3 ms·

I'm actually worried about security here... I don't know much about magnetic strip card technology, so I'm curious to know whether a malicious user could captu

by tjko 13y ago

I'm actually worried about security here... I don't know much about magnetic strip card technology, so I'm curious to know whether a malicious user could capture the signal and replay it.

raverbashing 13y ago
Yes, it can It's still not clear to me how the card data goes to the POS equipment, is it NFC or something else?
- tjko 13y ago
  I'd assume NFC, but I really don't know. I'm surprised they mention so many people tried and failed... this approach seems fairly intuitive.
- parshap 13y ago
  That seems to be their secret sauce. It's not NFC as that would not be compatible with existing mag-stripe readers. It has to be some method of emitting magnetic fluctuation.
- pedalpete 13y ago
  In the video they mention that they 'broadcast' it, I suspect that means they are actually pushing out a straight magnetic signal which seems to the reader that a card has been swiped. I don't think it could be NFC, as most merchant readers wouldn't have NFC built in. It also explains why they need the special case or dongle, it doesn't appear that it can work with just your phone alone. It's a pretty innovative hack, but on the security issue, if you card is broadcasting it's data, then I assume anybody can pick it up, but they would need to be REALLY close.
  - giarc 13y ago
    They mention in their video or kickstarter site that you have to be within 4" of the mag reader.
- j_s 13y ago
  Take something like the free the Square magstripe-to-audio converter, record a swipe. Clean it up and/or amplify it, connect the Square reader as headphone output, and blast the recording as loud as necessary to induce the read in a nearby swipe reader. Security-wise, "the magnetic field will generally fall off as the cube of the distance from the magnet". http://www.instructables.com/id/Read-any-magnetic-strip-card-with-a-Square-reader-/ http://www.instructables.com/id/Read-any-magnetic-strip-card... http://van.physics.illinois.edu/qa/listing.php?id=419 http://van.physics.illinois.edu/qa/listing.php?id=419
ztnewman 13y ago
This can already be done by anyone with a magstripe or RFID reader

by tjko 13y ago

I'm actually worried about security here... I don't know much about magnetic strip card technology, so I'm curious to know whether a malicious user could capture the signal and replay it.

raverbashing 13y ago

Yes, it can It's still not clear to me how the card data goes to the POS equipment, is it NFC or something else?

tjko 13y ago
I'd assume NFC, but I really don't know. I'm surprised they mention so many people tried and failed... this approach seems fairly intuitive.
parshap 13y ago
That seems to be their secret sauce. It's not NFC as that would not be compatible with existing mag-stripe readers. It has to be some method of emitting magnetic fluctuation.
pedalpete 13y ago
In the video they mention that they 'broadcast' it, I suspect that means they are actually pushing out a straight magnetic signal which seems to the reader that a card has been swiped. I don't think it could be NFC, as most merchant readers wouldn't have NFC built in. It also explains why they need the special case or dongle, it doesn't appear that it can work with just your phone alone. It's a pretty innovative hack, but on the security issue, if you card is broadcasting it's data, then I assume anybody can pick it up, but they would need to be REALLY close.
- giarc 13y ago
  They mention in their video or kickstarter site that you have to be within 4" of the mag reader.
j_s 13y ago
Take something like the free the Square magstripe-to-audio converter, record a swipe. Clean it up and/or amplify it, connect the Square reader as headphone output, and blast the recording as loud as necessary to induce the read in a nearby swipe reader. Security-wise, "the magnetic field will generally fall off as the cube of the distance from the magnet". http://www.instructables.com/id/Read-any-magnetic-strip-card-with-a-Square-reader-/ http://www.instructables.com/id/Read-any-magnetic-strip-card... http://van.physics.illinois.edu/qa/listing.php?id=419 http://van.physics.illinois.edu/qa/listing.php?id=419

ztnewman 13y ago

This can already be done by anyone with a magstripe or RFID reader