9 ms·

Spraying Magnetic Stripe Cards with Iron Filings

321 points by charlieirish 11y ago

luck87 11y ago
For the same reason, the ferromagnetic nature of the magstripe, it is possible to read, store and playback the data information on the stripe. You need only few $ for the reader or a simple Square reader. This is an alternative solution to spoof Magnetic stripe cards on Android: http://cosmodro.me/blog/2011/mar/25/rhombus-square-iskewedi/ http://cosmodro.me/blog/2011/mar/25/rhombus-square-iskewedi/
- flax 11y ago
  Hey, cool, it's nice to see my stuff get referenced by someone that isn't me! Rhombus only _reads_ magnetic stripe data. It won't write it. But yes, you could totally write to a low-coercivity stripe with the right hardware. Before you run out and get a Square reader, they're all encrypted now and don't return the raw data necessary for Rhombus to work. You can still get unencrypted readers from China on alibaba pretty easily.
  - thevdude 11y ago
    I remember requesting a stripe reader when I first saw something about them just spitting out the info, and by the time I got it they were already encrypted.
  - Vexs 11y ago
    I actually read your thing a long while ago too! I took it a step further, and made a small coil and amp, and played the recorded data back through the coil, and placed the coil next to a one-track card reader. It actually worked, which was neat.
  - luck87 11y ago
    There are same crazy nerd which enjoy themself (I don't know why) to decrypt credit card data coming off of a magnetic stripe scanner: https://www.parthenonsoftware.com/blog/how-to-decrypt-magnetic-stripe-scanner-data-with-dukpt/ https://www.parthenonsoftware.com/blog/how-to-decrypt-magnet... But I agree with you, an un-encrypted reader of magnetic stripe is very easy to find or build. The security is like a door in the desert.
- brokentone 11y ago
  Here is a spoofer for Arduino which I have constructed myself once: http://www.instructables.com/id/Arduino-Magstripe-Emulator/ http://www.instructables.com/id/Arduino-Magstripe-Emulator/ Rather fun.
Others 11y ago
What I'm confused about here is why the ShooTag actually has any data on it at all. Surely it would be cheaper to just make part of the plastic card black, instead of actually going to the trouble of encoding something on it.
- tikhonj 11y ago
  One thing to consider is that the creators might very well believe it works themselves. It's easy to fool yourself into believing something you want to believe. They might even have done some informal, poorly structured tests and gotten the results they were expecting for other reasons, reinforcing their beliefs. Hell, I've done this to myself (ie when debugging) so I can totally empathize.
  - bentcorner 11y ago
    Reminds me of Esio Trot: https://en.wikipedia.org/wiki/Esio_Trot https://en.wikipedia.org/wiki/Esio_Trot
    - metasean 11y ago
      I hadn't heard of Esio Trot, but sounds like a definite fit. I was actually reminded of "Hidden Messages in Water" - https://duckduckgo.com/?q=%22hidden+messages+in+water%22 https://duckduckgo.com/?q=%22hidden+messages+in+water%22
  - freehunter 11y ago
    I would probably die of embarrassment if anyone ever saw the number of lines in my code that say x = x //this doesn't need to be here but it breaks if you remove it
    - moron4hire 11y ago
      Wouldn't it be better to figure out why it breaks?
PirateDave 11y ago
When he pulled the ShooTag out I thought he was totally going to write the card data to it. Nonetheless, interesting article.
stephengillie 11y ago
It might be interesting to perform this same experiment with a Coin Card. It would be cool to see the patterns shift as it remagnetizes its bars.
Animats 11y ago
Yeah, the ShooTag thing is totally bogus. Viewing magnetic recordings with magnetic particles used to be a standard maintenance tool. It was used to check tape drive head alignment. There was a liquid with iron particles in suspension into which you could dip a strip of tape. When the solvent evaporated, you could see the data tracks. A non-destructive version was a hand-held viewer, with a window on top and a thin plate on the bottom, filled with a fluid containing iron particles. You could press this against a tape and view it. These were sometimes used in data centers during the transition from 7 to 9 track tape drives, when an incoming tape had an unknown format.
- castratikron 11y ago
  The liquid is called magnetic developer. http://www.q-card.com/products/magnetic-developers.asp http://www.q-card.com/products/magnetic-developers.asp
- rtanaka 11y ago
  The liquid (also comes in spray form) still exists. It's called a Magnetic Developer: https://en.wikipedia.org/wiki/Magnetic_developer https://en.wikipedia.org/wiki/Magnetic_developer
  - seanp2k2 11y ago
    Wow, never heard of this. Gotta love the old-skool tech!
    - MichaelCrawford 11y ago
      The very first time I wrote an interrupt handler, it was in octal, entered by a numeric keypad into an LSI-11 with DEC's ODT - "Octal Debugging Technique". I wish I could say I was paid to do that but it was for UC Davis' Intro to Computer Architecture Class. I got a C because I cratered the final.
DanBC 11y ago
You used to be able to buy magnetic field viewers to inspect tape. Here's a picture of one: http://nickapedia.com/2011/02/21/back-to-the-geek-future-cool-old-stuff/ http://nickapedia.com/2011/02/21/back-to-the-geek-future-coo... Another fun thing you can do is put the iron filings in a jar with mineral oil. Give it a good shake, then put a strong magnet on the side. You'll be able to see the magnetic field in 3D.
nkurz 11y ago
A beautiful story about the inner workings of a patent-pending species-specific insect repellent based on a small strip of magnetic strip. As one might guess, it involves encoding the words "FLEA" and "TICK" on the strip. Or maybe "AELF" and "KCIT" to properly actuate the quantum polarity? The story was written in 2010 while the patent was still pending. But surely it's been rejected by now. Nope. Also as one might guess, the patent was granted by the USPTO with the the main claim intact: https://www.google.gg/patents/US8382001 https://www.google.gg/patents/US8382001 Have you ever thought to yourself "Sure, this advertisement says 'patent-pending', but that only means that someone was able to scrape together enough money to file a patent. It's not like someone has vetted the technology and actually granted them a patent." Well, now you see that you can safely shorten that to "Sure, this advertisement says 'patented', but that only means that someone was able to scrape together enough money to file a patent. It's not like someone has vetted the technology." This is probably not surprising to anyone who understands the role of patents. They aren't designed to act as evidence that a technology is useful, or even possible. Instead, they are designed to "promote the Progress of Science and useful Arts", which seems to be interpreted as to "create a secondary market for dubious patents". I was surprised though to see that they had been granted a second patent, covering the ornamental design of the tag: http://www.google.com/patents/USD626704 http://www.google.com/patents/USD626704 I was aware that design patents existed to cover essential innovations such as the rounded corners of a "portable display device" (http://www.google.com/patents/USD670286 http://www.google.com/patents/USD670286), but I hadn't realized how broadly they could be applied. Is there a threshold that needs to be exceeded when determining how much the grant of a design patent will "promote the Progress of Science and useful Arts"? Or can one expect to receive design patents for any design variation you can dream up?
- DanBC 11y ago
  The article is from 2010. Amazingly shootag is still on sale at Amazon. $35 for two! They have 150 reviews. 42% 5 star, 12% 4 stars and 31% 1 star. The reviews seem to have many genuine people who absolutely believe these work - even though these things clearly can't work. Reading the reviews makes me a bit angry and a bit sad.
  - 11y ago
aplc0r 11y ago
There is also magnetic developer: https://en.wikipedia.org/wiki/Magnetic_developer https://en.wikipedia.org/wiki/Magnetic_developer This is what is usually used today to diagnose issues with magnetic stripe encoding/reading.
pbreit 11y ago
Is there a learning here that something so simple and reliable can work so well for 60+ years despite constant ridicule from in-the-know tech and supposed "insecurity"?
- freehunter 11y ago
  If it's stolen as often as it is, it doesn't really "work so well". It worked well up until it started being used and stored on Internet-accessible machines. As soon as that happened, it utterly failed to "work so well". If you want to know about its "supposed" insecurity, maybe read any of the hundreds of articles online about Target, Staples, Home Depot, PF Changs, Neiman Marcus, Goodwill, Global Payments, UPS, Michaels, and dozens more. I'm not sure what you're arguing, that magstripe is safe enough?
  - TeMPOraL 11y ago
    Magnetic stripe is about as secure as your door key. It's all great as long as it sits in your pocket, but post a close-up photo of it accompanied by your address to Twitter and see how long it takes until the things from your flat start mysteriously appearing on Craigslist.
3JPLW 11y ago
Don't miss the comment where they decode the ShooTag magstripe to contain the DEC-SIXBIT ASCII strings "FLEA" and "TICK": http://www.tetherdcow.com/another-science-experiment/#comment-297446 http://www.tetherdcow.com/another-science-experiment/#commen... Sure to repel them, that. Also, note (2010).
- PebblesHD 11y ago
  >No matter how magnetically sensitive they are, and how smart, insects don’t read English encoded in DEC-SIXBIT. Favourite comment ever.
- rotten 11y ago
  I wonder if you made one that said "hot babe" it would be a chick magnet.
  - dkersten 11y ago
    Chick repellant.
- saiya-jin 11y ago
  now it explains why they don't work in non-english speaking countries. other fleas no hablo ingles! time to send them for some proper schooling...
omgitstom 11y ago
Metal filings can wreck havoc on your lungs / eyes - please use safety precautions if you are attempting this at home
codezero 11y ago
In one of my experimental physics courses we built a circuit to digitize the data on magnetic cards. It really blew my mind when I realized how it was designed to allow variable swipe speeds. If you think about it, it's very cool.
atamyrat 11y ago
You can use laser printer toners to get same effect! They are magnetic as well and might be easier to get. It's also easy to get better contrast - apply transparent tape to magnetic strip, remove the tape and put it on top of white paper. You can clearly see strips.
mgrennan 11y ago
Nothing new here. I was doing this back in the 80 to check on the alignment of 8" floppies and backup tapes.
- nkurz 11y ago
  I downvoted your comment, but then noticed that you have only made two comments here, so this felt needlessly cruel. So I upvoted your first comment as recompense. Your first one was a fine comment. This one is not. I'd be glad to hear more about using this technique to check alignment of floppies. In fact, the top rated comment on this page is about that. But saying "Nothing new here" is unwarranted and crass. While this may be old hat to you, it's interesting to many who might not have considered it. Perhaps more importantly, only the first part of the article is about visually checking the magnetic strip. The rest is about enhancing it using image enhancement, decoding it by guessing likely parity codes, and then detailing years of unsuccessful attempts to discourage people from buying this fraudulent product. Anyway, welcome to HN and please stick around to share your experience by make more comments like your first one.
  - sebastianavina 11y ago
    he is a true veteran, he doesnt care if his comments are popular or not
madez 11y ago
Question: Will this interfer with their invisible fence collars? Answer: I wouldn't know the answer to that for sure - but would not hesitate to use with an invisible fence. This is not an electric type mechanism but rather one of kinetic energy - thus based on the dogs movement...as they move they create body energy and the tag works to keep critters away...not related to any electrical devices etc. I believe on the Shoo Tag site you can reach out to them and there are FAQ's, I'm sure they can clarify 100%. Source: http://www.amazon.com/interfer-their-invisible-fence-collars/forum/Fx29K5XDBM2ROGB/TxFT1NCVR7Y0JB/1/ref=cm_cd_ql_tlc_al?_encoding=UTF8&asin=B0021L8XBO http://www.amazon.com/interfer-their-invisible-fence-collars... Where, again, was the possibility to opt out of being human? I really should’ve had been paying more attention.

321 points by charlieirish 11y ago

For the same reason, the ferromagnetic nature of the magstripe, it is possible to read, store and playback the data information on the stripe. You need only few $ for the reader or a simple Square reader. This is an alternative solution to spoof Magnetic stripe cards on Android: http://cosmodro.me/blog/2011/mar/25/rhombus-square-iskewedi/ http://cosmodro.me/blog/2011/mar/25/rhombus-square-iskewedi/

flax 11y ago
Hey, cool, it's nice to see my stuff get referenced by someone that isn't me! Rhombus only _reads_ magnetic stripe data. It won't write it. But yes, you could totally write to a low-coercivity stripe with the right hardware. Before you run out and get a Square reader, they're all encrypted now and don't return the raw data necessary for Rhombus to work. You can still get unencrypted readers from China on alibaba pretty easily.
- thevdude 11y ago
  I remember requesting a stripe reader when I first saw something about them just spitting out the info, and by the time I got it they were already encrypted.
- Vexs 11y ago
  I actually read your thing a long while ago too! I took it a step further, and made a small coil and amp, and played the recorded data back through the coil, and placed the coil next to a one-track card reader. It actually worked, which was neat.
- luck87 11y ago
  There are same crazy nerd which enjoy themself (I don't know why) to decrypt credit card data coming off of a magnetic stripe scanner: https://www.parthenonsoftware.com/blog/how-to-decrypt-magnetic-stripe-scanner-data-with-dukpt/ https://www.parthenonsoftware.com/blog/how-to-decrypt-magnet... But I agree with you, an un-encrypted reader of magnetic stripe is very easy to find or build. The security is like a door in the desert.
brokentone 11y ago
Here is a spoofer for Arduino which I have constructed myself once: http://www.instructables.com/id/Arduino-Magstripe-Emulator/ http://www.instructables.com/id/Arduino-Magstripe-Emulator/ Rather fun.

Others 11y ago

What I'm confused about here is why the ShooTag actually has any data on it at all. Surely it would be cheaper to just make part of the plastic card black, instead of actually going to the trouble of encoding something on it.

tikhonj 11y ago
One thing to consider is that the creators might very well believe it works themselves. It's easy to fool yourself into believing something you want to believe. They might even have done some informal, poorly structured tests and gotten the results they were expecting for other reasons, reinforcing their beliefs. Hell, I've done this to myself (ie when debugging) so I can totally empathize.
- bentcorner 11y ago
  Reminds me of Esio Trot: https://en.wikipedia.org/wiki/Esio_Trot https://en.wikipedia.org/wiki/Esio_Trot
  - metasean 11y ago
    I hadn't heard of Esio Trot, but sounds like a definite fit. I was actually reminded of "Hidden Messages in Water" - https://duckduckgo.com/?q=%22hidden+messages+in+water%22 https://duckduckgo.com/?q=%22hidden+messages+in+water%22
- freehunter 11y ago
  I would probably die of embarrassment if anyone ever saw the number of lines in my code that say x = x //this doesn't need to be here but it breaks if you remove it
  - moron4hire 11y ago
    Wouldn't it be better to figure out why it breaks?

PirateDave 11y ago

When he pulled the ShooTag out I thought he was totally going to write the card data to it. Nonetheless, interesting article.

stephengillie 11y ago

It might be interesting to perform this same experiment with a Coin Card. It would be cool to see the patterns shift as it remagnetizes its bars.

Animats 11y ago

Yeah, the ShooTag thing is totally bogus. Viewing magnetic recordings with magnetic particles used to be a standard maintenance tool. It was used to check tape drive head alignment. There was a liquid with iron particles in suspension into which you could dip a strip of tape. When the solvent evaporated, you could see the data tracks. A non-destructive version was a hand-held viewer, with a window on top and a thin plate on the bottom, filled with a fluid containing iron particles. You could press this against a tape and view it. These were sometimes used in data centers during the transition from 7 to 9 track tape drives, when an incoming tape had an unknown format.

castratikron 11y ago
The liquid is called magnetic developer. http://www.q-card.com/products/magnetic-developers.asp http://www.q-card.com/products/magnetic-developers.asp
rtanaka 11y ago
The liquid (also comes in spray form) still exists. It's called a Magnetic Developer: https://en.wikipedia.org/wiki/Magnetic_developer https://en.wikipedia.org/wiki/Magnetic_developer
- seanp2k2 11y ago
  Wow, never heard of this. Gotta love the old-skool tech!
  - MichaelCrawford 11y ago
    The very first time I wrote an interrupt handler, it was in octal, entered by a numeric keypad into an LSI-11 with DEC's ODT - "Octal Debugging Technique". I wish I could say I was paid to do that but it was for UC Davis' Intro to Computer Architecture Class. I got a C because I cratered the final.

DanBC 11y ago

You used to be able to buy magnetic field viewers to inspect tape. Here's a picture of one: http://nickapedia.com/2011/02/21/back-to-the-geek-future-cool-old-stuff/ http://nickapedia.com/2011/02/21/back-to-the-geek-future-coo... Another fun thing you can do is put the iron filings in a jar with mineral oil. Give it a good shake, then put a strong magnet on the side. You'll be able to see the magnetic field in 3D.

nkurz 11y ago

A beautiful story about the inner workings of a patent-pending species-specific insect repellent based on a small strip of magnetic strip. As one might guess, it involves encoding the words "FLEA" and "TICK" on the strip. Or maybe "AELF" and "KCIT" to properly actuate the quantum polarity? The story was written in 2010 while the patent was still pending. But surely it's been rejected by now. Nope. Also as one might guess, the patent was granted by the USPTO with the the main claim intact: https://www.google.gg/patents/US8382001 https://www.google.gg/patents/US8382001 Have you ever thought to yourself "Sure, this advertisement says 'patent-pending', but that only means that someone was able to scrape together enough money to file a patent. It's not like someone has vetted the technology and actually granted them a patent." Well, now you see that you can safely shorten that to "Sure, this advertisement says 'patented', but that only means that someone was able to scrape together enough money to file a patent. It's not like someone has vetted the technology." This is probably not surprising to anyone who understands the role of patents. They aren't designed to act as evidence that a technology is useful, or even possible. Instead, they are designed to "promote the Progress of Science and useful Arts", which seems to be interpreted as to "create a secondary market for dubious patents". I was surprised though to see that they had been granted a second patent, covering the ornamental design of the tag: http://www.google.com/patents/USD626704 http://www.google.com/patents/USD626704 I was aware that design patents existed to cover essential innovations such as the rounded corners of a "portable display device" (http://www.google.com/patents/USD670286 http://www.google.com/patents/USD670286), but I hadn't realized how broadly they could be applied. Is there a threshold that needs to be exceeded when determining how much the grant of a design patent will "promote the Progress of Science and useful Arts"? Or can one expect to receive design patents for any design variation you can dream up?

DanBC 11y ago
The article is from 2010. Amazingly shootag is still on sale at Amazon. $35 for two! They have 150 reviews. 42% 5 star, 12% 4 stars and 31% 1 star. The reviews seem to have many genuine people who absolutely believe these work - even though these things clearly can't work. Reading the reviews makes me a bit angry and a bit sad.
- 11y ago

aplc0r 11y ago

There is also magnetic developer: https://en.wikipedia.org/wiki/Magnetic_developer https://en.wikipedia.org/wiki/Magnetic_developer This is what is usually used today to diagnose issues with magnetic stripe encoding/reading.

pbreit 11y ago

Is there a learning here that something so simple and reliable can work so well for 60+ years despite constant ridicule from in-the-know tech and supposed "insecurity"?

freehunter 11y ago
If it's stolen as often as it is, it doesn't really "work so well". It worked well up until it started being used and stored on Internet-accessible machines. As soon as that happened, it utterly failed to "work so well". If you want to know about its "supposed" insecurity, maybe read any of the hundreds of articles online about Target, Staples, Home Depot, PF Changs, Neiman Marcus, Goodwill, Global Payments, UPS, Michaels, and dozens more. I'm not sure what you're arguing, that magstripe is safe enough?
- TeMPOraL 11y ago
  Magnetic stripe is about as secure as your door key. It's all great as long as it sits in your pocket, but post a close-up photo of it accompanied by your address to Twitter and see how long it takes until the things from your flat start mysteriously appearing on Craigslist.

3JPLW 11y ago

Don't miss the comment where they decode the ShooTag magstripe to contain the DEC-SIXBIT ASCII strings "FLEA" and "TICK": http://www.tetherdcow.com/another-science-experiment/#comment-297446 http://www.tetherdcow.com/another-science-experiment/#commen... Sure to repel them, that. Also, note (2010).

PebblesHD 11y ago
>No matter how magnetically sensitive they are, and how smart, insects don’t read English encoded in DEC-SIXBIT. Favourite comment ever.
rotten 11y ago
I wonder if you made one that said "hot babe" it would be a chick magnet.
- dkersten 11y ago
  Chick repellant.
saiya-jin 11y ago
now it explains why they don't work in non-english speaking countries. other fleas no hablo ingles! time to send them for some proper schooling...

omgitstom 11y ago

Metal filings can wreck havoc on your lungs / eyes - please use safety precautions if you are attempting this at home

codezero 11y ago

In one of my experimental physics courses we built a circuit to digitize the data on magnetic cards. It really blew my mind when I realized how it was designed to allow variable swipe speeds. If you think about it, it's very cool.

atamyrat 11y ago

You can use laser printer toners to get same effect! They are magnetic as well and might be easier to get. It's also easy to get better contrast - apply transparent tape to magnetic strip, remove the tape and put it on top of white paper. You can clearly see strips.

mgrennan 11y ago

Nothing new here. I was doing this back in the 80 to check on the alignment of 8" floppies and backup tapes.

nkurz 11y ago
I downvoted your comment, but then noticed that you have only made two comments here, so this felt needlessly cruel. So I upvoted your first comment as recompense. Your first one was a fine comment. This one is not. I'd be glad to hear more about using this technique to check alignment of floppies. In fact, the top rated comment on this page is about that. But saying "Nothing new here" is unwarranted and crass. While this may be old hat to you, it's interesting to many who might not have considered it. Perhaps more importantly, only the first part of the article is about visually checking the magnetic strip. The rest is about enhancing it using image enhancement, decoding it by guessing likely parity codes, and then detailing years of unsuccessful attempts to discourage people from buying this fraudulent product. Anyway, welcome to HN and please stick around to share your experience by make more comments like your first one.
- sebastianavina 11y ago
  he is a true veteran, he doesnt care if his comments are popular or not

madez 11y ago

Question: Will this interfer with their invisible fence collars? Answer: I wouldn't know the answer to that for sure - but would not hesitate to use with an invisible fence. This is not an electric type mechanism but rather one of kinetic energy - thus based on the dogs movement...as they move they create body energy and the tag works to keep critters away...not related to any electrical devices etc. I believe on the Shoo Tag site you can reach out to them and there are FAQ's, I'm sure they can clarify 100%. Source: http://www.amazon.com/interfer-their-invisible-fence-collars/forum/Fx29K5XDBM2ROGB/TxFT1NCVR7Y0JB/1/ref=cm_cd_ql_tlc_al?_encoding=UTF8&asin=B0021L8XBO http://www.amazon.com/interfer-their-invisible-fence-collars... Where, again, was the possibility to opt out of being human? I really should’ve had been paying more attention.