4 ms·

Unfortunately the article stops short of actually stating how this would be useful as you couldn't really do this in real time on an unsuspecting card holder (H

Unfortunately the article stops short of actually stating how this would be useful as you couldn't really do this in real time on an unsuspecting card holder (Hey, can I casually hold my phone over your credit card while my buddy over there buys a TV?). My best guess is that you physically control a compromised card and use the reader-emulator setup to drain the card as quickly as possible. Think of a scenario where you are holding the card at your secret hideout and then send out a team of goons, each with an emulator, to buy gift cards using the stolen card a la NFC. This just feels like a much more complicated version of card cloning.

tjoff 8y ago
With a proper antenna you can do this from a distance. Or just a gentle tap on someones wallet.
lallysingh 8y ago
Won't this work while the card's still in your wallet, and the phone is in the hand of the person behind you?
- chrsstrm 8y ago
  That's a great question, so I tried it. Its pretty uncommon to be issued an NFC card from a bank in the US so I stuffed my wallet with a Metro card and a couple Hilton hotel keys. I used NFC Tools on my Pixel 2 and tried to read the wallet. The cards do scan, but you never know which one you will get. I put my wallet in my pocket and tried to read it - there is absolutely no way someone is going to read my wallet in my pocket without me noticing (using a standard reader). I needed direct contact and had to move the phone around to get a read. If the wallet were inside a purse or bag, forget about it. Keep your Metro card or an NFC hotel key on the outside of your payment cards and chances of getting scanned reduce quite sharply (based on my small non-scientific experiment).
  - rasz 8y ago
    backpack sized reader will pick up your cards (all of them) from 10-30cm, standing next to a person is enough.
  - monocasa 8y ago
    Relying on non tuned antennas for your test is a mistake. Check out the war driving peeps who connect to WiFi networks from miles away. Your phone's antenna is intentionally not tuned well to avoid picking up random devices that it's not near. When I was working on an RFID board, we intentionally tuned it for such poor distance that the FCC was willing to not call it an intentional transmitter, but instead one half of an air core transformer. That's pretty standard for the product space.
  - londons_explore 8y ago
    Modified readers the size of a briefcase can read NFC cards from around 300 feet away. I can totally imagine someone leaving such a briefcase on a busy shopping street, then providing 'free money to anyone' via an app and the internet.
  - opless 8y ago
    https://www.youtube.com/watch?v=kUduHIygbY8 https://www.youtube.com/watch?v=kUduHIygbY8 This decon talk mostly targets 125KHz readers, but to read 13.56MHz NFC MiFare/EMV cards you use can still get COTS components. Also most of the proxmark 3 devices and friends, have external (amplified) antennas which certainly can do remote attacks such as the one described. Also, NFC cards will be on the rise in the USA given the introduction in 2017. Most of the rest of the world have had NFC payment cards for a decade.
sdwisely 8y ago
I'm not thinking of the card as the weak point, more the reader. a rogue employee putting a false reader that relays to the real reader. Back when I worked in retail we had an issue in our local area where a group impersonated our support department and came on site to install altered versions of our readers. I'd imagine things like the readers in our public transport ticketing machines are a pretty easy target too to hide a nearby relay. In Australia our NFC limits are pretty high at ~$100, readers are nearly everywhere and the readers are sometimes display-less plastic discs. Even the local animal shelter has a tap to make a donation thing now.
- dzhiurgis 8y ago
  How about setting up a relay on ATM slot?

tjoff 8y ago

With a proper antenna you can do this from a distance. Or just a gentle tap on someones wallet.

lallysingh 8y ago

Won't this work while the card's still in your wallet, and the phone is in the hand of the person behind you?

chrsstrm 8y ago
That's a great question, so I tried it. Its pretty uncommon to be issued an NFC card from a bank in the US so I stuffed my wallet with a Metro card and a couple Hilton hotel keys. I used NFC Tools on my Pixel 2 and tried to read the wallet. The cards do scan, but you never know which one you will get. I put my wallet in my pocket and tried to read it - there is absolutely no way someone is going to read my wallet in my pocket without me noticing (using a standard reader). I needed direct contact and had to move the phone around to get a read. If the wallet were inside a purse or bag, forget about it. Keep your Metro card or an NFC hotel key on the outside of your payment cards and chances of getting scanned reduce quite sharply (based on my small non-scientific experiment).
- rasz 8y ago
  backpack sized reader will pick up your cards (all of them) from 10-30cm, standing next to a person is enough.
- monocasa 8y ago
  Relying on non tuned antennas for your test is a mistake. Check out the war driving peeps who connect to WiFi networks from miles away. Your phone's antenna is intentionally not tuned well to avoid picking up random devices that it's not near. When I was working on an RFID board, we intentionally tuned it for such poor distance that the FCC was willing to not call it an intentional transmitter, but instead one half of an air core transformer. That's pretty standard for the product space.
- londons_explore 8y ago
  Modified readers the size of a briefcase can read NFC cards from around 300 feet away. I can totally imagine someone leaving such a briefcase on a busy shopping street, then providing 'free money to anyone' via an app and the internet.
- opless 8y ago
  https://www.youtube.com/watch?v=kUduHIygbY8 https://www.youtube.com/watch?v=kUduHIygbY8 This decon talk mostly targets 125KHz readers, but to read 13.56MHz NFC MiFare/EMV cards you use can still get COTS components. Also most of the proxmark 3 devices and friends, have external (amplified) antennas which certainly can do remote attacks such as the one described. Also, NFC cards will be on the rise in the USA given the introduction in 2017. Most of the rest of the world have had NFC payment cards for a decade.

sdwisely 8y ago

I'm not thinking of the card as the weak point, more the reader. a rogue employee putting a false reader that relays to the real reader. Back when I worked in retail we had an issue in our local area where a group impersonated our support department and came on site to install altered versions of our readers. I'd imagine things like the readers in our public transport ticketing machines are a pretty easy target too to hide a nearby relay. In Australia our NFC limits are pretty high at ~$100, readers are nearly everywhere and the readers are sometimes display-less plastic discs. Even the local animal shelter has a tap to make a donation thing now.

dzhiurgis 8y ago
How about setting up a relay on ATM slot?