4 ms·

Sorry I am probably ignorant here but, don't these guys just use mag stripe reader? They often just ask to see your credit card, lean down, swipe on their own d

Sorry I am probably ignorant here but, don't these guys just use mag stripe reader? They often just ask to see your credit card, lean down, swipe on their own device. They aren't 'cracking' Key Injection Facility or messing with protocols. They just add a simple card reader? The reason they hit gas machines is the volume and most don't take chips (US). https://www.amazon.com/dp/B01N4L19CR/ref=asc_df_B01N4L19CR5176947/?tag=hyprod-20&creative=395033&creativeASIN=B01N4L19CR&linkCode=df0&hvadid=167140485757&hvpos=1o2&hvnetw=g&hvrand=2889272093920227984&hvpone=&hvptwo=&hvqmt=&hvdev=c&hvdvcmdl=&hvlocint=&hvlocphy=1027028&hvtargid=pla-312069085145 https://www.amazon.com/dp/B01N4L19CR/ref=asc_df_B01N4L19CR51...

lmilcin 9y ago
Let's assume you swiped my card and now you have full contents of my credit card. For the fraudster to receive any funds from my account they would have to go with that data somehow to my issuing bank and have their transaction request accepted. My bank will never do this because my card is a secure one. They expect it to generate a signed document listing the details of my transaction along with the name (ID) of the merchant and terminal performing the transaction. The message also certifies that the PIN I entered was successfully verified by my card. The message can only be created by the card using my PIN. This requires the card to be stolen along with the PIN. The only money I can loose in case my card is stolen without the PIN is up to a floor limit for offline transactions. It's peanuts but it allows for quick transactions for example from vending machines. The gist of the story is to move to a bank that cares for security.
- djsumdog 9y ago
  So the skimmers in the article are pretty basic, but there are more advanced ones that have pin hole cameras to record pins too. You could also mitm the keypad too with another patch line. Two years ago at defcon, someone presented on advanced skimmers that could read chips too. He claimed they need a network connection to work, as there's only a two minute window to reuse the same token.
  - reaperducer 9y ago
    > You could also mitm the keypad too with another patch line. This was noted in the article. There appears to be availability on the board for an extra connection.
    - convolvatron 9y ago
      it seems like the pin entry has to be associated with the card
- dsfyu404ed 9y ago
  >up to a floor limit for offline transactions. Buy stolen CCs without pin in large volume Set up online merchant account (eBay is common), use software to scrape and copy listings for popular products that cost less than the floor amount but more than your costs. When someone orders a product and the payment clears automatically put in an order for the product on a different website (preferably one that allows a guest checkout). Automate more and more parts of the process as time goes on (e.g. using a different card when one is declined) Keep the transaction volume low and you're basically printing money at the rate of the difference between card info cost and item cost. This is a pretty common tactic to monetize large volumes of CC#s. It doesn't help that most merchants don't cross reference billing address with the bank and some don't require the security code.
  - captainmuon 9y ago
    Clever, but how do you receive money in that scheme? You need an account under a fake name, right? That seems really hard to get (as it is a prerequisite for all kinds of crimes).
    - fragmede 9y ago
      Stolen CC numbers sound like hard things to get in the first place, but they're available online. Fullz (identity-stealing kits w/ SSN and driver license info) and bank drops are similarly available, for a higher fee, as well as aged accounts for many sites.
- Bartweiss 9y ago
  > The message also certifies that the PIN I entered was successfully verified by my card. The message can only be created by the card using my PIN. This requires the card to be stolen along with the PIN. Forgive my ignorance, but aren't most sellers in America willing to process transactions (even large ones) without PIN entry? I realize pin-and-chip is a largely secure scheme, but the chip rollout in the US hasn't actually implemented a two-factor system.
  - lmilcin 9y ago
    Credit card payment organization will hold merchants, acquirers, issuers liable for fraund if the party is lagging behind in security even if it can't be shown directly that the fraud was their fault. This is called liability shift. http://www.emv-connection.com/best-practices/what-is-the-fraud-liability-shift-and-when-is-it/ http://www.emv-connection.com/best-practices/what-is-the-fra...
    - chipotle_coyote 9y ago
      The page you linked to says that gas pumps ("Automatic Fuel Dispensers") are exempted from liability shift until October of this year. But that's actually out of date information: the exemption for ATMs has been pushed to October 2017 (from the original date of October 2015), but gas pumps aren't required to go that route until October 2020: https://usa.visa.com/visa-everywhere/security/emv-at-the-pump.html https://usa.visa.com/visa-everywhere/security/emv-at-the-pum... While I don't doubt they're already out there, I don't recall ever seeing a gas pump in the US with a chip reader. Also, it's at leas worth noting that technology for skimming chip-based transactions already exists in the wild: https://krebsonsecurity.com/2017/01/atm-shimmers-target-chip-based-cards/ https://krebsonsecurity.com/2017/01/atm-shimmers-target-chip... The "shimmers" take advantage of poor implementations of the EMV standard, but the chances strike me as fairly high that there's going to be a lot of poor implementations of EMV out there in the wild. (Not only is the less secure "chip and signature" approach common in the US, I've made more than one purchase with what could be described as "chip and nothing": put my card in a chip reader and make a purchase without being asked for either a PIN or a signature.)
- tzs 9y ago
  How do large online purchases work with your card?
- otakucode 9y ago
  > For the fraudster to receive any funds from my account they would have to go with that data somehow to my issuing bank and have their transaction request accepted. Not quite. The one who gets your card info probably won't use it. They will more likely sell it. If the person who buys it can't use it, whoops, too bad.
- exabrial 9y ago
  what bank?

lmilcin 9y ago

Let's assume you swiped my card and now you have full contents of my credit card. For the fraudster to receive any funds from my account they would have to go with that data somehow to my issuing bank and have their transaction request accepted. My bank will never do this because my card is a secure one. They expect it to generate a signed document listing the details of my transaction along with the name (ID) of the merchant and terminal performing the transaction. The message also certifies that the PIN I entered was successfully verified by my card. The message can only be created by the card using my PIN. This requires the card to be stolen along with the PIN. The only money I can loose in case my card is stolen without the PIN is up to a floor limit for offline transactions. It's peanuts but it allows for quick transactions for example from vending machines. The gist of the story is to move to a bank that cares for security.

djsumdog 9y ago
So the skimmers in the article are pretty basic, but there are more advanced ones that have pin hole cameras to record pins too. You could also mitm the keypad too with another patch line. Two years ago at defcon, someone presented on advanced skimmers that could read chips too. He claimed they need a network connection to work, as there's only a two minute window to reuse the same token.
- reaperducer 9y ago
  > You could also mitm the keypad too with another patch line. This was noted in the article. There appears to be availability on the board for an extra connection.
  - convolvatron 9y ago
    it seems like the pin entry has to be associated with the card
dsfyu404ed 9y ago
>up to a floor limit for offline transactions. Buy stolen CCs without pin in large volume Set up online merchant account (eBay is common), use software to scrape and copy listings for popular products that cost less than the floor amount but more than your costs. When someone orders a product and the payment clears automatically put in an order for the product on a different website (preferably one that allows a guest checkout). Automate more and more parts of the process as time goes on (e.g. using a different card when one is declined) Keep the transaction volume low and you're basically printing money at the rate of the difference between card info cost and item cost. This is a pretty common tactic to monetize large volumes of CC#s. It doesn't help that most merchants don't cross reference billing address with the bank and some don't require the security code.
- captainmuon 9y ago
  Clever, but how do you receive money in that scheme? You need an account under a fake name, right? That seems really hard to get (as it is a prerequisite for all kinds of crimes).
  - fragmede 9y ago
    Stolen CC numbers sound like hard things to get in the first place, but they're available online. Fullz (identity-stealing kits w/ SSN and driver license info) and bank drops are similarly available, for a higher fee, as well as aged accounts for many sites.
Bartweiss 9y ago
> The message also certifies that the PIN I entered was successfully verified by my card. The message can only be created by the card using my PIN. This requires the card to be stolen along with the PIN. Forgive my ignorance, but aren't most sellers in America willing to process transactions (even large ones) without PIN entry? I realize pin-and-chip is a largely secure scheme, but the chip rollout in the US hasn't actually implemented a two-factor system.
- lmilcin 9y ago
  Credit card payment organization will hold merchants, acquirers, issuers liable for fraund if the party is lagging behind in security even if it can't be shown directly that the fraud was their fault. This is called liability shift. http://www.emv-connection.com/best-practices/what-is-the-fraud-liability-shift-and-when-is-it/ http://www.emv-connection.com/best-practices/what-is-the-fra...
  - chipotle_coyote 9y ago
    The page you linked to says that gas pumps ("Automatic Fuel Dispensers") are exempted from liability shift until October of this year. But that's actually out of date information: the exemption for ATMs has been pushed to October 2017 (from the original date of October 2015), but gas pumps aren't required to go that route until October 2020: https://usa.visa.com/visa-everywhere/security/emv-at-the-pump.html https://usa.visa.com/visa-everywhere/security/emv-at-the-pum... While I don't doubt they're already out there, I don't recall ever seeing a gas pump in the US with a chip reader. Also, it's at leas worth noting that technology for skimming chip-based transactions already exists in the wild: https://krebsonsecurity.com/2017/01/atm-shimmers-target-chip-based-cards/ https://krebsonsecurity.com/2017/01/atm-shimmers-target-chip... The "shimmers" take advantage of poor implementations of the EMV standard, but the chances strike me as fairly high that there's going to be a lot of poor implementations of EMV out there in the wild. (Not only is the less secure "chip and signature" approach common in the US, I've made more than one purchase with what could be described as "chip and nothing": put my card in a chip reader and make a purchase without being asked for either a PIN or a signature.)
tzs 9y ago
How do large online purchases work with your card?
otakucode 9y ago
> For the fraudster to receive any funds from my account they would have to go with that data somehow to my issuing bank and have their transaction request accepted. Not quite. The one who gets your card info probably won't use it. They will more likely sell it. If the person who buys it can't use it, whoops, too bad.
exabrial 9y ago
what bank?