Slashdot Mirror
Shmoocon Demo Shows Easy, Wireless Credit Card Fraud
Sparrowvsrevolution writes with this excerpt from a Forbes piece recounting a scary demo at the just-ended Shmoocon: "[Security researcher Kristin] Paget aimed to indisputably prove what hackers have long known and the payment card industry has repeatedly downplayed and denied: That RFID-enabled credit card data can be easily, cheaply, and undetectably stolen and used for fraudulent transactions. With a Vivotech RFID credit card reader she bought on eBay for $50, Paget wirelessly read a volunteer's credit card onstage and obtained the card's number and expiration date, along with the one-time CVV number used by contactless cards to authenticate payments. A second later, she used a $300 card-magnetizing tool to encode that data onto a blank card. And then, with a Square attachment for the iPhone that allows anyone to swipe a card and receive payments, she paid herself $15 of the volunteer's money with the counterfeit card she'd just created. (She also handed the volunteer a twenty dollar bill, essentially selling the bill on stage for $15 to avoid any charges of illegal fraud.) ... A stealthy attacker in a crowded public place could easily scan hundreds of cards through wallets or purses."
It is news in that this has now been brought up to the credit card companies in a manner which cannot be easily ignored.
Don't know something? Look it up. Still don't know? Then ask.
You should be more worried about waiters and cashiers then somebody in a crowd grabbing your data.
Your hair look like poop, Bob! - Wanker.
The issue isnt being able to mitigate, the issue is that if the CC companies convince everyone that this isnt possible, then they have an easy path to never having to pay out against fraud. They can just refuse to believe this exists, and tell anyone who had their card info stolen that the cause was their behavior, and then never have to honor a dime of repayment. This is enough to let everyone know that theft can occur this way, and liability remains with the CC companies.
>> the cards are set to offer up a one-time CVV code with every scan
Wait, I thought RFID only offered up static information. Does this infer that the cards have some sort of logic onboard to generate these 'one-time codes' and have create a new code on every scan that matches up with its processor? How does this effect an inadvertent scan, do the codes get all out of sync? Is there resync logic as well? How would this be handled throught payment processors and 3rd party clearing houses?
Now, someone enlighten me on this if it's true. But this sounds to me like total bullcrap.
Why is it "hyperbole" if somebody can drain hundreds of bank accounts wirelessly with a $50 device?
To me that sounds more like "panic stations, block all cards now!!"
Why anybody needs RFID credit cards is beyond me anyway. Is it sooooo hard to swipe a card through a reader?
PS: Why would the CVV number be on the RFID chip? Surely that's the secret only you and the company are supposed to know?
No sig today...