Slashdot Mirror
Android App Lets You Steal Contactless Credit Card Data
mask.of.sanity writes "An Android application capable of siphoning credit card data from contactless bank cards has appeared on the Google Play store.
The app was developed by a security penetration tester for research purposes and will steal card numbers and expiry dates, along with transactions and merchant IDs.
It requires a near field device capable phone, or accessory."
Really. Broadcast data can be intercepted by anyone with the ability to receive?
Support the EFF and Creative Commons. The war is coming, and they're supporting you...
I mean really, how idiotic do these companies need to be to make a system where the full Credit Card information is TRANSMITTED over the air with no authentication. Even a token would be more acceptable.
The Credit Card system is quite happy to take a loss on all the money they have to pay back with protection guarantees when consumers get scammed, instead of actually tackling the problem by inventing a SECURE SYSTEM that is impervious to skimming methods.
This app does not add any additional functionality that scammers don't already have, but a good highlight of how damn simple it is to do, while Mastercard/Visa and the financial institutions who use them do nothing.
What I don't even....
Support the EFF and Creative Commons. The war is coming, and they're supporting you...
Nope. Contact-less is a US thing. Europe uses chip and PIN.
This sounds like exactly what you'd need if you wanted to do something like accept card payments using your phone, similar to the iPhone credit card adapter. Same tech, different color hat.
That's right, you didn't.
Faster! Faster! Faster would be better!
We have it here in Australia, not happy about it, the new cards have it included for our convenience! lol
Common sense is not so common
Mastercard PayPass (Visa's equal is PayWave) is a pretty common card in the US now. Europe uses EMV (AKA chip and pin) and I have never seen a contactless card in europe, only the USA (FWIW, PayWave and PayPass are EMV compatible). So it has been demonstrated in the wild that you can skim these contact-less cards and then make a clone mag-stripe card, but it is only good for one transaction since the CVV code changes on the contact-less card with each transmission whereas the mag-stripe has it static. Not only that but you would have to use the mag-stripe before the next contact-less card transaction for it to be successfully authorized and I *believe* that even if you did, the next time that the card holder tried to use the card it would get rejected and flag the card. The industry doesn't try and make fraud-proof products, they try and balance usability with mitigating controls.
Most of these contact less cards, etc. are found in Europe, where the majority of credit cards are stolen.
Good ol' US still uses the crappy magnetic strips. Sure they are just as easy to clone, but only through contact with a skimmer.
Are you sure they're not exclusively used in america?
So I can buy an NFC reader for $60ish and connect it to my computer and read the cards that way instead?
The problem is with the protocol, not the hardware.
Hi I'm in the UK we have contactless cards here.
Last time I checked the UK was a founder of the EU and in Europe ;-)
I suppose the fact that this article is not related to anything you mentioned matters at all to you. It does show everyone who reads your comment that you are an idiot, though.
I wonder what the range is, which I realize it is a function of the phone, but a ball park. Are we talking 10 cm, 50 cm, 1 m?
She can siphon my credit card better than those stupid android app. All she needs is my wallet...fucking bitch
Barclays made a big thing about introducing this in the UK with the advert with a guy sliding down a near endless water slide buying things as he went.
I was livid as soon as I saw it, I had less than zero faith in it's security, I did NOT want it on my cards.
Even back then I realised it meant a stolen card was instantly usable even if only for the small daily limit before it was reported, I still did not want it. But over the air cloning was what I was expecting.
Give my a powerful scanner and I'll scan your asshole lol
With NFC phones you could make an almost crack proof system. Since the phone has a second line of communication it could use NFC to generate an an encrypted transaction with the merchant terminal and then use it's cellular connection to verify that transaction with the bank, and at last the merchant terminal would use it's network connection to the bank to finalize that transaction. Yes that means both devices need a working network connection to make the transaction work, but it would be super secure since there would be no CC number. Each transaction would be unique and unrepeatable. The bank would get verification from both the merchant and the customer for each transaction.
I am so mad that every one of my CC's/Debit cards that has expired has been replaced by the banks with ones that do this broadcasting shit. Has anyone been able to get them to replace with one that doesn't do this shit? There's absolutely no reason I would want my CC to broadcast its info for devices to read, and swiping the thing is just as easy as passing it over an NFC device.
Or perhaps can anyone name a national bank who has allowed them to get a debit card that doesn't do this?
Because I have had to implement credit card payments where the field was marked as required but never checked or stored anywhere. So, if you didn't fill it in or put in a random value, it worked perfectly fine and this was on sites doing millions in transactions per year.
There is also nothing in the contracts with processors that this is required, it is recommended but not required.
A lot of web companies are terribly afraid to turn away any customer because they might have to think for a second while making a purchase.
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
I can vow that this is true, have had to implement it like this myself. It is often marked as required but never actually checked.
Three reasons, the web master is afraid of putting up any hurdles to a purchase.
During testing, the CVC check is often disabled, so its proper functioning can only be tested on a live account.
And lastly not every card has it and so the idea exists with web shop owners that if they enforce it, they might loose X% of customers.
IF you happily filled in your number correctly for years, that is no proof it was ever checked. Welcome to the online purchasing!
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
OK, but what if I made a note of someone's VIN code and then used it to clone their car? Would that be stealing?
Wait, can you clone a car from a VIN code? Does that even make sense to begin with? DAMN THESE CAR ANALOGIES!
Let's try again - OK, suppose you have a series of cars, like, red, green, brown, etc, and then you make a note of the ones that pass you, and... no, this isn't working either.
So you're following a car, and you happen to crash into the back, launching yourself through your windshield and through the back window of the car you were following, landing on the backseat. There, you notice someone's handbag, and you quickly pull out your Android phone and scan the card. Would that be stealing? Hmmm? Hmmmmmmm?
You are not alone. This is not normal. None of this is normal.
Last time I checked the UK was a founder of the EU and in Europe ;-)
I see the smiley but am intrigued by your claim the UK was a founder of the EU...
http://en.wikipedia.org/wiki/History_of_the_European_Union
As a matter of fact the UK has so many exemptions to the otherwise general rules of the EU that it's even a bit of a stretch to call them a full member right now.
"The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."
RTFA Germany uses contact-less
Like anyone can even know that
Probably because it's a troll, incorrect and off topic.
The NFC card proponents and credit card companies said that this could not happen.
They said that the data was encrypted and virtually impervious to interception.
They said we could trust them.
They said that the people saying otherwise were clueless Chicken Littles.
Obviously this app is the product of highly sophisticated terrorists, or possibly an enemy state. /s
No but if you then fraudulently misused the info, aye, there's he rub.
Foor most people, you wouldn't need encryption or security. You wouldn't need locks on doors or keys for cars. It's because there are lousy jackasses out there that these things are needed.
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
Just in case:
Parent is already modded down as troll, but just in case anyone really daft reads it:
Do not attempt to delete system32 from your Windows system. I'm not sure if it will even succeed but if it does it will leave your system unbootable.
Does anyone know of a good credit card... "sleeve" that shields EM radiation? Ideally something you can put the card into that can fit in your usual wallet and which is still fairly easy to remove for when you do need to use it.
When someone hooks this into a fast-spreading botnet this lame excuse for a transaction verification system will be turned off overnight. Amex, Visa and MC are not too big to fail. They know they need to roll out smart "cards" that do one-time verifications even they've been able to put it off so far.
Oh, I'm sorry sir, I thought you were referring to me, Mr. Wensleydale.
I have an NFC-enabled Android smartphone and tried out this app (and several others with similar claims).
They simply do not work as advertised. Most cards I tried use encryption and the app wasn't able to break it (as a matter of fact it didn't even try...).
All that these apps can do consistently is detect if there is some kind of RFID chip nearby (as in "less than 10 cm away from the phone").
Some can read part of the information stored. But none of them could read the hidden data on any of the cards I tried that had encryption.
As for playing the info back, the success rate even with unencrypted cards (like for instance my company's door sensors) is quite low.
So don't panic. It's not nearly as bad as the summary and article (and most comments to TFA) imply.
Because security through obscurity has proven to be such a great policy...
"Unheard of means only it's undreamed of yet,
Impossible means not yet done." ~~ Julia Ecklar
Exactly! :)
You sir, are an idiot.
annnnddd....... its gone. App cant be found on the play store anymore.
Yes!
In fact, I managed to obtain a reader compatible with ISO14443-A/B cards (as used by European PayPass/PayWave, and public transport card implementations), and FeliCa (as used by Japanese payment systems) for about GBP35 from a Belgian online store, and a prepaid PayPass card for GBP5, ages ago; and successfully managed to read data from the card under Linux using a modified version of some scripts supplied with LibNFC.
I even discovered that it was possible to open the reader's case, remove the Secure Application Module card, and either insert a GSM SIM card, or hold an EMV card's contacts to the contacts on the device, in order to read data from it.
This app should be installed by default on all NFC phones. Maybe it will help highlight the gross stupidity of using contactless credit cards.
Where does all of this FUD come from here on /.? I just received a new card from my bank a month ago, and it has the contactless PayPass chip. This is from one of the big conglomerate banks.
Cripes, /. used to be a place to go for articles with somewhat intelligent comments. Now it is more and more like The Onion every day.
I guess they never anticipated that a contactless magic wireless super lazy marketing gimmick receiver system could potentially have a similar device built to do the exact same thing the exact same way. I know, I'm sure they're just SHOCKED over there to find out someone did it.
no, the problem is that there are 100 million of these phones out there that anybody can install a credit card stealer. at least when you buy your stuff off of warez.co then not everybody has it.
[snork] that's fancy talk considering your comment history. "I hope your brain explodes messily."
These cards are all over Europe.
We have chip and pin too, but many UK and German cards now have this as well.
I did some research this week. I found that on most of my UK credit and debit cards (Santander, MBNA, Barclays, etc) you can effectively disable the contactless feature by damaging the antenna. This is very easy and will NOT affect the Chip-and-PIN feature that s relied upon for ATMs and in-store purchases. (DON'T FOLLOW THOSE STUPID YOUTUBE VIDEOS THAT DRILL OUT THE VISIBLE CHIP!!!).
All you need to do is use a pair of scissors, make a small vertical cut of around 7mm at the top-middle of the card - just above the magnetic stripe. If you look very carefully into the cut you will see 4 or 5 very small wires that have been severed. Job done.
Without the antenna loop, the contactless chip cannot energise and communicate.
See my blog post on this in more detail: http://linuxcentre.net/disabling-contactless-cards
I downloaded the app and tried to see if I could pull data from any of my cards. I opened the app and didn't see any buttons that needed to be pressed to enable scanning, but the app's in a language I don't speak (German I assume). I ran it over a card with a chip and nothing popped up, I ran it over my entire wallet and nothing. I'm pretty sure I've got at least one card that is NFC-capable, and I know my phone is.
LOL there is soo much above that makes your comment seem uneducated.
1) Google did not poorly design the NFC system.
1a)Google probably didn't design the NFC system at all.
1b)Depending on perspective, it looks like they designed it really well... I mean you can now use a tablet for your point of sale app.
2) Even if there were no Android phones, skimming will still happen,
2a) It has been happening
2b) Before, even before Android
2c) With contactless cards.
3) History has shown us anyone who wants to repurpose hardware will repurpose hardware
4) The information age is upon us
4a) Anyone who wants information can get it trivally
4b) When information is censored or classified, there are well known ways to still get it
4c) Information can and will allow us, who can think, to do things that were not considered as the original intent.
All systems,even using paper and people, are vulnerable to fraud... that is why we have policies, laws, and basic protections.
Am I affraid of my contactless cards getting skimmed?? no. Go ahead, let them make a purchase on my card and send them to federal pound-them-in-the-ass prison.
120 characters ought to be enough for anyone