8 ms·
MagSpoof: Wireless Magstrip Spoofer
- NavinF 4y agoAww I misread the title. Was hoping this would unlock full speed wireless charging without Apple's magsafe charger.
- deleted 4y ago[deleted]
- skrowl 4y agoIs this basically the same thing that Samsung smartphones used to do that allowed you to pay at swipe-only terminals?
- arjvik 4y ago> as well as learn about and create your own devices similar to other existing, commercial technologies such as Samsung MST and Coin Yup
- ford 4y agoI long for the day I can carry my phone or watch without needing keys or wallet. The fact that most adults carry at least 3 things (keys/phone/wallet) at all times in 2022 is crazy.
- gkoberger 4y agoAgreed completely, but keys/IDs work 100% of the time. Even if virtual versions work 99% of the time, that's still not enough.
- throwawaaarrgh 4y agoI agree it would be convenient. But consider the new dangers: 1) pickpocketing would suddenly be 3x as profitable and 3x as easy, 2) lose one thing and you've lost everything, 3) if one thing stops working, everything stops working, 4) venues where you have to give up your phone means carrying extra cash in.... a wallet, 5) cybercriminals can now steal much more from you without ever getting near you, 6) I imagine there will never be a universal standard for these things so changing vendor will be quite difficult.
- cowsup 4y agoI can theoretically leave my home with just my smartphone. I can use it to pay fare at the local train station, get directions to restaurants, read the news, pay for food and coffee, and even lock / unlock my apartment. I do still bring my wallet and keys, because I'd hate to run into a scenario where my phone does get lost, stolen, or damaged, leaving me stranded without a way to get home. But the concept is definitely there, and for someone less paranoid than I, it's definitely possible to live a life of convenience.
- notpushkin 4y agoYou can still use phone to do everything for convenience, but carry stuff as a backup.
- deleted 4y ago[deleted]
- ImPostingOnHN 4y ago1) so lose the keychain and evenly distributed your keys in all your pockets to minimize the percentage of personal items lost per successful pickpocket
- Beta-7 4y agoThat day is closer than you may think. I sometimes only have my phone with me as i can pay using only it (something like Google/Apple pay, but through my bank's app) and can unlock my front door thanks to Home Assistant. Both of those (should, I don't have one) work with a smart watch.
- saaaaaam 4y agoI’ve been able to do this for about five years over here in the U.K. - and very regularly do.
- espenwa 4y agoCan’t help you with the keys or ID (yet), but I exclusively use the stored cards on my Apple Watch for payment. It is so reliable (in Norway) that I haven’t brought my wallet on normal days in 2+ years. Even on vacation in Northern Europe (Belgium, Netherlands, France, Germany) and on a business trip to the US (California+Texas) this year, I very rarely had to use the physical cards. NFC just works. Everywhere. I still bring the cards on important occasions or when going further than a normal drive, though - a testament to the fact that the day you’re longing for is not _quite_ here yet.
- monocularvision 4y agoNFC adoption has been improving in the US but still far too many big retailers that still won’t accept it, even when they have the equipment.
- 0x457 4y agoOr they accept it in theory, but it's not working for some reason. It's so silly.
- bloggie 4y agoI’ve long wanted to do this, as a kid I added NFC (at the time, simply RFID) door locking to my 1989 jetta so I didn’t have to fumble for keys. It turns out I do live in the future. I don’t lock my house, so that’s one less key right away, but there are some keyless door locks on the market if you still need them, and those could probably be automated with something like home assistant. I have a tesla that uses a phone for a key. Work has a key card, it’s a proprietary system but I could shrink one into a ring or something. I don’t carry cash, but instead use a magnetic wallet on my phone from popsockets (apple makes one too) for physical cards, although I mostly use apple pay. No digital driver’s license here yet however, so I needed a place to keep cards anyway. In Seoul the metro pass is a simple NFC sticker that you place on the back of your phone. So, no keys for me! Everything is built around the phone, which is fine until I lose access to it…
- brysonreece 4y agoMy personal example of this, allowing me to cut down on my daily carry: - Cards stored in Apple Wallet - Health/Vehicle insurance card available via an app - Driver's License available via state-issued app - FlexNT NFC implants located in both of my middle fingers, allowing me to lock/unlock my house using Home Assistant + a scanner I built based on an ESP32 & PN532. Sure, I'm more reliant on the device in my pocket - which can definitely be an issue if it's dead. However, I work from home and am rarely in situations where that predicament would arise.
- oceanplexian 4y agoIt’s a great idea until the battery in your devices fail and you’re stranded somewhere with no ID, no way to communicate, and no money for a train ticket.
- kalleboo 4y agoIs that any different from losing your wallet in the pre-smartphone era though?
- justsomehnguy 4y agoDepends. In pre-smartphone era I usually had an 'in case of emergency' bill tucked away in my ID, which was in other pocket than wallet.
- ImPostingOnHN 4y agowouldn't the proper comparison be to losing your phone in the current era but still having keys and wallet?
- Eleison23 4y agoI could leave my keys at home, but most days now I'm traveling with my security keys, partly to keep them away from my desk at home and partly in case I might need to login to a secure account while out and about.
- nati0n 4y agoIncredible application of technology, interesting read about the internals of credit card payment information storage.
- Loggie 4y agoAlthough you can disable the bits in the service code pertaining to the cards ICC capabilities, in theory there's a good chance that the track2 equivalent data on the chip is different from the track2 data on the magstrip. That would make it easy for the issuer to determine that the track2 has been modified and reject the transaction and/or flag the account for fraudulent activity.
- Scoundreller 4y agoYeah, whenever I try to swipe my card, it instantly tells me to use Chip and PIN. I think it's just to provide rapid localized responses, but who knows if some banks are misconfigured and overly trusted the magstripe data to block magstripe transactions.
- ComputerGuru 4y agoBut that's what's covered in the article. The "block transaction and require chip and PIN" flag is stored on the magtrack itself.
- lxgr 4y agoThe bank/processor also knows it and is able to reject any modifications. Whether they do is a matter of their security posture.
- ImPostingOnHN 4y agothe article covers that too, saying that the issuer does not seem to do such verification
- amluto 4y agoCredit card security is comically poor. Off the top of my head: 1. An NFC-enabled EMV card will happily reveal its entire account number and expiration date over NFC with no authentication whatsoever. I don’t know whether the CVV comes along, but I wouldn’t be surprised if it did. 2. (As mentioned in the article) issuers accept transactions from EMV (chip)-capable readers that nominally originate from EMV-capable cards without requiring the chip to be used. So what’s the point of the chip? (Note that this allows a card to be cloned without even touching the card - see #1.) 3. The information leaked in #1 is enough to buy things online (as long as the CVV2 can be found or guessed). Wtf? 4. For some reason I can’t fathom (presumably just laziness), if your card number is stolen, the chip stops working until a replacement shows up. 5. Fancy merchants can arrange a subscription that survives a lost card or even a fraud report against that merchant. But these subscriptions can’t be seen or cancelled on the cardholder website or even by customer service. But somehow all this comes with fairly stringent PCI requirements, which supposedly represent best practices, despite the entire system design being a case study on worst practices.
- isoprophlex 4y ago> [...] found a global pattern that allows me to accurately predict American Express card numbers by knowing a full card number, even if already reported lost or stolen. > This means if I were to obtain your Amex card and you called it in as lost or stolen, the moment you get a new card, I know your new credit card number. Criminally hilarious.
- amluto 4y ago> Criminally hilarious. ISTM it’s only criminally hilarious if you catch Amex doing something fraudulent or illegal themselves. But it sure would be entertaining to have a big civil lawsuit on the basis of incompetent security practices.
- Scoundreller 4y agoI suspect this has already been exploited in South America with at least one North American banks' Amex cards. Can't get into too much detail, but the pieces fit.
- petesergeant 4y agoSamy is still my hero
- Forge36 4y agoThis is the myspace guy?
- notme1234 4y agoThis is less useful nowdays, since magstrip are deprecated (at least in most developed countries).
- gambiting 4y agoThe american reliance on magstrips is crazy. Over here(Poland) I don't think I've seen a magstrip-compatible terminal for years, they just don't have the swipe part anymore, it's been removed from terminals and cash registers ages ago.
- Scoundreller 4y agoAre gift cards not a thing in Poland? How do they work? I have McDonald's gift cards in Canada, and I use the swipe for that.
- gambiting 4y agoThey just have a chip like any other card? I bought a mastercard gift card some time ago and it just came with a pin. In fact I think gift cards don't even have a swipe part at all, and my own visa/mastercard cards still have it but I have it disabled through my online bank account - so I assume any magstrip transaction for those cards would be just rejected entirely.
- lights0123 4y agoThey’re talking about store-specific gift cards, not generic visa/Mastercard cards.
- j_jochem 4y agoAll of the gift cards I’ve seen in the EU used barcodes, not mag stripes.
- cbm-vic-20 4y agoAmerican here- most retail terminals here support NFC and chip- I haven't used magstrip in a retail environment for years- even mom-and-pop shops support NFC. Most gas stations accept chip, but not many accept NFC yet, though I'm seeing it more and more. Some gas stations still only accept magstrip. We still have the stupid policy in restaurants where you hand your card to the server and they walk away with it (their terminals are usually chip), which is something that a lot of foreigners freak out about.
- stevehawk 4y agoI'm pretty sure my Samsung watch from 2014 did this?
- FPGAhacker 4y agoYou can see whole credit card number in the iron oxide encoding in the picture of the whole backside of the card with electrical tape covering the signature. The author seems to have wiped away the iron oxide but enough residue is left behind that you can still read it.
- anamexis 4y agoThe card expired in 2017, and is not an American Express, so I imagine it is not a concern.
- madmod 4y agoI followed the plans to build one of these years ago but couldn’t get it to work for some reason.
- zxcvbn4038 4y agoI'm not sure this is useful for credit cards at all - ever since the deadline for chipped cards to roll out passed, my issuers all decline swipe transactions. Even at middle of nowhere gas pumps that don't have chip readers, I found two during my last cross-country trip, swiping the card will get a decline response.
- blamazon 4y agoMany places in USA, you can 'fall back' to magstripe by inserting the chip and having it fail to read 3 or 4 or 5 times. The reader will prompt for a swipe after the threshold of failed attempts is reached. I'm really tough on my cards and when the chip dies this becomes my routine everywhere until the new one comes in the mail.
- TazeTSchnitzel 4y ago> the bits stating the card has Chip-and-PIN can be turned off from the magstripe This is true, but it's not the last line of defence, right? The bank could still reject the transaction if it sees a chip card used to do a magstripe transaction on a chip-capable reader. That relies on the reader providing that information to the bank, though, and while I believe the EMV protocol can do that, I don't know if that's used for magstripe transactions (talking purely reader to bank here, not reader to card). I don't think it can be fairly considered a security issue that the “I'm a chip card, why are you swiping me” bit is on the magnetic stripe. It's obvious that doesn't protect against modification, but it's not supposed to! Hell, it's probably only meant to be a reminder anyway, as you can subvert it by making the card reader think the chip isn't working.