5 ms·

Hi! I have implement a complete payment terminal application with magstripe, chip and contactless capabilities. I have also designed security protocols to keep

Hi! I have implement a complete payment terminal application with magstripe, chip and contactless capabilities. I have also designed security protocols to keep the data and keys from the bad guys, including things like Key Injection Facility, loading and exchange protocols, etc. These things (terminals, cards, HSMs) can be extremely safe. Not only there are protocols available that in my knowledge have never been breached but also the devices themselves are built in secure manner to prevent any physical attacks. The entire infrastructure can be made so that no single employee can get hold of any secret material. The truth is, that there is a range of solutions and the secure ones cost. It costs to set them up and use correctly. It costs to produce chip card that can dynamically sign and encrypt the data. It is up to the issuer (bank) how much they pay for the security of their card and typically banks are not too eager to overpay. Rather, they take calculated risk. Another problem is that North America is particularly behind in security standards. I remember, while working on this application (10 years ago) there was much more leniency for US users (issuers, acquirers) than the rest of the world.

amelius 9y ago
> Rather, they take calculated risk. And credit-cards are a testament to that.
ransom1538 9y ago
Sorry I am probably ignorant here but, don't these guys just use mag stripe reader? They often just ask to see your credit card, lean down, swipe on their own device. They aren't 'cracking' Key Injection Facility or messing with protocols. They just add a simple card reader? The reason they hit gas machines is the volume and most don't take chips (US). https://www.amazon.com/dp/B01N4L19CR/ref=asc_df_B01N4L19CR5176947/?tag=hyprod-20&creative=395033&creativeASIN=B01N4L19CR&linkCode=df0&hvadid=167140485757&hvpos=1o2&hvnetw=g&hvrand=2889272093920227984&hvpone=&hvptwo=&hvqmt=&hvdev=c&hvdvcmdl=&hvlocint=&hvlocphy=1027028&hvtargid=pla-312069085145 https://www.amazon.com/dp/B01N4L19CR/ref=asc_df_B01N4L19CR51...
- lmilcin 9y ago
  Let's assume you swiped my card and now you have full contents of my credit card. For the fraudster to receive any funds from my account they would have to go with that data somehow to my issuing bank and have their transaction request accepted. My bank will never do this because my card is a secure one. They expect it to generate a signed document listing the details of my transaction along with the name (ID) of the merchant and terminal performing the transaction. The message also certifies that the PIN I entered was successfully verified by my card. The message can only be created by the card using my PIN. This requires the card to be stolen along with the PIN. The only money I can loose in case my card is stolen without the PIN is up to a floor limit for offline transactions. It's peanuts but it allows for quick transactions for example from vending machines. The gist of the story is to move to a bank that cares for security.
  - djsumdog 9y ago
    So the skimmers in the article are pretty basic, but there are more advanced ones that have pin hole cameras to record pins too. You could also mitm the keypad too with another patch line. Two years ago at defcon, someone presented on advanced skimmers that could read chips too. He claimed they need a network connection to work, as there's only a two minute window to reuse the same token.
    - reaperducer 9y ago
      > You could also mitm the keypad too with another patch line. This was noted in the article. There appears to be availability on the board for an extra connection.
      - convolvatron 9y ago
        it seems like the pin entry has to be associated with the card
  - dsfyu404ed 9y ago
    >up to a floor limit for offline transactions. Buy stolen CCs without pin in large volume Set up online merchant account (eBay is common), use software to scrape and copy listings for popular products that cost less than the floor amount but more than your costs. When someone orders a product and the payment clears automatically put in an order for the product on a different website (preferably one that allows a guest checkout). Automate more and more parts of the process as time goes on (e.g. using a different card when one is declined) Keep the transaction volume low and you're basically printing money at the rate of the difference between card info cost and item cost. This is a pretty common tactic to monetize large volumes of CC#s. It doesn't help that most merchants don't cross reference billing address with the bank and some don't require the security code.

amelius 9y ago

> Rather, they take calculated risk. And credit-cards are a testament to that.

ransom1538 9y ago

Sorry I am probably ignorant here but, don't these guys just use mag stripe reader? They often just ask to see your credit card, lean down, swipe on their own device. They aren't 'cracking' Key Injection Facility or messing with protocols. They just add a simple card reader? The reason they hit gas machines is the volume and most don't take chips (US). https://www.amazon.com/dp/B01N4L19CR/ref=asc_df_B01N4L19CR5176947/?tag=hyprod-20&creative=395033&creativeASIN=B01N4L19CR&linkCode=df0&hvadid=167140485757&hvpos=1o2&hvnetw=g&hvrand=2889272093920227984&hvpone=&hvptwo=&hvqmt=&hvdev=c&hvdvcmdl=&hvlocint=&hvlocphy=1027028&hvtargid=pla-312069085145 https://www.amazon.com/dp/B01N4L19CR/ref=asc_df_B01N4L19CR51...

lmilcin 9y ago
Let's assume you swiped my card and now you have full contents of my credit card. For the fraudster to receive any funds from my account they would have to go with that data somehow to my issuing bank and have their transaction request accepted. My bank will never do this because my card is a secure one. They expect it to generate a signed document listing the details of my transaction along with the name (ID) of the merchant and terminal performing the transaction. The message also certifies that the PIN I entered was successfully verified by my card. The message can only be created by the card using my PIN. This requires the card to be stolen along with the PIN. The only money I can loose in case my card is stolen without the PIN is up to a floor limit for offline transactions. It's peanuts but it allows for quick transactions for example from vending machines. The gist of the story is to move to a bank that cares for security.
- djsumdog 9y ago
  So the skimmers in the article are pretty basic, but there are more advanced ones that have pin hole cameras to record pins too. You could also mitm the keypad too with another patch line. Two years ago at defcon, someone presented on advanced skimmers that could read chips too. He claimed they need a network connection to work, as there's only a two minute window to reuse the same token.
  - reaperducer 9y ago
    > You could also mitm the keypad too with another patch line. This was noted in the article. There appears to be availability on the board for an extra connection.
    - convolvatron 9y ago
      it seems like the pin entry has to be associated with the card
- dsfyu404ed 9y ago
  >up to a floor limit for offline transactions. Buy stolen CCs without pin in large volume Set up online merchant account (eBay is common), use software to scrape and copy listings for popular products that cost less than the floor amount but more than your costs. When someone orders a product and the payment clears automatically put in an order for the product on a different website (preferably one that allows a guest checkout). Automate more and more parts of the process as time goes on (e.g. using a different card when one is declined) Keep the transaction volume low and you're basically printing money at the rate of the difference between card info cost and item cost. This is a pretty common tactic to monetize large volumes of CC#s. It doesn't help that most merchants don't cross reference billing address with the bank and some don't require the security code.