Slashdot Mirror
Android App Lets You Steal Contactless Credit Card Data
mask.of.sanity writes "An Android application capable of siphoning credit card data from contactless bank cards has appeared on the Google Play store.
The app was developed by a security penetration tester for research purposes and will steal card numbers and expiry dates, along with transactions and merchant IDs.
It requires a near field device capable phone, or accessory."
First
Really. Broadcast data can be intercepted by anyone with the ability to receive?
Support the EFF and Creative Commons. The war is coming, and they're supporting you...
A Microsoft employee hid a folder in the Windows 95 operating system that slows down the computer by 32x. This man is called Cameron Jackdowns, and he has a PhD in Computer Sciences from Oxford. He is also known to be a bit of a joker.
After adding this folder, which contain junk files that look important so that it looked inconspicuous to the people who were testing Windows 95 in order to use up space, he added a file that slows down and surveys on the computer. “Explorer.exe” is the name of the file. What Explorer does is it “explores” your system and uploads a list of files that are on your computer, as well as Internet history, to Microsoft's secret base for analysis. It also slows down the machine by 32 times. Although, when you open it, it opens up a “file explorer”, to hide the file's true purpose.
After the launch of Windows 95, the developers had a party in a premium club, all paid for by Bill Gates and Steve Ballmer. Cameron took way too much alcohol and ended up drunk and manipulatable. People heard him mumble the words, “System32 is a fake. It slows... down... the machine...”.
Shock and disgust filled the room, but that's just because Cameron vomited on everyone after speaking.
After word spread about this folder, there was a large meeting at Microsoft's headquarters. Bill Gates, Steve Ballmer, developers, and engineers were glaring at Cameron Jackdowns. Bill Gates broke the silence like a sledgehammer to glass. “So, explain why you did this...”, with Steve Ballmer finishing his sentence as if they shared a mind, “...and tell us why. Because this is genius!”. Cameron seemed confused, yet still terrified for his own job. He stumbled over his words. “W... wait, what!?”.
Bill and Steve then explained about their new idea about an expensive piece of software ($299) that sped up the system just by deleting the folder. The software was called SpeedoPC and was cancelled at the last minute due to a lawsuit from Speedo, as Microsoft used their trademark.
After the word came out (it came out in the lawsuit), many people deleted their System32 folder, and only the trolls say it breaks the computer. Well, either the trolls or people who deleted the wrong folder and blamed System32. Many top companies' main work computers no longer have System32 and are now as powerful as the higher end machine, even though they are less powerful specification-wise.
So, delete System32 and everything will run amazingly fast.
I mean really, how idiotic do these companies need to be to make a system where the full Credit Card information is TRANSMITTED over the air with no authentication. Even a token would be more acceptable.
The Credit Card system is quite happy to take a loss on all the money they have to pay back with protection guarantees when consumers get scammed, instead of actually tackling the problem by inventing a SECURE SYSTEM that is impervious to skimming methods.
This app does not add any additional functionality that scammers don't already have, but a good highlight of how damn simple it is to do, while Mastercard/Visa and the financial institutions who use them do nothing.
Most of these contact less cards, etc. are found in Europe, where the majority of credit cards are stolen.
Good ol' US still uses the crappy magnetic strips. Sure they are just as easy to clone, but only through contact with a skimmer.
Would it be theft if someone wore a t-shirt with their social security number printed on it in big numbers, and I were to make note of that?
When I receive a new card that has an RFID tag in it, I simply drill a hole through the tag. Problem solved.
I've proved who I am so many times,
The magnetic strip's worn thin.
And each time I was someone else,
And everyone was taken in.
- Pacing the Cage, Bruce Cockburn
This was a disaster waiting to happen. Google tried to go from 0 to 60 in their android development, and did not properly consider the ramifications of their design decisions. Now we have
1) an insecure OS that provides all sorts of information to any app
2) unfiltered app stores that allow any malware to be posted and purchased
3) poorly designed NFC system.
As a result,, ALL NFC systems are less safe thanks to these android design decisions. Way to go, Goog.
This sounds like exactly what you'd need if you wanted to do something like accept card payments using your phone, similar to the iPhone credit card adapter. Same tech, different color hat.
You won't find this app in the App Store! Heck, you can't even read this data from an iPhone!
I wonder what the range is, which I realize it is a function of the phone, but a ball park. Are we talking 10 cm, 50 cm, 1 m?
I tried it on my PayPass enabled MasterCard and all it got was the NFC ID - 09 08 CC AD. Doesn't seem very useful.
She can siphon my credit card better than those stupid android app. All she needs is my wallet...fucking bitch
if i carry my card inside a balloon in my rectum, will this protect it?
It's not the same thing, your comparison doesn't hold up to this situation. Unfortunately, those companies are aware of this sort of security hole and they don't take enough measure to fix it. Simple problems to fix really. Unfortunately, the android app dev didn't talk to the proper people to get heard and be able to fix the problem. Nope ! Instead he decides to create an app, make it public and put in jeopardy thousands of people including sensitive info. I hope the dev gets arrested. I seriously don't get this kind of action.... I think I never will
With NFC phones you could make an almost crack proof system. Since the phone has a second line of communication it could use NFC to generate an an encrypted transaction with the merchant terminal and then use it's cellular connection to verify that transaction with the bank, and at last the merchant terminal would use it's network connection to the bank to finalize that transaction. Yes that means both devices need a working network connection to make the transaction work, but it would be super secure since there would be no CC number. Each transaction would be unique and unrepeatable. The bank would get verification from both the merchant and the customer for each transaction.
I am so mad that every one of my CC's/Debit cards that has expired has been replaced by the banks with ones that do this broadcasting shit. Has anyone been able to get them to replace with one that doesn't do this shit? There's absolutely no reason I would want my CC to broadcast its info for devices to read, and swiping the thing is just as easy as passing it over an NFC device.
Or perhaps can anyone name a national bank who has allowed them to get a debit card that doesn't do this?
Because I have had to implement credit card payments where the field was marked as required but never checked or stored anywhere. So, if you didn't fill it in or put in a random value, it worked perfectly fine and this was on sites doing millions in transactions per year.
There is also nothing in the contracts with processors that this is required, it is recommended but not required.
A lot of web companies are terribly afraid to turn away any customer because they might have to think for a second while making a purchase.
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
I can vow that this is true, have had to implement it like this myself. It is often marked as required but never actually checked.
Three reasons, the web master is afraid of putting up any hurdles to a purchase.
During testing, the CVC check is often disabled, so its proper functioning can only be tested on a live account.
And lastly not every card has it and so the idea exists with web shop owners that if they enforce it, they might loose X% of customers.
IF you happily filled in your number correctly for years, that is no proof it was ever checked. Welcome to the online purchasing!
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
OK, but what if I made a note of someone's VIN code and then used it to clone their car? Would that be stealing?
Wait, can you clone a car from a VIN code? Does that even make sense to begin with? DAMN THESE CAR ANALOGIES!
Let's try again - OK, suppose you have a series of cars, like, red, green, brown, etc, and then you make a note of the ones that pass you, and... no, this isn't working either.
So you're following a car, and you happen to crash into the back, launching yourself through your windshield and through the back window of the car you were following, landing on the backseat. There, you notice someone's handbag, and you quickly pull out your Android phone and scan the card. Would that be stealing? Hmmm? Hmmmmmmm?
You are not alone. This is not normal. None of this is normal.
The NFC card proponents and credit card companies said that this could not happen.
They said that the data was encrypted and virtually impervious to interception.
They said we could trust them.
They said that the people saying otherwise were clueless Chicken Littles.
Obviously this app is the product of highly sophisticated terrorists, or possibly an enemy state. /s
No but if you then fraudulently misused the info, aye, there's he rub.
Foor most people, you wouldn't need encryption or security. You wouldn't need locks on doors or keys for cars. It's because there are lousy jackasses out there that these things are needed.
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
Does anyone know of a good credit card... "sleeve" that shields EM radiation? Ideally something you can put the card into that can fit in your usual wallet and which is still fairly easy to remove for when you do need to use it.
When someone hooks this into a fast-spreading botnet this lame excuse for a transaction verification system will be turned off overnight. Amex, Visa and MC are not too big to fail. They know they need to roll out smart "cards" that do one-time verifications even they've been able to put it off so far.
Oh, I'm sorry sir, I thought you were referring to me, Mr. Wensleydale.
They need to take the guy who wrote it and anyone else who does and give them 20 years. Then go after the banks for handing out the cards. Been waiting for this to happen!
I have an NFC-enabled Android smartphone and tried out this app (and several others with similar claims).
They simply do not work as advertised. Most cards I tried use encryption and the app wasn't able to break it (as a matter of fact it didn't even try...).
All that these apps can do consistently is detect if there is some kind of RFID chip nearby (as in "less than 10 cm away from the phone").
Some can read part of the information stored. But none of them could read the hidden data on any of the cards I tried that had encryption.
As for playing the info back, the success rate even with unencrypted cards (like for instance my company's door sensors) is quite low.
So don't panic. It's not nearly as bad as the summary and article (and most comments to TFA) imply.
Because security through obscurity has proven to be such a great policy...
"Unheard of means only it's undreamed of yet,
Impossible means not yet done." ~~ Julia Ecklar
Uh, that's neat. Take that, iPhone lovers, this is something you will never be able to do!
annnnddd....... its gone. App cant be found on the play store anymore.
LOL OMG WTF BBQ
I LOLed. I hate myself for it though.
This app should be installed by default on all NFC phones. Maybe it will help highlight the gross stupidity of using contactless credit cards.
I guess they never anticipated that a contactless magic wireless super lazy marketing gimmick receiver system could potentially have a similar device built to do the exact same thing the exact same way. I know, I'm sure they're just SHOCKED over there to find out someone did it.
While it is true that UK retailers are reluctant and sometimes refuse to accept mag-stripe cards, if a foreign card is presented without EMV they cannot refuse it if they display the VISA/MasterCard logo on their storefront. This is part of the VISA/MC rules, now if it is an EMV card in which the chip simply does not work then that might be a different story. So far I have spent about 5 months in Europe on three separate occasions working for a credit card company and only encountered one time when my card was flat out refused because it wasn't EMV (I'm from the USA).
I did some research this week. I found that on most of my UK credit and debit cards (Santander, MBNA, Barclays, etc) you can effectively disable the contactless feature by damaging the antenna. This is very easy and will NOT affect the Chip-and-PIN feature that s relied upon for ATMs and in-store purchases. (DON'T FOLLOW THOSE STUPID YOUTUBE VIDEOS THAT DRILL OUT THE VISIBLE CHIP!!!).
All you need to do is use a pair of scissors, make a small vertical cut of around 7mm at the top-middle of the card - just above the magnetic stripe. If you look very carefully into the cut you will see 4 or 5 very small wires that have been severed. Job done.
Without the antenna loop, the contactless chip cannot energise and communicate.
See my blog post on this in more detail: http://linuxcentre.net/disabling-contactless-cards
I downloaded the app and tried to see if I could pull data from any of my cards. I opened the app and didn't see any buttons that needed to be pressed to enable scanning, but the app's in a language I don't speak (German I assume). I ran it over a card with a chip and nothing popped up, I ran it over my entire wallet and nothing. I'm pretty sure I've got at least one card that is NFC-capable, and I know my phone is.
I have made an Android application that can steal credit card numbers from regular credit cards without the use of NFC. Actually, it is pre-installed on most Android phones by the name: Camera.
Until this can steal credit card numbers from a few feet away, why is this news?