4 ms·

What are they decapping for the purpose of carding? Just curious, as I know little about that "scene"

tialaramex 9y ago
Chip cards have some private key burned into them that makes them unique, depending on the chip they may just use this to witness a transaction (so the issuer knows this card was used) or something more involved so that the issuer can verify the card was really told the correct PIN and transaction amount. In principle you can uncap the chip and get that key back out. You could then clone it, or bypass any restrictions built into the chip like "I won't authorise more than £200 total spend without going online". I'm not sure how that would be worth doing unless it's surprisingly easy and quick. Unlike with cloning magstripe cards though this would trash the original, take substantially more than a couple of minutes and be readily detectable by the issuing bank if they are paying attention. So it seems crazy to me and my default position would be to believe it's not actually being done, certainly on an "industrial" scale.
- baybal2 9y ago
  How they prime majority of such cards get to carders is through bought post workers that steal replacement credit cards sent by post. So, even when a card is does not arrive, most people will assume that the post simply lost it, and call for another replacement. As I understand, a great lot of banks still ship fully active cards that require no "activation" by phone or online, assuming that nobody can recover the pin.
  - topranks 9y ago
    Ah ok... that is an interesting attack. Is the actual pin on the chip though? I would have assumed only a hash of it was stored, enough that it can verify the right pin has been supplied without having to store the actual code?
    - baybal2 9y ago
      I there are full rainbow tables available for each used hash algo for 4 digit pins. They are routinely bruteforceable.
      - tialaramex 9y ago
        Whereas I don't have criminal contacts who'd know whether anybody actually is stealing chip cards and de-capping them, I do know plenty about algorithms and data structures. Rainbow tables make no sense here, the rainbow table is a clever optimisation of the normal time-space tradeoff where we don't want to pay the full space cost, and will accept a time penalty (and usually in practice an accuracy penalty) to avoid using so much space. For a four digit PIN there is no concern about space, storing and indexing 10 000 possible hashes is trivial, (whereas storing and indexing say three trillion password hashes is kind of a pain so that's why you have rainbow tables)
        baybal2 9y ago
        Well, they are trivial, actually I ha e no idea of details

Chip cards have some private key burned into them that makes them unique, depending on the chip they may just use this to witness a transaction (so the issuer knows this card was used) or something more involved so that the issuer can verify the card was really told the correct PIN and transaction amount. In principle you can uncap the chip and get that key back out. You could then clone it, or bypass any restrictions built into the chip like "I won't authorise more than £200 total spend without going online". I'm not sure how that would be worth doing unless it's surprisingly easy and quick. Unlike with cloning magstripe cards though this would trash the original, take substantially more than a couple of minutes and be readily detectable by the issuing bank if they are paying attention. So it seems crazy to me and my default position would be to believe it's not actually being done, certainly on an "industrial" scale.

baybal2 9y ago
How they prime majority of such cards get to carders is through bought post workers that steal replacement credit cards sent by post. So, even when a card is does not arrive, most people will assume that the post simply lost it, and call for another replacement. As I understand, a great lot of banks still ship fully active cards that require no "activation" by phone or online, assuming that nobody can recover the pin.
- topranks 9y ago
  Ah ok... that is an interesting attack. Is the actual pin on the chip though? I would have assumed only a hash of it was stored, enough that it can verify the right pin has been supplied without having to store the actual code?
  - baybal2 9y ago
    I there are full rainbow tables available for each used hash algo for 4 digit pins. They are routinely bruteforceable.
    - tialaramex 9y ago
      Whereas I don't have criminal contacts who'd know whether anybody actually is stealing chip cards and de-capping them, I do know plenty about algorithms and data structures. Rainbow tables make no sense here, the rainbow table is a clever optimisation of the normal time-space tradeoff where we don't want to pay the full space cost, and will accept a time penalty (and usually in practice an accuracy penalty) to avoid using so much space. For a four digit PIN there is no concern about space, storing and indexing 10 000 possible hashes is trivial, (whereas storing and indexing say three trillion password hashes is kind of a pain so that's why you have rainbow tables)
      - baybal2 9y ago
        Well, they are trivial, actually I ha e no idea of details