Magnetic Stripe Snooping at Home

pbrinich writes "Have you ever wondered what information is actually stored on all those cards you have in your wallet? Well, it turns out you can find out yourself! An excellent project, Stripe Snoop started by Billy Hoffman, a Georgia Tech computer science student, contains schematics, source code and a wide variety of information about the standards used to store all sorts of information on your magnetic cards."

Comments

to sum up a lot of comments...

[niteice]

*puts on tinfoil hat*

Re:to sum up a lot of comments...

[Living WTF]

You have a magnetic stripe on your head?

Re:to sum up a lot of comments...

[madaxe42]

I can't imagine putting his head through a card reader is terribly comfortable.

KER-CHUNK-click.

'Have a nice day sir!'

Re:to sum up a lot of comments...

[value_added]

Not enough.

You need this as well.

POS

[BrianHursey]

This would be intresting to use for some open source point of sale systems... *Project ideas flying through head*

Re:POS

[dhbiker]

A nice idea but isn't magnetic stripe rapidly becoming obsolete (and being replaced by Chip and Pin)

Gives new meaning...

[Reignking]

Gives new meaning to the Capital One tagline "What's in your wallet?"

Missing Information

[jgbishop]

I'm just shocked at what *isn't* on my cards. For example, every time I go to my bank's ATM, I have to indicate whether I want to do business in English or Spanish. Shouldn't that information be on the card? I mean, the card is *mine* - they know who I am. Surely that should indicate what language I speak...

Re:Missing Information

[caino59]

Yah know - I have wondered that myself so many damned times.

Hell, just put my pin on there while we're at it. Just put in a fingerprint reader for some biometric authentication.

Now that'd be nice. Just get rid of the card altogether, pay for that purchase with a fingerprint.

Ugh, I better stop, someone is bound to be watching and realize that's a great way to generate a more accurate, more complete, and constantly updated finger print database....

Re:Missing Information

[Anonymous Coward]

Actually there is a place for this on the stripe but since many Banks do not issue cards with this information:

a) Another Bank cannot assume the information is correct
b) The Bank that does not do this reliably itself has to assume everyone else is just as reliable (at its own ATMs)
c) The Bank that does do this reliably assumes that no one else does (see b)

So the result is that only if you are at one of you own Bank's ATM's and they know they do it reliably will you be likely to get the correct language dialog offered by default.

Re:Missing Information

[swillden]

I'm just shocked at what *isn't* on my cards. For example, every time I go to my bank's ATM, I have to indicate whether I want to do business in English or Spanish.

Well, if you were the engineering committee assigned the task of defining the standard data structures to be placed on all ATM cards, thinking about account codes, card verification codes, etc., and realizing that you have limited space to work with without adding more tracks (meaning more expensive readers and perhaps even slightly more expensive cards), would it have occurred to you to put the cardholder's language preference in there?

I can tell yout that it wouldn't have occurred to me. And these data layouts can't be changed without going through a formal standards process, because they have to work in every ATM in the world (and now at many grocery stores, department stores, etc.).

So, I'm not surprised at all that that data isn't there. If you want to be surprised by this, you should probably be surprised that the bank didn't choose to store your language preference in their database and then look it up when you swipe your card. That's the sort of feature that a bank can offer to its own customers at its own ATMs without having to get the rest of the world to agree.

Re:Missing Information

[should_be_linear]

Well, everything is online AFAIK, so good SW engeneer will tell you that it needs only unique GUID of person to be stored on the card. Everything else ATM can download from the central (distributed) server. Adding new informations/functions only requires update/inovation on ATM side, not changing cads.

Re:Missing Information

[Otter]

If you want to be surprised by this, you should probably be surprised that the bank didn't choose to store your language preference in their database and then look it up when you swipe your card.

Exactly. There's no reason why that should be on the card, and my banks (Bank of America, formerly Fleet, formerly BankBoston, formerly Bay Bank, formerly...) have stored a language preference in the account data as far back as I can recall.

Re:Missing Information

[Aidtopia]

So, I'm not surprised at all that that data [language preference] isn't there. If you want to be surprised by this, you should probably be surprised that the bank didn't choose to store your language preference in their database and then look it up when you swipe your card.

I'm sure things have changed a lot in how the ATM networks work, and such a scheme may be feasible now, but this wouldn't have fit the model they had when first introduced. Throughout the 1970s, my mother, father, and step-father all wrote code for banking terminal systems and some of the first ATMs. From them I learned:

There was one roundtrip to the bank's central computers after you had entered everything for the transaction. I assume this was for scalability. The ATM would collect your card number, PIN, and transaction request and send it as a single request the central computer. That's why they wouldn't tell you about a mistyped PIN until you've entered everything else for your transaction. Transactions were stored in a secondary database which were posted to your real account record overnight.

In the good old days, the bank didn't assign a PIN for you, store it in a database (which could be snooped by employees), printed it on paper (which could be discovered by anyone), and send it to you in the mail (which could be stolen). Instead, to activate your account, you went to your local branch. A teller would come out to the ATM with you, put his/her card into the machine, enter his/her PIN, then insert your card, and finally turn his/her back while you entered a PIN of your choice. PINs were hashed in the ATM and the bank only ever had the hash, not the original value.

Re:Missing Information

[Grishnakh]

All official business in the US is done in English. I see nothing wrong with assuming US residents know English, and letting them select otherwise later.

Re:Missing Information

[Politburo]

In the good old days, the bank didn't assign a PIN for you, store it in a database (which could be snooped by employees), printed it on paper (which could be discovered by anyone), and send it to you in the mail (which could be stolen).

My bank (Bank of New York) doesn't discuss PINs, ever. If you need a new one, get to a branch. When I set my PIN, it was similar to what you describe, except we did not use the ATM, just a standalone reader and keypad that I assume was hooked into their central system. I figured every bank did it this way, but based on your language, that is apparently not the case.

Re:Missing Information

[Politburo]

I would think that this was done for security. If a malicious person had a person's card and PIN, and wanted to lock someone out of the account, they couldn't do so immediately, and if they did not have access to the person's mail, they would be SOL. I don't think that them sending you a new card means that the PIN is definitely embedded in the stripe. That doesn't seem logical.

Re:Missing Information

[GoRK]

Sometimes I like to use the spanish option for fun. I don't speak or understand most spanish, but I never have a problem getting through it to get some cash.

When I first got my drivers license, the "written" test was actually taken at a computer terminal. There was a long line at every one except for the spanish-language one. I asked what happened if one failed the test -- the DMV lady said that you could re-take it right then up to three times a day until you passed (obviously this is to ensure that there are plenty of dumbasses driving around for cops to be able to issue tickets)

Anyway, I had nothing to lose and hours of time to gain, so I sprang for the spanish test. It was multiple choice with lots of pictures.

Re:Missing Information

[DutchSter]

I'm just shocked at what *isn't* on my cards. For example, every time I go to my bank's ATM, I have to indicate whether I want to do business in English or Spanish. Shouldn't that information be on the card? I mean, the card is *mine* - they know who I am. Surely that should indicate what language I speak...

Working for a bank, this one should be a home run, and a shameless plug...except that I'm not going to name my employer. There's several different reasons why that stuff isn't stored on a card itself. The two biggest are bandwidth and the availability of equipment to re-encode a card with your preferences.

However, that does not mean that the ATM network servers cannot store your preferences. The bank I work for has begun rolling out a "My Preferences" feature on the new Diebold ATM machines. It lets you set a language, receipt option (yes/no), fast cash amount, and some other options. When you stick your card in, not only does it authenticate your PIN, but it pulls your preference file from the server. You can make updates any time from the on screen selections. It's pretty neat, you can cut at least three screens out by setting up those default responses.

It has been interesting to see the marketing stats on how many times customers interface with the ATM before they decide to press the "Set up My Preferences" button. Right now the average is about 3 for those that are going to use the feature.

Re:Missing Information

[plover]

There's a lot of FUD in this discussion, and I'd like to clear a bit of it up. First, track data is very strictly formatted. If you are issuing a card for use in financial transactions, it needs to be encoded according to ISO 7811, 7812 and 7813 standards. These standards declare what each and every character on the cards means, how it is to be encoded, how it is to be read and how it is to be interpreted. And these standards do NOT currently contain a field for "Primary language of cardholder". Therefore, they can't store this information on the card, because nobody would know where to use it.

And just for more information, track 2 has space for only 40 bytes of numeric data (it's a 4 bit character set that has no alpha capacity.) It has provisions for a country code, but only for cards in a specific format. The country code is to be used primarily to determine and display exchange rates to the cardholder. Currently, most credit cards issued in the United States use anywhere from 29 to 36 of the 40 available bytes. Many European cards use 33 to all 40. And some cards violate the standards, and exceed the maximums. Customers of these banks get turned away by retailers whose driver software refuses to parse these tracks.

Any remaining space not covered by the required fields falls into a "discretionary data" field. This can be anywhere from 0 - 11 digits. Typically banks place a random nonce into the cards to ensure that the stripe could not be created without the card present.

Technically, a specific bank could choose to issue cards that have an ISO language code embedded in their own discretionary data field, and could program their ATMs to respond to their cards. (They could also choose to have their own 0-9 language code, offering ATM services in one of 10 languages.) But any such system would be proprietary, and would not be respected outside of their own private network. That's why people see "Retrieving preferences" messages: the card is looked up first, and the preferences are transmitted back to the ATM. This method can be implemented by any ATM system, and will work regardless of what the issuing bank does on the mag stripes.

Something else to keep in mind is that mag stripes turn over very slowly. That means you cannot just change the stripe format and expect magic to happen overnight. These cards are issued at great expense once every four years or so. I believe it costs somewhere around $2.50 or $3.00 to create and mail a new card. Multiply that by a million card holders, and that's an expense you want to avoid as much as possible.

Finally, keep in mind that all this is based on 1970s era technology, and was developed with a distinctly American bias. Languages and disabilities were not a part of the landscape of the era.

Time to start the over/under pool

[aendeuryu]

Since one of the listed articles talks about common security blunders with cards, it's time to start the over/under pool on how long it takes before this guy gets shut down by some corporation claiming DMCA violations.

I call one week.

Re:Time to start the over/under pool

[Threni]

I knew someone would say something like this. I also correctly predicted that no attempt whatsoever would be made to justify the statement, what with the mag stripes not being encrytped in any way, belonging to universal standards regarding how the data be read (and written) on the multitude of devices out there. Nice easy way to bumb your karma up!

From the "Why Use It?" portion

[Reignking]

Open your wallet. How many cards in there have magstripes on them? Three? Four? Five? Ever wonder what was encoded on them?

I know I did. I had six cards in my wallet with magstripes. One day a friend of mine had a $200 Magstripe reader, so I ran my cards through. Aside from the expected credit card numbers, I was surprised by the amount of personal information encoded on them. In fact, for reasons I still don't know, 2 cards contained my social security number.

Re:From the "Why Use It?" portion

[crunk]

I didn't say I was "worried" about it, but it would be intresting to know. I am not in the military, but I do remember the bar code from when I was a dependent and had a military I.D.

BTW, I am a contractor and we use the same types of cards you are talking about. Not in the office I work at, but at other offices we have. In one office I can think of the doors actually authenticate you _and_ open the door automatically as you walk towards it. Pretty neat stuff.

Re:From the "Why Use It?" portion

[rayzat]

http://turbulence.org/Works/swipe/main.html It has a java program that reads a picture of a barcode and tells you what information it contains.

Re:could be worrying

[REBloomfield]

except it isn't............

Hoffman

[delirium of disorder]

Billy Hoffman, aka Acidus, is one of the top up and comming security experts; he probably knows more about card systems and ATMs then anyone outside "the industry". I had the privilage of seeing him speak and phreaknic and hope his contributions to the hacking community continue. People like him keep the rest of us free and informed dispite the massive corporate, academic, and government powers that would have otherwise. So....Thanks!

Re:Lovely...

[Corporate Drone]

[shrug]... security through obscurity is oh-so-effective, ain't it?

wouldn't it be interesting if this were to cause a groundswell of support for the recently proposed RFID credit cards? ack...

Nothing new to thieves

[szlevente]

I don't think articles such as this one will bring anything new to those who are in the business of credit card stealing. But it should serve as an eye-opener and for raising awareness for the average card user. Being a little more careful with that card should help a lot, I guess. Besides, I let the bank use my money for a reason, right? They should take the risk on themselves...

Re:could be worrying

[Anonymous Coward]

Your pin is not stored on the card at all. If you have two cards for one account, and go to an ATM with one, switch your pin, the other will have been switched also without being put in a machine. The pin is connected to an account, not a particular card.

More info....

[thoughtcr1mes]

Stripe Snoop was discussed in detail by its author on a show called Binary Revolution Radio awhile back. You can download the ep, #56, at: http://www.binrev.com/radio/archive.html/ -enjoy, it's a really good show!

Encrypted PIN on credit cards?

[Anonymous Coward]

One of the screenshots shows that there's an encrypted PIN stored on credit cards. How soon before we are able to de-encrypt that? Then all a thief needs is a magstripe reader, this free program, and the decrypter program, to start his business.
Even if it's irreversible, it can't be too hard to brute force number-only PINs.

Re:Encrypted PIN on credit cards?

[rhombic]

"it can't be too hard to brute force number-only PINs."

Yeah, especially since all the ATM cards I've ever used use only four digit PINs (securing all of your cash with a 14bit key???)

I doubt if you'd even have to brute force it. Look in the right places, you can probably find the hashing algorithm (even if they're not using something obvious, which they probably are). Just generate all 10000 hashes and use it as a lookup table for all the cards you can get your hands on. Yikes.

Re:Encrypted PIN on credit cards?

[Anonymous Coward]

It can't be "brute forced" or "cracked", any more than you can tell what the OTP enciphered message "htpn juio gowew" says without the pad. In modern banking systems it's part of a two factor system, in which you need the algorithm plus ANY TWO of the following in order to figure out the third

* Real PIN (typically stored in customer's brain, sometimes also on a PostIt stuck inside their desk drawer)

* PIN offset (stored on magstripe of card)

* Stored PIN from database (stored in a secure machine at the bank, probably along with your current balance)

You can imagine that the function used is XOR, but actually there are various methods that could work, and I've never investigated which one is used. However this system lets several moderately clever things happen...

1. You can have two cards (e.g husband and wife) for the same account with different PINs, yet store only one PIN in the database

2. ATMs can change the PIN by knowing your old and new PIN, then applying the changed offset to the magstripe.

3. By leaving the PIN unchanged and issuing a card with a different offset the bank can send you a new card, with a new PIN, without instantly disabling your old card and PIN.

4. Knowing the PIN, and having a valid card number are not sufficient to validate yourself to the ATM network. You don't know the offset that goes with that PIN, you'd have to steal (or at least read) the customer's card to get a valid offset.

5. The real PIN is never sent over the network. So if you have an opportunity to eavesdrop on bank network traffic you don't learn the PIN for anyone's card.

This is actually pretty clever stuff, the banks can be many things, but they're not stupid, you don't last long in financial circles if you are.

Re:Encrypted PIN on credit cards?

[fixer007]

Not really... As said earlier the 'PIN' on the card is not actually the PIN at all. It is merely an offset which is used along with a DES key and the PAN to calculate the real PIN. Your bank may either store the real PIN on their host system or use this offset calculation method. The PIN is transmitted over the line during a transaction (unless the ATM verifies for you). It is either DES or TDES encrypted, so technically that could be brute-forced.

I just tried mine...

[Anonymous Coward]

It said "Paul is dead"

What's that mean?

Your worries are misplaced

[Laurentiu]

The average Joe is very careful with his plastics, and won't loose the suspicious waiter from his sights while the later handles his credit card. The same Joe will thoughtlessly type away his credit card number as a means of "age verification" in some random Paris Hilton pictorial site.

A hacker getting through his poorly set up XP box and stealing his credit card number is more dangerous than a device needing the presence of a physical card. And, of course, there are this kind of occurences, which are the most worrying of all.

I've done this

[The Hobo]

I've actually done this myself, purchased the magnetic reader, some electrical parts, soldered the thing together. Once I had things going, when you swipe say a Visa, it lists the card #, the expiry date, and the issuing bank. I've also tried it with a bank card, and it does list the bank card #, and an 'encrypted pin', which, if I understand correctly, is encrypted with triple DES (that's what I remember, I may be wrong). I also swiped my University student card, but can't yet make out what it has stored. Finally, I swiped an M&M Meat Shops Max Member card and all it has on it is the max member #, nothing more. Also, the person I did this with created some shims to raise the card so as to read the 2nd and 3rd track. It was overall a neat project.

But the important part is...

[zoharroy]

you can use it (like he did) to build your own coke machine....
http://www.yak.net/acidus/magstripe/coke.html

Re:could be worrying

[Skye16]

That's why, when you go to an ATM and put your pin in, you could put the wrong in one and it isn't going to tell you until you actually make the withdrawal/deposit. It has to connect to whatever-the-hell-it-connects-to and send it the pin info account info and the request and if the pin is invalid, then it spits out your card and tells you you messed up.

I wonder if the information sent to whatever-the-hell-it-is is encrypted... :O

Transcript

[mushupork]

As Dave starts sliding his cards thru the reader, looking at all of his private info flashing up on his monitor...a red camera eye fills the screen:

Dave Bowman: What's the problem?
HAL: I think you know what the problem is just as well as I do.
Dave Bowman: What are you talking about, HAL?
HAL: This mission is too important for me to allow you to jeopardize it.
Dave Bowman: I don't know what you're talking about, HAL.

Errie, eh?

Why do I get the impression

[Anita Coney]

that a few weeks after ordering the necessary hardware, you'd get sued or arrested.

Re:Why do I get the impression

[JohnGrahamCumming]

I bought a magstripe reader that connects to the keyboard port of my laptop and looks like a keyboard. Don't need any special software to read the output because it emulates key presses. I just go into the emacs scratch buffer and swipe the card. The reader even puts end-of-line characters at the end of each track.

Can someone point out why Stripe Snoop is better than my solution?

John.

Re:Why do I get the impression

[DigitalSorceress]

"Can someone point out why Stripe Snoop is better than my solution?"

Not just because it's cheaper, but the author of Stripe Snoop is showing people how to build their own from parts (encouraging an interest in Electronics) as well as providing Open Source software that not only reads from the hardware he built, but also will deal with data from your reader, and provides added functionality (as the article compares) sort of like a CDDB that will help you figure out what some of the data means... Software you can take apart and put back together again in your own way to maybe learn something and create something new by building on his work.

Changing the Strip

[n0dalus]

How easy would it be to edit the data on the strips?
For example, would it be possible for me to take my magnetic bus ticket and easily add another 10 trips to it?

Re:Changing the Strip

[hackstraw]

How easy would it be to edit the data on the strips?

Its trivial. You can get a magstripe writer for a couple hundred bucks, max.

For example, would it be possible for me to take my magnetic bus ticket and easily add another 10 trips to it?

Depends on how the bus tickets are set up. If they have a unique identifier on them and it looks up your balance against a central database. No luck. If the info is stored on the ticket itself, it should be trivial. Although the paper bus and train tickets are not the same as standard CC style cards.

Interesting trivia on the subject.

Ever wonder why the person swipes your credit card and then enters the last 4 digits that are hologram embossed on the card manually?

Because its trivial to put any account number on the card.

CC numbers have an internal checksum, so you cant simply make up a number that will match the last 4 digits. The odds of reprogramming your card with an active and valid account that matches your last 4 digits printed on your card are pretty low.

Re:Changing the Strip

[Anonymous Coward]

The checksum method for credit cards is well known and isn't even close to sha-1 or md4/md5 in terms of security. It isn't that much harder to break than crc32 is for programs that check their crc32 checksum. Of course it would take time unless you just happened to have a large database of active credit card numbers available such as one from Choicepoint.

Re:could be worrying

[dknj]

I wonder if the information sent to whatever-the-hell-it-is is encrypted...

Yes. Even those standalone-shady-looking ATM's that dialup an 800 number and connect at 1200baud will have encrypted transmissions.

Re:DMCA time?

[swillden]

The DMCA's anti-circumventions provisions only apply to (a) copyrighted materials that are (b) "protected" by an anti-copying technology. Account codes and cardholder info are pure data, which is not copyrightable, and there is no anti-copying technology applied here, so there's nothing to circumvent.

So, no, the DMCA doesn't apply.

Dupe!

[Anonymous Coward]

At least it's been off the front page a while this time.

Re:could be worrying

[eison]

PINs aren't stored in the stripe. Not plaintext, not encrypted, not at all.

Schematics and instructions.

[WOV]

The new Make magazine has a heavily-photographed and pretty intelligible partslist / walkthrough of building the actual device, as well. http://make.oreilly.com/

Re:Hurray !

[TrippTDF]

I did something like this once. Back in 2001 I worked at a company that had Internet Kiosks across Manhattan. I went to a cafe to upgrade a machine. There was a certain attractive young lady on the terminal when I got there. I called my manager (who was a friend) and told him it would be a few minutes before I could get on, and mentioned the cute girl.

He did a query of the database to get her name from the credit card she swiped. As she was getting up I said "have a good day, Jen". Scared the CRAP out of her until I explained how I did it. We are now married and have three lovely children

Ok, that last part isn't true.

Re:could be worrying

[nkh]

It has to connect to whatever-the-hell-it-connects-to

It's called a computer. I know, I'm using one right now and in a few years, they'll be everywhere and you'll buy one to play games!

Waay back when I was a youngun

[Matey-O]

They put a mag strip access lock to the computer lab in college. We were complaining at having to now carry around our student I.D.s to get access to the labs when I found out ALL of my credit cards allowed access to the lab. (Not smart, but hey, this was 1989)

Turns out the Lab assistant that installed the lock thought it'd be cool if any card he pulled out of his wallet would open the door. But the local bank's first 9 digits on the mag strip was the same for ALL cards they issued.

Re:Waay back when I was a youngun

[g0at]

This makes me think of the after-hours door-entry things at bank ATMs, where you have to insert a card in order to unlock the door to the vestibule where the ATM is. Invariably, any such door I've tried will respond to any magnetic card at all.

What is the point of these? Obviously not security. I suppose it must be to keep homeless people out, since they are least likely to carry any kind of magnetic card.

-b

Re:Waay back when I was a youngun

[atomic_toaster]

...after-hours door-entry things at bank ATMs... Invariably, any such door I've tried will respond to any magnetic card at all. What is the point of these?

Especially since most people will be polite and hold the door open for someone behind them... It doesn't even keep homeless people from sheltering in the ATM vestibule, because they just have to wait for someone to go in the door and then slip into the vestibule before the door closes. All the swipe-card locks on ATM vestibules do is make it more annoying to get into the building in the winter, when it means that you have to take your gloves off in the freezing cold to get that stupid card out of your wallet. Yeesh.

Contents of drivers license barcode

[lmsig]

Nothing exciting is in that barcode; just what is on the front of your license, at least in new york state where I tried it. I had written a PDF417 barcode reader a couple years back and we used the back of our licenses as some test data just to see. It is literally just everything from the front side (name, address, height, wieght, etc). The interesting stuff will be in the database that this info is the key for!

Re:could be worrying

['nother poster]

Last I checked, my PINs are by card. My PIN and my wifes PIN are different, but access the same accounts. At least for my financial institution, the pin is stored on the card, but in tripple DES encryption. When I perform a transaction, the pin I enter, and the encrypted PIN are both sent to my bank, which encrypts the PIN I enter with thier key, and compares them. No matchee, no money. When I changed my PIN a few years back, they punched my account data into a terminal, I put in the pin I wanted, and then swipped the card. When I walked back to the loby, my card worked with the new PIN, no problem.

PayByTouch

[plover]

There are companies offering just that. We looked at PayByTouch, a company that offers a "digital wallet" that you can access at participating retailers. As a customer, you go to a kiosk, register your fingerprint, and swipe the cards you want to store in the "wallet". At the point of purchase, you key your phone number and touch the fingerprint reader, and the PIN pad brings up your wallet where you can scroll through your cards and select the one you want for this transaction.

According to PayByTouch, the phone number is used as an index to speed fingerprint matching. The PBT computer located at the point of sale device turns the fingerprint data into a hash on the spot prior to sending the request over the network, so the "clear" fingerprint isn't stored or sent anywhere.

I personally thought customers would find "fingerprinting" to be too Big-Brotherish, but many pilot customers preferred the idea of using a fingerprint over carrying a wallet full of credit cards and shopper loyalty cards. But at the time we looked at them, Visa refused to certify them as being as secure as a mag stripe, so the idea died around here.

Re:PayByTouch

[100lbHand]

Cute young lady walks up to you.
"Oh hi, your cute.
Can I get your pone number?
Great, hold my drink while I write it down."
She goes home pulls your print from the cup, makes a false fingertip.
You get cleaned out.

Re:Hurray !

[Nijika]

Scared the CRAP out of her until I explained how I did it.

Where can I find a copy of your new book; How to collect restraining orders.

Re:DMCA time?

[JavaNPerl]

Most of the information about credit cards is contained within various ISOs. IANAL but, I don't think legal actions could be taken against software which implements a public specification. Although this project is nice, there isn't much you can't figure out about CCs by reading the specs. Personally I've found the most interesting information is contained on cards which are not well defined like student ID cards, video rental cards, etc.

ISO 7810 Physical Characteristics of Credit Card Size Document
ISO 7811-1 Embossing
ISO 7811-2 Magnetic Stripe - Low Coercivity
ISO 7811-3 Location of Embossed Characters
ISO 7811-4 Location of Tracks 1 and 2
ISO 7811-5 Location of Track 3
ISO 7811-6 Magnetic Stripe - High Coercivity
ISO 7813 Financial Transaction Cards
ISO 4909 Track 3 Data Format

The proper place for this information...l

[wowbagger]

The proper place for information like language preference is not on the card, but rather in the bank's database that the ATM accesses.

Ideally, when the card is first inserted the ATM will ask for non-secure data from the bank - things like language pref and such. If the card is NOT valid, the bank could send back default data (to prevent using that to ease checking of forged cards).

By seperating the prefs from the card, you can update the card without losing the prefs.

(Slashbots: Notice that the word is losing, not loosing!)

Truth does not matter

[jimbro2k]

We can still sue you for possible DMCA violations and watch you impoverish yourself trying to defend yourself. It is the (not-so-new) common strategy to shut people up.
Whether or not this is an actual DMCA violation does not matter.

Building the reader is in Make

[neile]

The first issue of Make had a whole article, with parts list and clear directions, on how to attach a card reader to your computer and use the Stripe Snoop software to read off the information.

my bank *does* do this

[sbma44]

Bank of America has rolled out new color touchscreen ATMs in the DC/Metro area that retrieve user preferences based on the inserted card. You have to set them the first time, of course, but then it'll pull it up automatically. In addition to language choice, it also tracks whether you want receipts (and for which transactions) and some other preferences (how much money you want when you hit "fast cash").

It's a decent system, but it's sloooow compared to the old monochrome monitors. And worse: the biggest problem is the touchscreens break all the time.

Still, the general idea seems right. Keeping the GUID on the card is the right idea.

Re:Hurray !

[TrippTDF]

I'm still looking for a publisher, actually. All the ones that I took it to originally have taken out restraining orders against me.

134 and counting, baby!

Re:Hurray !

[R2.0]

"Ok, that last part isn't true"

What, your children are ugly? Such honesty is refreshing.

pay to play (but not that much)

[jdw242b]

for the record, less expensive readers are available.
I used one to snoop my cards and found some interesting information...

Try this link: http://www.posguys.com/category.asp?catID=4

Snore....

[feloneous cat]

I did this over six years ago... A lot of the info was on the net then and it is incredibly dull how little info is really stored. Worse, Japanese credit cards have a hidden stripe on the FRONT of the card (just in case you wanted to know). You can get a mag-stripe reader for these pretty easily. Personally, I still think RFID is more interesting...

University IDs

[langelgjm]

I'm an undergrad student in the University of Maryland system. I managed to write some simple C and Perl programs a while back for a reader I obtained, and ran quite a few cards through them. I found that our university issued ID cards have our social security numbers stored on them, unencrypted. A friend filed some public information request acts requesting to know if the university stored data such as the time and locations of card swipes, and if that data was attached to the student in any way. After initially denying this, the university eventually admitted that they do store data, and sent the guy a copy of his records, which indicate to the second when and where he swiped his card, in addition to when he went to the gym, how much he bought at the dining halls, etc. So much for privacy. I'm no engineer or programmer, and I was able to do this fairly easily; it can't be that hard to build an intercept and install it within a reader that's attached to a door, and voila - hundreds of SSNs. We're trying to contact some people in the school media and administration and have something done.

Re:University IDs

[Reignking]

Even worse: the University of South Carolina had your SSN in plain site on their ID cards. Oh wait, that's if you could crack the system! It was XssnXX on mine.

Re:University IDs

[whovian]

the university eventually admitted that they do store data, and sent the guy a copy of his records, which indicate to the second when and where he swiped his card, in addition to when he went to the gym, how much he bought at the dining halls, etc. So much for privacy. ... We're trying to contact some people in the school media and administration and have something done.

Have you asked whether they will assign you a new non-SSN ID at your request?

Kudos for taking the noble approach. In this day and age, I would be tempted to dangle this in front of national media and suggest how victim identity theft is, well, a kind of internal terrorism.

I'm serious about this because it seems everything *else* is being done to protect people from harm from others as well as themselves and to protect corporations/businesses from people. Why does it seem that government stops short here? Is it to allow businesses to sell "protection services" for your private perosnal info?

Re:University IDs

[dave420]

What do you mean privacy? Someone could follow you around, quite legally, and make a note of ALL of that information. That's just as legal.

I'm not being weird here, but if you're in public you don't have a right to privacy. That's why it's called public and not private.

Fair enough if they were spying in your private residence or something, but seeing when you go into a room is nothing. Especially considering it's their university, so like you in your house, can do anything that doesn't violate a law. As they violated no laws, it's all cool.

Threni? Meet Google. Google? This is Threni!

[aendeuryu]

Feel free to go google DMCA abuse. There's about 100,000 hits, and you might find one or two in there that might lead you to understand WHY it's reasonable to think that a corporation might go after this, using the DMCA as a weapon, because they've done it before.

The FatWallet one is particularly educational. I invite you to go read it. It's even less applicable to the DMCA than card-stripe reading, and it happened anyway.

In Europe the ATMs inform YOU!

[evilandi]

jgbishop: every time I go to my bank's ATM, I have to indicate whether I want to do business in English or Spanish. Shouldn't that information be on the card?

In Europe it is quite common for the ATMs to automatically work out what language you speak, and automatically present you with an interface in that language.

This works solely by the ATM recognising which bank your card is from. For instance, mine is Barclays, which the ATM knows is a UK bank, so many ATMs in France present me with an English interface by default. I would strongly expect all European ATMs with this ability to present all US cardholders with an English language by default (Spanish-speaking US citizens aren't common tourists).

However this breaks when your country speaks more than one language. I'd expect all ATMs to be very confused about which language a Swiss cardholder prefers; Switzerland has German, French and regional languages as official languages. Belgians probably get a choice of Dutch or French too.

There are also regional variations. For example, when using my Barclays ATM card in Wales [1], I sometimes get the option for the interface in Welsh or English, because Barclays customers in Wales might prefer Welsh over English (for instance, my uncle prefers Welsh for conversing about money and family, but English for talking about science and technology).

So it can be done, but they don't dial back to HQ for your individual preference- the ATMs generally only recognise the default language of your bank. If your bank speaks both Spanish and English, then most ATMs aren't going to know any better.

[1] Wales and England are Kingdoms [2] of the United Kingdom in the same way that California and Texas are States of the United States. The UK isn't just England, any more than the US is just California.

[2] Actually, Wales is a Principality (ruled by a Prince/Princess, not a King/Queen), not a Kingdom, but you get the idea.

Re:could be worrying

[plover]

Your PIN is never stored on your card, and hasn't been since the early 1980s. Not even in an encrypted format.

When you key your PIN, the PIN pad accepting it will encrypt the PIN along with other transactional information plus its own serial number using a key injected securely by a representative of the issuing bank.

This blob plus the other data is transmitted to an authorizer, where the account is looked up and a local copy of the blob is created. If it matches the incoming blob, it's a go.

The bank almost certainly did not encode your card in the scenario you described above. Encoding is usually done with a machine-fed stripe writer, and is almost never done by hand-swiping the stripe anymore. (The timing is usually better on machine fed devices.) What the bank most likely did was to generate a blob similar to the one I described above for transmission to their authorizing computer, who immediately stored it and activated it for use.

Yes, the original intent of mag stripes was to enable offline transactions. However, bad guys quickly figured out how to read stripes and forge PINs, so everyone went to strictly on-line authorizing in the early 1980s.

Wager...

[http101]

I'll give him 2 days before the DMCA guys come knockin' on his dorm-room door.

Re:Lovely...

[swillden]

wouldn't it be interesting if this were to cause a groundswell of support for the recently proposed RFID credit cards?

First, they're not RFID cards, they're contactless smart cards, which are a very different. Different frequency, different range, different capabilities, different protocols, and very different security.

Second, smart card credit cards are a good thing, and you as a credit card user should want them because they'll reduce fraud. Granted, the banks and merchants mostly bear the brunt of the fraud, not the cardholder, but since all of the money ultimately comes from our pockets that's a distinction without a difference.

Finally, your implied notion ("ack") that contactless smart cards are a bad thing for cardholders shows that you don't know anything about them. A fully-implemented EMV card:

1. Won't divulge any data other than a public key until after your PIN has been presented to it in a secure (mutually-authenticated and encrypted) session.
2. Allows transactions to be conducted off-line, making your checkout quicker for low-value transactions.
3. Can make decisions about whether or not transactions should require a real-time connection back to your bank to verify the account status. This counters the increased fraud opportunity provided by the greater convenience of fast transactions.
4. Provides very strong authentication to the transaction, making it nearly impossible for a thief to perform a "card-present" transaction without actually obtaining your card (and PIN). "Skimming" is the #1 type of credit card fraud, and these cards eliminate it.
5. With card readers built into PCs, offers a mechanism for doing "card present" on-line transactions. This will reduce the card fees paid by on-line merchants, which will (after a delay, probably) reduce your costs as well. Oh, and you can also use an EMV card to make logging into your bank's web site easier and more secure.
6. With an additional calculator-like device (or a PC and reader), offers a mechanism for doing secure over-the-phone transactions as well. Maybe in the future the cards will have a display and PIN pad integrated right into the card, eliminating the need for the extra device.
7. Offers credit card issuers to provide "value added" services on the chip. It's not clear how valuable this is; at present they're talking about things like storing your bookmarks on the card, so that you can carry them with you. It's possible that other, more useful, ideas will arise.

The security in these cards is very well thought-out and banks have zero interest in intruding on your privacy, because it would piss you off. If you don't believe they're careful with your privacy, consider the fact that they already know about every purchase you make with any credit card -- how often do you get marketers calling you because they got information from your bank about a recent purchase you made on your credit card?

If you don't care to believe me about how the security is designed, please review it for yourself. Complete EMV specifications are published on the EMV web site at http://www.emvco.com.

I'm a security expert of sorts -- and fairly paranoid by nature -- and the main concerns I have with this technology will arise if the US banks decide not to fully implement the technology.

1. They may decide that cardholders like signature authorization and don't want PINs. That would mean the card would have to be willing to communicate with anyone and it would become possible for handheld readers to collect card numbers in a crowd. Personally, I would love to use a PIN rather than signing. Signing is slow, and inherently must be done at the end of the process, meaning it can't be parallelized. With chip and PIN, I can insert my card and enter my PIN while the cashier is still scanning my items. As soon as (s)he's done, the transaction can be executed, which takes <2 seconds, including printing th

Re:could be worrying

[eison]

Nope.
Card formats are in the original article. No PIN in the stripes. http://stripesnoop.sourceforge.net/devel/layoutstd .pdf
(CVV/CVC are not your PIN, they are an additional security check. They are also different from CVV2/CVC2, which is printed on the card but not in the stripe.)

There is indeed encryption used - but it's not on the card. When you perform a transaction, *the pin you manually enter* is encrypted (with a public key tied to the merchant or particular signature capture device transaction, depending on technology used) and sent to the processor. This is decrypted and compared to what the processor has on file for you. Nothing related to the PIN on the card itself, it's solely based on what you keyed in.

Language preference stored on bank-side

[fons]

Where I live, the language of preference is stored on the server.

All ATM's in Belgium can work in 4 langauges, but I never had to choose a language at an ATM. So I suppose the bank knows i want to be served in Dutch.

When a foreigner uses an ATM in Belgium, he gets to choose a language. (And when I go abroad, I get to choose a language too)

Re:could be worrying

[swillden]

so everyone went to strictly on-line authorizing in the early 1980s.

Everyone in the US did, anyway. Much of the rest of the world still does off-line transactions with magstripe. That's a big part of the reason why chip cards are being deployed so much more aggressively outside of the US, because they don't want to do on-line authentication (due to higher communications costs), and allowing off-line transactions with magstripe is just asking for high fraud rates.

In France, for example, a few years ago fraud was insanely high. Since they've gone to chip cards skimming fraud has dropped to zero and overall credit card fraud is miniscule.

Guy's not an RMS fan

[JackBuckley]

From Deep in TFA (tm):

Q: Why did you release Stripe Snoop under the GPL?

A: Well, its not because I like Richard Stallman, thats for sure. I don't believe that all code should be Free Software,and think he is pretty much a coding communist. One of the reasons Stripe Snoop was created was the lack of cheap or quality magstripe software, especially that would run on Linux. I have worked very hard on Stripe Snoop, and the last thing I want are the very companies that have expensive, crappy software from using my code and not contributing code themselves. In this regard the GPL provides the protections I want, even if I disagree with most of the creator's politics.

Interesting to see a "security expert" (see earlier post--I can't verify this opinion) who thinks RMS is a code communist.

Like this?

[First Person]

I noticed a 3 track reader for $59 from Kanecal.net. This looks like a very quick and cheap approach to data extraction. The advantage of making your own is that you need not limit yourself to cards following the ISO specifications for track positions and character encodings.

What's in Your Wallet?

[Skjellifetti]

The magnetic stripe standards, of course. The card is a test card I printed while I was building an ID card system for a client. The front lists the track standard and the allowed chars:

Track 1 (IATA data max. 76 chars):
!"#$%&'()*+,-./0123456789:;<=>@ABCDEFGHIJKLMNOPQRS TUVWXYZ[\]^ _

Track2 (ABA data, max 37 chars): 0123456789;;<=>

Track 3(TTS data, max. 104 chars):
0123456789:;<=>

The allowed chars have been encoded onto the stripe on the back.

A testament to the strength of GPL

[bshroyer]

Is that those who disagree vehemently with the politics of RMS can still see the GPL for what it is: the Right Way to license software, if you want to see it live, grow, and prosper.