4 ms·

Android app swipes contactless credit card

38 points by dlapiduz 14y ago

talkingquickly 14y ago
Here's the github link to the App for anyone who wants more details: https://github.com/thomasskora/android-nfc-paycardreader#readme https://github.com/thomasskora/android-nfc-paycardreader#rea...
- spindritf 14y ago
  It 404s now.
  - talkingquickly 14y ago
    wow that was quick, guess it was kind of inevitable, wonder if all the forks will have gone as well
GvS 14y ago
It seems it's already removed from Google Play.
ragmondo 14y ago
Sorry.. Am calling BS on this... To read any protected memory regions on an NFC card a fairly complicated handshake has to occur with various exchanges of keys - you can't just read details with your average NFC reader in an Android phone using an app that doesn't even require root...
- lucaspiller 14y ago
  The app is designed to be used with the German GeldKarte which appears to use an old NFC technology. It isn't a credit card, you have to load cash onto it before you can spend it, and doesn't use the same security as modern contactless bank cards. Also it appears this isn't the first app to do this: http://www.nfc.cc/2011/12/11/nfc-geldkarte-broken-by-design/ http://www.nfc.cc/2011/12/11/nfc-geldkarte-broken-by-design/
- thomc 14y ago
  Not exactly BS - it depends on the cards. In the UK this has been demonstrated to work on Visa cards from a few different banks. I did a quick demo for Channel 4 News at their request a little while ago, video: http://www.channel4.com/news/millions-of-barclays-card-users-exposed-to-fraud http://www.channel4.com/news/millions-of-barclays-card-users... Also did one in a crowded lift for BBC Watchdog and live on This Morning breakfast show. It is pretty old news (as in years old) and is not exactly an effective way to lift lots of details. But makes a cute demo.
ragmondo 14y ago
Here is a clone which is still up at github: https://github.com/rayyan/android-nfc-paycardreader https://github.com/rayyan/android-nfc-paycardreader and this is the most "interesting" bit of source : https://github.com/rayyan/android-nfc-paycardreader/blob/master/src/net/skora/eccardinfos/ECCardInfosActivity.java https://github.com/rayyan/android-nfc-paycardreader/blob/mas... - it can identify card types and that's about it...
- danielhunt 14y ago
  Looks like it's not quite up to date - it doesn't have the latest pull request in it
- K2h 14y ago
  00 A4 04 0C 07 A0 00 00 00 XX XX XX 03 10 10 Visa 04 99 99 MasterCard 04 30 60 Maestro 04 60 00 Cirrus 03 20 10 Visa Electron 03 20 20 Visa V Pay 03 80 10 Visa V Pay
mneedham 14y ago
Along these lines - are there any good 'hacker' tools out there for the various phone platforms? I know there are port scanners and some other things out there but is this a well-developed space?
- objclxt 14y ago
  Depends what you're interested in, but as an iOS developer I highly recommend Jonathan Zdziarski's "Hacking and Securing iOS Applications", published by O'Reilly. It's a good primer, and covers a wide variety of both exploits and hacks. http://shop.oreilly.com/product/0636920023234.do http://shop.oreilly.com/product/0636920023234.do
- thomc 14y ago
  On Android, apart from being able to run Backtrack on certain Android devices you have tools to MITM WiFi and other fun stuff (on rooted phones) and there is some movement in making it into a developed product, e.g. ANTI: http://www.zimperium.com/Android_Network_Toolkit.html http://www.zimperium.com/Android_Network_Toolkit.html
sahaskatta 14y ago
The one mentioned in the article is no longer in the Play Store. However, this one is still available for download: https://play.google.com/store/apps/details?id=com.idstronghold.CCReaderMkt https://play.google.com/store/apps/details?id=com.idstrongho... I gave it a quick try with some credit cards I have and it immediately displayed information.
ajross 14y ago
So what's the exploit here? Is it a bug in the cards or the protocol or what? Or is the card info considered "public" by the protocol (i.e. I could imagine an authentication scheme where the card could provide its number but the bank would only honor charges via the secure contactless scheme which came with a RSA cookie or whatenot).

38 points by dlapiduz 14y ago

Here's the github link to the App for anyone who wants more details: https://github.com/thomasskora/android-nfc-paycardreader#readme https://github.com/thomasskora/android-nfc-paycardreader#rea...

spindritf 14y ago
It 404s now.
- talkingquickly 14y ago
  wow that was quick, guess it was kind of inevitable, wonder if all the forks will have gone as well

GvS 14y ago

It seems it's already removed from Google Play.

ragmondo 14y ago

Sorry.. Am calling BS on this... To read any protected memory regions on an NFC card a fairly complicated handshake has to occur with various exchanges of keys - you can't just read details with your average NFC reader in an Android phone using an app that doesn't even require root...

lucaspiller 14y ago
The app is designed to be used with the German GeldKarte which appears to use an old NFC technology. It isn't a credit card, you have to load cash onto it before you can spend it, and doesn't use the same security as modern contactless bank cards. Also it appears this isn't the first app to do this: http://www.nfc.cc/2011/12/11/nfc-geldkarte-broken-by-design/ http://www.nfc.cc/2011/12/11/nfc-geldkarte-broken-by-design/
thomc 14y ago
Not exactly BS - it depends on the cards. In the UK this has been demonstrated to work on Visa cards from a few different banks. I did a quick demo for Channel 4 News at their request a little while ago, video: http://www.channel4.com/news/millions-of-barclays-card-users-exposed-to-fraud http://www.channel4.com/news/millions-of-barclays-card-users... Also did one in a crowded lift for BBC Watchdog and live on This Morning breakfast show. It is pretty old news (as in years old) and is not exactly an effective way to lift lots of details. But makes a cute demo.

ragmondo 14y ago

Here is a clone which is still up at github: https://github.com/rayyan/android-nfc-paycardreader https://github.com/rayyan/android-nfc-paycardreader and this is the most "interesting" bit of source : https://github.com/rayyan/android-nfc-paycardreader/blob/master/src/net/skora/eccardinfos/ECCardInfosActivity.java https://github.com/rayyan/android-nfc-paycardreader/blob/mas... - it can identify card types and that's about it...

danielhunt 14y ago
Looks like it's not quite up to date - it doesn't have the latest pull request in it
K2h 14y ago
00 A4 04 0C 07 A0 00 00 00 XX XX XX 03 10 10 Visa 04 99 99 MasterCard 04 30 60 Maestro 04 60 00 Cirrus 03 20 10 Visa Electron 03 20 20 Visa V Pay 03 80 10 Visa V Pay

mneedham 14y ago

Along these lines - are there any good 'hacker' tools out there for the various phone platforms? I know there are port scanners and some other things out there but is this a well-developed space?

objclxt 14y ago
Depends what you're interested in, but as an iOS developer I highly recommend Jonathan Zdziarski's "Hacking and Securing iOS Applications", published by O'Reilly. It's a good primer, and covers a wide variety of both exploits and hacks. http://shop.oreilly.com/product/0636920023234.do http://shop.oreilly.com/product/0636920023234.do
thomc 14y ago
On Android, apart from being able to run Backtrack on certain Android devices you have tools to MITM WiFi and other fun stuff (on rooted phones) and there is some movement in making it into a developed product, e.g. ANTI: http://www.zimperium.com/Android_Network_Toolkit.html http://www.zimperium.com/Android_Network_Toolkit.html

sahaskatta 14y ago

The one mentioned in the article is no longer in the Play Store. However, this one is still available for download: https://play.google.com/store/apps/details?id=com.idstronghold.CCReaderMkt https://play.google.com/store/apps/details?id=com.idstrongho... I gave it a quick try with some credit cards I have and it immediately displayed information.

ajross 14y ago

So what's the exploit here? Is it a bug in the cards or the protocol or what? Or is the card info considered "public" by the protocol (i.e. I could imagine an authentication scheme where the card could provide its number but the bank would only honor charges via the secure contactless scheme which came with a RSA cookie or whatenot).