4 ms·

Actually, the prudent thing is to actively damage the NFC antenna. There is not much point in damaging the magnetic stripe but leaving wireless functionality..

by tjoff 8y ago

Actually, the prudent thing is to actively damage the NFC antenna. There is not much point in damaging the magnetic stripe but leaving wireless functionality... they are exactly the same thing only wireless works from a greater distance.

gambiting 8y ago
That's absolutely not true. Magnetic stripe is just a dumb carrier of information - you can buy a $5 reader off eBay and read every card in the world, it's not protected in any way. Modern NFC cards do not surrender their information to some random reader - they need to receive a valid cryptographic key first to reply with the data - and such key can only be produced by an authorized terminal. A normal NFC reader will not read any data off a contactless card, it's just not possible(yes I am aware that there have been attacks demonstrated, but they were all timing based, with extremely limited use in real world).
- tjoff 8y ago
  Depends on the card. All NFC cards in Sweden are just as dumb as a magnetic stripe cards. I actually believe all cards in Europe are but I could be wrong. It's there, in plain text, any normal NFC-reader will get you everything (there even are android-apps that does it in the play-store).
  - gruez 8y ago
    Those apps don't get you an authorization token, which is needed for a transaction.
    - deleted 8y ago
      [deleted]
    - tjoff 8y ago
      What authorization token? If you mean the CVV it isn't required to make a transaction.
      - gruez 8y ago
        >If you mean the CVV it isn't required to make a transaction. that's incorrect. there's a cvv1 on the magstripe that's needed for magstripe transactions, and there's cvv2 that's on the back of the card that's mostly required (depends on merchant policy) for card not present transactions. for EMV transactions, you need a payment terminal because the card will refuse to communicate unless the other side has a valid certificate. even then, the card only returns a signed response, which you can't use elsewhere.
        tjoff 8y ago
        > that's incorrect. No? You just said so yourself? "depends on merchant policy" Why would an attacker choose a merchant whose policy denies their use case? Why would an attacker opt for a magstripe transaction or a contactless transaction?
        gruez 8y ago
        >No? You just said so yourself? "depends on merchant policy" Why would an attacker choose a merchant whose policy denies their use case? it's not as easy as you think. nearly all merchants require some sort of additional information (cvv, billing address, cardholder name) in addition to card number + expiration date. reason being, for card not present transactions (eg. online), the merchant is liable for fraud (the purchase amount + ~$25 chargeback fee), so they have a strong financial incentive to collect/verify as many pieces of information to reduce their losses. it would be insane to not collect any of those (only requiring card number + expiry date), because the chargebacks will bankrupt you. the reason i said "depends on merchant policy" is because some merchants (iirc amazon) don't collect cvv2 (but they do collect billing address + cardholder name), which I presume is for convenience/conversion rate reasons. I don't actually know of any merchants that only collects card number + expiry date.
        tjoff 8y ago
        Sure, forgot that name wasn't provided. But name is the only additional information you need to make a legitimate purchase, and that information isn't a secret (if you, under any circumstance, ask for someones CVV they will tell you to fuck off. Ask for their name is another thing (maybe even present on a name tag or in many cases trivial in a certain context)). It will make it slightly harder to just randomly scan peoples pockets on the subway but still an absolute security nightmare. Just disable NFC altogether, no reason not to.
  - tjoff 8y ago
    I guess I'm getting downvoted because people just can't fathom how insecure it actually is. https://www.nytimes.com/2016/10/31/technology/how-to-protect-yourself-when-using-a-contactless-card.html https://www.nytimes.com/2016/10/31/technology/how-to-protect... In Britain, where people have arguably embraced contactless cards to a greater extent than individuals in other countries, researchers have routinely been able to copy the financial details of some cards, including the 16-digit card number and expiration date, by merely passing their own N.F.C. reader close to a person’s wallet. There have been numerous other demonstrations of this as well. Another demonstration (site is in Swedish https://www.svt.se/nyheter/lokalt/uppsala/sa-kan-tjuven-skimma-ditt-nya-bankkort https://www.svt.se/nyheter/lokalt/uppsala/sa-kan-tjuven-skim... ).
    - close04 8y ago
      > researchers have routinely been able to copy the financial details of some cards I think this is the key. The implementation of each card may differ leading to inconsistent results. As a general rule I suggest covering up the CVV or scratching it off if you're sure you have it somewhere safe. An option is to also erase the magnetic strip. It might lead to a less useful card (in cases where only magstrip would work) but definitely a more secure one. And for any NFC card an RFID shield sleeve does wonders.
    - tialaramex 8y ago
      Yes, this gets you the data that's printed on the front of the card. You could also get this data by... seeing the card ?
      - tjoff 8y ago
        Yes? And that is a common technique to do it. Hide a small camera behind the counter, make sure quickly hold a customers card in view of it and you are done. NFC though has the advantage to be read from a distance, easily through a pocket and wallet (if the wallet doesn't have an rfid shield). Surely open up that attack vector isn't helping? If you are paying attention you can detect someone trying to photograph your card (they shouldn't even be handling it in the first place). But through your pocket? Practically impossible to detect. edit: The fact that we still print everything needed to make a purchase on the card itself isn't particularly flattering for our species.
therealmarv 8y ago
NFC payment cards are cryptographic protected. It's not just read it and you have a 1:1 copy. Attacks are possible but only online attacks (this is no offline payment system) and with the right critical timing.
- tjoff 8y ago
  Apparently there do exist some cards that are protected, but all I've seen and all I've got access too are completely passive. They serve the exact same function as the magnetic stripe only from a greater distance.
  - gsich 8y ago
    Mifare Plus here. Not completely passive I guess.

by tjoff 8y ago

gambiting 8y ago

That's absolutely not true. Magnetic stripe is just a dumb carrier of information - you can buy a $5 reader off eBay and read every card in the world, it's not protected in any way. Modern NFC cards do not surrender their information to some random reader - they need to receive a valid cryptographic key first to reply with the data - and such key can only be produced by an authorized terminal. A normal NFC reader will not read any data off a contactless card, it's just not possible(yes I am aware that there have been attacks demonstrated, but they were all timing based, with extremely limited use in real world).

tjoff 8y ago
Depends on the card. All NFC cards in Sweden are just as dumb as a magnetic stripe cards. I actually believe all cards in Europe are but I could be wrong. It's there, in plain text, any normal NFC-reader will get you everything (there even are android-apps that does it in the play-store).
- gruez 8y ago
  Those apps don't get you an authorization token, which is needed for a transaction.
  - deleted 8y ago
    [deleted]
  - tjoff 8y ago
    What authorization token? If you mean the CVV it isn't required to make a transaction.
    - gruez 8y ago
      >If you mean the CVV it isn't required to make a transaction. that's incorrect. there's a cvv1 on the magstripe that's needed for magstripe transactions, and there's cvv2 that's on the back of the card that's mostly required (depends on merchant policy) for card not present transactions. for EMV transactions, you need a payment terminal because the card will refuse to communicate unless the other side has a valid certificate. even then, the card only returns a signed response, which you can't use elsewhere.
      - tjoff 8y ago
        > that's incorrect. No? You just said so yourself? "depends on merchant policy" Why would an attacker choose a merchant whose policy denies their use case? Why would an attacker opt for a magstripe transaction or a contactless transaction?
        gruez 8y ago
        >No? You just said so yourself? "depends on merchant policy" Why would an attacker choose a merchant whose policy denies their use case? it's not as easy as you think. nearly all merchants require some sort of additional information (cvv, billing address, cardholder name) in addition to card number + expiration date. reason being, for card not present transactions (eg. online), the merchant is liable for fraud (the purchase amount + ~$25 chargeback fee), so they have a strong financial incentive to collect/verify as many pieces of information to reduce their losses. it would be insane to not collect any of those (only requiring card number + expiry date), because the chargebacks will bankrupt you. the reason i said "depends on merchant policy" is because some merchants (iirc amazon) don't collect cvv2 (but they do collect billing address + cardholder name), which I presume is for convenience/conversion rate reasons. I don't actually know of any merchants that only collects card number + expiry date.
        tjoff 8y ago
        Sure, forgot that name wasn't provided. But name is the only additional information you need to make a legitimate purchase, and that information isn't a secret (if you, under any circumstance, ask for someones CVV they will tell you to fuck off. Ask for their name is another thing (maybe even present on a name tag or in many cases trivial in a certain context)). It will make it slightly harder to just randomly scan peoples pockets on the subway but still an absolute security nightmare. Just disable NFC altogether, no reason not to.
- tjoff 8y ago
  I guess I'm getting downvoted because people just can't fathom how insecure it actually is. https://www.nytimes.com/2016/10/31/technology/how-to-protect-yourself-when-using-a-contactless-card.html https://www.nytimes.com/2016/10/31/technology/how-to-protect... In Britain, where people have arguably embraced contactless cards to a greater extent than individuals in other countries, researchers have routinely been able to copy the financial details of some cards, including the 16-digit card number and expiration date, by merely passing their own N.F.C. reader close to a person’s wallet. There have been numerous other demonstrations of this as well. Another demonstration (site is in Swedish https://www.svt.se/nyheter/lokalt/uppsala/sa-kan-tjuven-skimma-ditt-nya-bankkort https://www.svt.se/nyheter/lokalt/uppsala/sa-kan-tjuven-skim... ).
  - close04 8y ago
    > researchers have routinely been able to copy the financial details of some cards I think this is the key. The implementation of each card may differ leading to inconsistent results. As a general rule I suggest covering up the CVV or scratching it off if you're sure you have it somewhere safe. An option is to also erase the magnetic strip. It might lead to a less useful card (in cases where only magstrip would work) but definitely a more secure one. And for any NFC card an RFID shield sleeve does wonders.
  - tialaramex 8y ago
    Yes, this gets you the data that's printed on the front of the card. You could also get this data by... seeing the card ?
    - tjoff 8y ago
      Yes? And that is a common technique to do it. Hide a small camera behind the counter, make sure quickly hold a customers card in view of it and you are done. NFC though has the advantage to be read from a distance, easily through a pocket and wallet (if the wallet doesn't have an rfid shield). Surely open up that attack vector isn't helping? If you are paying attention you can detect someone trying to photograph your card (they shouldn't even be handling it in the first place). But through your pocket? Practically impossible to detect. edit: The fact that we still print everything needed to make a purchase on the card itself isn't particularly flattering for our species.

therealmarv 8y ago

NFC payment cards are cryptographic protected. It's not just read it and you have a 1:1 copy. Attacks are possible but only online attacks (this is no offline payment system) and with the right critical timing.

tjoff 8y ago
Apparently there do exist some cards that are protected, but all I've seen and all I've got access too are completely passive. They serve the exact same function as the magnetic stripe only from a greater distance.
- gsich 8y ago
  Mifare Plus here. Not completely passive I guess.