7 ms·

Intro to NFC Payment Relay Attacks

73 points by dsr12 8y ago

notduncansmith 8y ago
This is why many debit systems require both the chip and the PIN. For credit cards, the situation is still scary.
- newaccoutnas 8y ago
  NFC payment systems don't require a pin though, even if they are limited (to say £30 in the UK)
  - ErneX 8y ago
    You mean by default? because here by default if the purchase is <= 20 no pin is required, but this is something my bank at least allows you to remove so you get asked the PIN always.
    - deleted 8y ago
      [deleted]
    - avianlyric 8y ago
      In the UK yeah, and I think the limit is going up. If someone uses your card fraudulently the banks have pay you back the money, and they (the banks) can get in trouble for kicking up a fuss.
      - newaccoutnas 8y ago
        There's a sweet spot between making it easy for the customer to pay (and thereby increasing the volume of sales and therefore card charges) vs. anti-fraud measures. It's the old adage of security vs. usability.
    - newaccoutnas 8y ago
      No, anything above 30 goes on chip+pin
  - hammock 8y ago
    I think some of them you have to keep your fingerprint on the reader while you tap.
    - newaccoutnas 8y ago
      Not all NFC has that. i.e. the ones in bank cards, which here in the UK is the vast majority of contactless (nfc) payment
  - brlewis 8y ago
    Which NFC payment systems? Fitbit Pay requires it. https://help.fitbit.com/articles/en_US/Help_article/2236#secure https://help.fitbit.com/articles/en_US/Help_article/2236#sec...
    - deleted 8y ago
      [deleted]
    - newaccoutnas 8y ago
      The ones on all my debit and credit cards (here in UK)
  - londons_explore 8y ago
    It is up to the issuer if a pin is required. NFC and pin is a thing in many countries, but not the UK.
taoistextremist 8y ago
How useful is the info gathered from an attack like this? Does it depend on the specific method (e.g., contactless card versus something like Google Pay) how compromising the information is? I was under the impression that by having virtual cards and the service itself to contact, Google Pay had something of a buffer from attacks like this.
- londons_explore 8y ago
  The privacy angle is only part of it - the other part is someone else spending my money, and they can do that just as easily with something like Google Pay.
  - taoistextremist 8y ago
    Well, only if you unlock your phone, too.
amaccuish 8y ago
Is there any other ways to prevent this? I know there's latency checks, but I assume in some cases this attack could still work.
- tjoff 8y ago
  Request a card without NFC. If not possible drill through the antenna.
  - londons_explore 8y ago
    Many cards are programmed to stop working if their antenna is disconnected/broken. Not sure why, but I assume it's an anti-reverse-engineering thing. Or perhaps the antenna has another use like a power supply smoothing inductor.
    - tjoff 8y ago
      Worth a try though.
- robocat 8y ago
  Buy a wallet with conducting mesh (Faraday cage) or make a sleeve for your card (e.g. from an aluminium can). Quick failure test it: by seeing if card still works on terminal when protected. Not perfect, but would prevent most "risks".
  - justin66 8y ago
    I've carried a Datasafe wallet made by Kena Kai for ten years or so. It includes a metallic mesh next to the leather that is durable enough that the wallet is still in good shape. I have no idea how well the protection truly works (it's marketed as complying with "FIPS-201 guidelines," which might not mean a lot) but it's been an excellent wallet in its own right. There don't seem to be nearly as many of these for sale now as there were ten years ago, which is interesting.
chrsstrm 8y ago
Unfortunately the article stops short of actually stating how this would be useful as you couldn't really do this in real time on an unsuspecting card holder (Hey, can I casually hold my phone over your credit card while my buddy over there buys a TV?). My best guess is that you physically control a compromised card and use the reader-emulator setup to drain the card as quickly as possible. Think of a scenario where you are holding the card at your secret hideout and then send out a team of goons, each with an emulator, to buy gift cards using the stolen card a la NFC. This just feels like a much more complicated version of card cloning.
- tjoff 8y ago
  With a proper antenna you can do this from a distance. Or just a gentle tap on someones wallet.
- lallysingh 8y ago
  Won't this work while the card's still in your wallet, and the phone is in the hand of the person behind you?
  - chrsstrm 8y ago
    That's a great question, so I tried it. Its pretty uncommon to be issued an NFC card from a bank in the US so I stuffed my wallet with a Metro card and a couple Hilton hotel keys. I used NFC Tools on my Pixel 2 and tried to read the wallet. The cards do scan, but you never know which one you will get. I put my wallet in my pocket and tried to read it - there is absolutely no way someone is going to read my wallet in my pocket without me noticing (using a standard reader). I needed direct contact and had to move the phone around to get a read. If the wallet were inside a purse or bag, forget about it. Keep your Metro card or an NFC hotel key on the outside of your payment cards and chances of getting scanned reduce quite sharply (based on my small non-scientific experiment).
    - rasz 8y ago
      backpack sized reader will pick up your cards (all of them) from 10-30cm, standing next to a person is enough.
Sephr 8y ago
There are many door access control systems vulnerable to this same kind of attack. I'm currently working on open source red team tools for exploiting this. The best way to protect yourself from these type of attacks is to have a Faraday-shielded wallet.
- EGreg 8y ago
  Why?
  - post_break 8y ago
    Because they can stop the scanners from picking them up. Some of these people buy a long range scanner made for drive up gates because you can glean the info from a block away.
- Relys 8y ago
  Fellow red teamer here. I've got a proxmark3 and a keysy! :D Unfortunately I don't get to use them much, but they never fail to impress whenever I give a demo.
PanMan 8y ago
Secrid wallets prevent this attack, and are quite popular here in the Netherlands (where almost all bank cards are NFC enabled). Funny enough they are more popular for their form factor, than the NFC shielding that was their core feature.
Bucephalus355 8y ago
The latest Yubico 5 Keys are NFC. Any thoughts on how this will affect them?

73 points by dsr12 8y ago

notduncansmith 8y ago

This is why many debit systems require both the chip and the PIN. For credit cards, the situation is still scary.

newaccoutnas 8y ago
NFC payment systems don't require a pin though, even if they are limited (to say £30 in the UK)
- ErneX 8y ago
  You mean by default? because here by default if the purchase is <= 20 no pin is required, but this is something my bank at least allows you to remove so you get asked the PIN always.
  - deleted 8y ago
    [deleted]
  - avianlyric 8y ago
    In the UK yeah, and I think the limit is going up. If someone uses your card fraudulently the banks have pay you back the money, and they (the banks) can get in trouble for kicking up a fuss.
    - newaccoutnas 8y ago
      There's a sweet spot between making it easy for the customer to pay (and thereby increasing the volume of sales and therefore card charges) vs. anti-fraud measures. It's the old adage of security vs. usability.
  - newaccoutnas 8y ago
    No, anything above 30 goes on chip+pin
- hammock 8y ago
  I think some of them you have to keep your fingerprint on the reader while you tap.
  - newaccoutnas 8y ago
    Not all NFC has that. i.e. the ones in bank cards, which here in the UK is the vast majority of contactless (nfc) payment
- brlewis 8y ago
  Which NFC payment systems? Fitbit Pay requires it. https://help.fitbit.com/articles/en_US/Help_article/2236#secure https://help.fitbit.com/articles/en_US/Help_article/2236#sec...
  - deleted 8y ago
    [deleted]
  - newaccoutnas 8y ago
    The ones on all my debit and credit cards (here in UK)
- londons_explore 8y ago
  It is up to the issuer if a pin is required. NFC and pin is a thing in many countries, but not the UK.

taoistextremist 8y ago

How useful is the info gathered from an attack like this? Does it depend on the specific method (e.g., contactless card versus something like Google Pay) how compromising the information is? I was under the impression that by having virtual cards and the service itself to contact, Google Pay had something of a buffer from attacks like this.

londons_explore 8y ago
The privacy angle is only part of it - the other part is someone else spending my money, and they can do that just as easily with something like Google Pay.
- taoistextremist 8y ago
  Well, only if you unlock your phone, too.

amaccuish 8y ago

Is there any other ways to prevent this? I know there's latency checks, but I assume in some cases this attack could still work.

tjoff 8y ago
Request a card without NFC. If not possible drill through the antenna.
- londons_explore 8y ago
  Many cards are programmed to stop working if their antenna is disconnected/broken. Not sure why, but I assume it's an anti-reverse-engineering thing. Or perhaps the antenna has another use like a power supply smoothing inductor.
  - tjoff 8y ago
    Worth a try though.
robocat 8y ago
Buy a wallet with conducting mesh (Faraday cage) or make a sleeve for your card (e.g. from an aluminium can). Quick failure test it: by seeing if card still works on terminal when protected. Not perfect, but would prevent most "risks".
- justin66 8y ago
  I've carried a Datasafe wallet made by Kena Kai for ten years or so. It includes a metallic mesh next to the leather that is durable enough that the wallet is still in good shape. I have no idea how well the protection truly works (it's marketed as complying with "FIPS-201 guidelines," which might not mean a lot) but it's been an excellent wallet in its own right. There don't seem to be nearly as many of these for sale now as there were ten years ago, which is interesting.

chrsstrm 8y ago

Unfortunately the article stops short of actually stating how this would be useful as you couldn't really do this in real time on an unsuspecting card holder (Hey, can I casually hold my phone over your credit card while my buddy over there buys a TV?). My best guess is that you physically control a compromised card and use the reader-emulator setup to drain the card as quickly as possible. Think of a scenario where you are holding the card at your secret hideout and then send out a team of goons, each with an emulator, to buy gift cards using the stolen card a la NFC. This just feels like a much more complicated version of card cloning.

tjoff 8y ago
With a proper antenna you can do this from a distance. Or just a gentle tap on someones wallet.
lallysingh 8y ago
Won't this work while the card's still in your wallet, and the phone is in the hand of the person behind you?
- chrsstrm 8y ago
  That's a great question, so I tried it. Its pretty uncommon to be issued an NFC card from a bank in the US so I stuffed my wallet with a Metro card and a couple Hilton hotel keys. I used NFC Tools on my Pixel 2 and tried to read the wallet. The cards do scan, but you never know which one you will get. I put my wallet in my pocket and tried to read it - there is absolutely no way someone is going to read my wallet in my pocket without me noticing (using a standard reader). I needed direct contact and had to move the phone around to get a read. If the wallet were inside a purse or bag, forget about it. Keep your Metro card or an NFC hotel key on the outside of your payment cards and chances of getting scanned reduce quite sharply (based on my small non-scientific experiment).
  - rasz 8y ago
    backpack sized reader will pick up your cards (all of them) from 10-30cm, standing next to a person is enough.

Sephr 8y ago

There are many door access control systems vulnerable to this same kind of attack. I'm currently working on open source red team tools for exploiting this. The best way to protect yourself from these type of attacks is to have a Faraday-shielded wallet.

EGreg 8y ago
Why?
- post_break 8y ago
  Because they can stop the scanners from picking them up. Some of these people buy a long range scanner made for drive up gates because you can glean the info from a block away.
Relys 8y ago
Fellow red teamer here. I've got a proxmark3 and a keysy! :D Unfortunately I don't get to use them much, but they never fail to impress whenever I give a demo.

PanMan 8y ago

Secrid wallets prevent this attack, and are quite popular here in the Netherlands (where almost all bank cards are NFC enabled). Funny enough they are more popular for their form factor, than the NFC shielding that was their core feature.

Bucephalus355 8y ago

The latest Yubico 5 Keys are NFC. Any thoughts on how this will affect them?