the emphasis is on coding/small electronics because of the world it opens up to you (except those things that are purely mechanical or require other skills). In any case, my hat is off to him. Impressive! [1] http://gingerybooks.com/
  - saganus 11y ago
    Do you have any examples of someone that would fit this description? I think a modern polymath could look a bit different than the ones in the classical sense. To be able to make contributions to the fields you mentioned, I guess you would need more years of study than anyone could dedicate to, just because those fields seem to be very hard, especially considering the degree at which nowadays we would consider someone proficient in any of these. Well, I'm not sure, I'm actually wondering. For your particular definition, or something close to it, who would you say it gets close?

Animats 11y ago

It should be possible to detect this with a reader firmware upgrade, if the reader reads more than one track on the card. If both read heads are showing similar signals, the signal isn't coming from a normal card.

dfox 11y ago
That depends on whether the terminal has physical capability to read more than one track of card data. I have Ingenico Alphira terminal in my junk box and from casual inspection it looks like the magnetic head has two coils, but while there are footprints for two sense amplifiers, only one is populated.

xseven 11y ago

So much for Coin

scentedmeat 11y ago
It's actually mentioned that this was to overcome poor performance with Coin.

0x2015 11y ago

I recall people demonstrating something similar this with passports at defcon some years back from quite the distance. Picking up credit card data and ids wirelessly is definitely not new. This is why I use small magnetic / RFID blocking case while traveling.

corin_ 11y ago
This submission isn't about that.

vermilingua 11y ago

Can anyone explain the legality of building and using one of these (for your own cards, obviously)? I know there are similar appliances, but do they need to be accredited?

mistercow 11y ago

> What's incredible is that the magstripe reader requires no form of wireless receiver, NFC, or RFID Another way of looking at it is that the magstripe reader is a wireless receiver. It just usually works with signals so weak that they can only be transmitted a miniscule distance.

guruslead 11y ago

need a hacker? for hacking of mails, grades, records, credit, facebook, whatsapp, and all forms of hacking, contact the hack guru on his email. demon_teco@gmx.com

guruslead 11y ago

Need a hacker?For your hacking of grades, database, fixing of credit, whatsapp, facebook, clearing of criminal records, contact the hack guru demon_teco@gmx.com dude is good.

amydav 11y ago

this is not an advert, but contact waltsteph82@gmail.com for your hacking related issues or text 601 866 5203

guruslead 11y ago

Need a hacker?For your hacking of grades, database, fixing of credit, whatsapp, facebook, clearing of criminal records, contact the hack guru demon_teco@gmx.com . we also track cheating spouses, locations, messages, call records and all forms of hacking demon_teco@gmx.com

the_mitsuhiko 11y ago

The shitty thing is that because of Samsung Pay it's impossible for a merchant to distinguish a cloned magstripe from a legitimate samsung pay transaction using MST. I wrote a bit about this a few months ago: http://lucumr.pocoo.org/2015/8/31/the-thing-about-samsung-pay/ http://lucumr.pocoo.org/2015/8/31/the-thing-about-samsung-pa...

deutronium 11y ago

I wrote a little tool that decodes the data optically from a credit card, using a photo of the credit card and an iron solution. https://www.anfractuosity.com/projects/optical-magnetic-stripe-reading/ https://www.anfractuosity.com/projects/optical-magnetic-stri... I'm planning on seeing if I can decode data from higher density mediums with the same approach, when I can get my hands on some iron nanoparticles.

JimmaDaRustla 11y ago

It mentions "disabling chip and pin", meaning it will convert the sentinel character on the magnetic stripe which tells the terminal that it is a chip card. By disabling the sentinel character and using this on a chip enabled terminal, the financial institute (BASE24) SHOULD decline the transaction because the Track 2 data will be incorrect. Edit: I meant on an EMV compliant terminal. Edit: Also, that is considered fraud and your best not testing it, unless you like the prison environment.

Justin_K 11y ago

I found Josh's code a couple years ago and had this very project working. Not as well documented but the concept has been around for some time. https://github.com/joshlf/magspoof https://github.com/joshlf/magspoof