Slashdot Mirror
Smartphone Used To Scan Data From Chip-Enabled Credit Cards
An anonymous reader sends this news from the CBC:
"Using a Samsung Galaxy SIII — one of the most popular smartphones available in Canada — and a free app downloaded from the Google Play store, CBC was able to read information such as a card number, expiry date and cardholder name simply holding the smartphone over a debit or credit card. And it could be done through wallets, pockets and purses. ... Although the NFC antennas in current smartphones need to be very close to a card in order to work — no farther than 10 cm — that could change with the next generation of Android smartphones. Legary said the Samsung Galaxy S4, set to go on sale this spring, might have a much more capable NFC antenna, which could not only read credit cards from a greater distance, but could also be able to read the chips embedded in enhanced driving licenses and passports."
I propose warstriding.
Without the CVV (verification code) you cannot do anything usefull...
This NFC technology must be stopped. Why should anyone's life be any more convenient than it already is.
Why back in my day a phone was attached to the wall with wires. It made phone calls and only phone calls and we liked it.
You youngsters and all your fancy gewgaws. Get off my lawn!
"Kittens give Morbo gas!"
...what we need is tinfoil wallets!
(all joking aside, when I got my RFID enhanced driver's license I went out and got an RFID shielded wallet).
There's nothing stopping a motivated skimmer from adding a more capable external antenna to extend read range. It's much simpler than rolling your own wi-fi antenna. The NFC antenna's usually one of the most outermost parts of a phone or table, which makes it easy to get at, and it's not nearly so frequency dependent, which makes it easier to build.
Faraday Wallet. It's like a tinfoil hat in your pants! http://www.amazon.com/Travelon-Blocking-Travel-Wallets-Black/dp/B001HZBA2E/ref=sr_1_12?ie=UTF8&qid=1366832426&sr=8-12&keywords=rfid+wallet
If it's a card not present transaction, the security code should be required, and presumably that isn't being transmitted as well.
I've got a hot news story for you - everyone person you hand your credit card to is able to access your card number, name, and expiration date!
CBC News asked Google why apps capable of skimming credit card information were available on the Google Play store.
You mean, why are apps capable of using the NFC capabilities of your phone available on Google Play? You might as well ask why eBay sells magnetic card readers.
"Anyone who [rips a CD] is probably engaging in copyright infringement." - David O. Carson
I've always thought those tap-to-pay things were really a bad idea from a security perspective, as your card can be used without you even knowing it and without any form of authentication.
The fact that it will broadcast all of that information to just about anything tells me it's something which retailers and credit card companies like -- but it's mostly bad for security, but great for convenience.
I may need to call my bank and see if I can get that disabled on my cards. I don't use it, don't want it, and seeing this, I trust it even less than I ever have. I'd prefer it didn't even respond to the NFC terminals.
I've always thought this was massively insecure, and it looks like I was right.
Lost at C:>. Found at C.
these information are available on the card in TEXT FORM anyways.... it is easy to be "stolen" everytime you whip it out with the wonderful technology we call "EYES".... this is why pin number exist, this is why the 3 digit security code exist.... and without those information, any transaction processed on the card can be easily reverted by calling your credit card company.... non-issue... technically this makes phone payment more secure since it does not have card number, expiry date and name written in plain text, you don't need to worry about people reading it when you whip it out and NFC can be easily disabled and only enable by button press using apps such as tasker.... as long as you don't lose your phone (even if you do, google wallet for example has pin number and can be remotely disabled in google accounts)
Just goes to show you how much the credit card companies /really/ care about security.
was that the summary says that more capable antennas could improve reading distance, while in reality the tecnology was desinged for very short ranges, with a practically working distance of less than 10 cm. This is I belive because most tags are passive, have no energy and most be powered by the reading device with magnetic induction.
The data on a passport is encrypted with a key derived from the "machine readable zone" that's inside the book. To decrypt the data available via NFC you have to actually optically scan the open page. In addition US passports have a shielded chip so the book has to be open to be readable.
Most of the fear, FUD and panic will go away if the card requires some form of semi-prolonged contact with the reading device in order to activate or unmask the magnetic data. Then unsolicited reading will be more or less the same as swiping, but without the dedicated hardware.
I have a VISA card with NFC and multiple tag readers for my phone and none of the tag readers can get any info like that out of the card. I've got apps that can read fare cards, passports, etc. but I can't find anything on my credit card.
What am I missing?
http://lkml.org/lkml/2005/8/20/95
I'd be intrigued to know what app they're using that's returning the code and expiry date.. that information is encrypted on the card and none of the free nfc tag readers I've tried even attempt to decrypt it (I don't trust the banking system to use half decent encryption so not discounting the possibility entirely).
Of course it could just be the typical bullshit scare story that newspapers come out with..
I was very much against them, in fact swearing I would smash my passport's smart chip when I got a new passport that had one.
But having read it with my phone, I'm impressed. You need key data from the printed page to make the NFC work and as you mention, the passports are unreadable when closed.
I think it's really well done. I'm a bit unsure quite what it's good for since it is slower than swiping it, I can only figure it was done just because putting that much info in a barcode was infeasible.
Now let me submit my pic as a link to a PNG or whatever instead of printing out a picture, having them scan it back in and turn it into a JPEG2000.
http://lkml.org/lkml/2005/8/20/95
I keep all my credit cards and smart chip embedded driving lincens in my hat. And my hat is actually a Faraday's cage constructed using a product from Reynolds. I understand the product is made by electrolysis of bauxite. So no one can read anything from it from a distance.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Really? I don't know anyone with one. It's all flip-phones, HTC and iPhones where I live. And I'm in Canada.
Get free satoshi (Bitcoin) and Dogecoins
In RF land the concept of placing object A near object B means very little. The big question is antenna gain/directionality and reciever gain and the ability of both to reject out of band noise and not create in band noise.
If a cell phone can read a signal from your credit card over a 2" gap then an antenna in a van can do it from across the street and Jodrell Bank can do it from the other side of the planet.
Many card companies probably won't provide a different card with RFID.
Instead, just drill a hole in the card to break the antenna wires and disable the RFID.
The chip and the magstripe should still work.
I've posted this as a reply to an AC above, but I want to make sure some people get to read it as it's actually important (and posting as AC myself so people know I'm not doing this for Karma).
Hai! "Expert" here (And by "expert" I mean I work in the industry, my company has a hand in testing everything from the cards themselves right up to the host in your Bank's basement).
Here's the deal - chip IS secure. What's more, contactless is also secure. Or rather, it's a hell of a lot more secure than the shitty magstripe you're talking about. It takes no time at all to clone a magstripe card. It can be done using a $10 reader off ebay. It's easy to do and has been a direct cause of so much fraud you wouldn't believe.
Chip cards, on the other hand, work completely differently. They use the same technology that's in the SIM card of most GSM phones, the chip isn't just a static bank of data but an actual miniature computer (likely running a cut-down version of Java). It doesn't just hand over your card details upon request, it actually uses a lot of cryptogeraphy, using public/private keypairs (Amongst other things) to ensure that no two transactions are ever the same. Cryptograms are used to ensure that data being sent and received is valid, it's impossible to change any data without breaking this. Even a compromised terminal can, at best, record an existing transaction and nothing more - it can't change amounts or anything like that without breaking it. If EITHER the card or the terminal suspects anything is up, it'll either decline or force the transaction "online" - to your bank, where they have the final say.
Contactless chip cards are nothing more than a wireless standard that compliments the above. Similar to Wi-fi versus ethernet, it's only the transmission medium that actually differs here, the same sorts of cryptograms and hashes are done here. The net result? Yes, you can skim some data using any NFC equipped smartphone, but it's useless to you because you cannot even replay a transaction because you don't have any of the private keys.
Yes, you can use the information to clone the magstripe on a card - the card gives you enough information in the clear to do this, but you'll find that the magstripe is largely useless to you as it's only used as a fallback. These days, even magstripe transactions are used "online" - that is, the terminal WILL contact the host to veryify it, a side effect of the rampant card fraud that goes on. The host will question why a chip-enabled terminal is doing magstripe with a card it knows is chip-enabled. The result? Transaction voided. Terminal prompts you to use the chip, because the terminal knows there's nothing wrong.
As for online shops - those shops that DON'T ask for the CVN are liable for the fraud, so few are left out there that don't. What's more, most cards these days have a secure online payment page requiring you to type in a password before continuing.
Sum total? This is a non-issue, there is nothing new in this article and anything else you hear is scaremongering. You cannot clone a chip card, it's physically impossible.
Chip-pin is standard in Europe (and maybe elsewhere too) but practically non-existent in the U.S. Everywhere here is still swipe with the magstripe. Sometimes you swipe on your own, but just as often you hand the card to someone else for them to swipe (or at restaurants, for them to take away to the terminal, swipe there, and bring back).
"Anyone who [rips a CD] is probably engaging in copyright infringement." - David O. Carson
That's what it is all about. If the data on the chip doesn't match the data printed on the passport, they know a forgery has taken place.
CBC provides absolutely no evidence for their claims, which fly in the face of widely known technological fact.
NFC readers do not have the ability to read the card number from a credit card. That information is encrypted on the chip, only decrypted in the cloud after being sent over the write.
The weakness for RFID is MITM, not reading a card and being able to clone it. I am disgusted by the CBC for this utter lack of journalistic standards.
If I told you I could read your (ssl sent) password over the wire, without proof, would you believe me? That is what the CBC are doing.
I had a course several years ago with a high lead counsel of a very well known company in the e-payments business. I ended up writing a final paper for them called "Security through Obscurity" basically explaining why their credit cards were incredibly insecure and detailing the existing cheap tech that was already accessible to average consumers. The card companies concept of security generally revolves around the idea that if they keep their security methods in a black box, no one will be able to crack it. Which works great until the first person looks in the box... then its all over. The card companies also employ thousands and subcontract to even more. They didn't like the paper. 6 months after the class was over, his company had a problem with their card system effectively taken verbatim from my paper. I sent them the news article and said he should revise my grade. I was disappointed I never heard back.
So you have to rub against the card - warfrotting?
One of the research scientists here at the UW actually found it works with the ID cards everyone gets, and you can download all your bus trips from the added bus pass we have.
Don't you love not having privacy?
-- Tigger warning: This post may contain tiggers! --
Nature's farady cage....lol
http://www.snopes.com/science/eelskin.asp
Hi "Expert". As you might or might not be aware, many chip-and-pin implementations are vulnerable to attacks that are approximately as effective as just cloning the card. Of course its a lot more work, but calling chip-and-pin "secure" doesn't pass the laugh test. Here for example. http://www.schneier.com/blog/archives/2012/09/new_attack_agai_2.html
Chip-and-pin does make fraud harder, but its purpose is mostly to allow banking institutions to fob the liability off on cardholders.
My wallet is made of stainless steel. Good luck with that.
I had an ATM have trouble reading my card, so it resorted to using the magstripe. However, when in magstripe mode I was limited to withdrawing only $20. So the magstripe is pretty much useless nowadays, at least up here in Canuckistan.
I do not fail; I succeed at finding out what does not work.
Lots of people arguing with the expert that there are still security holes.
Of course there are security holes with the chip and NFC. It's kind of like DRM: in the end, you need to be able to access the content. This means that, ultimately, the content must be decrypted into a usable form. It is at least good news that the card companies are finally - at the speed of a slow snail - adding something resembling security.
Enjoy life! This is not a dress rehearsal.
I have worked in information security for 25 years and am always amused when people say something is "physically impossible". There is almost always a way. I have worked on forensic engineering for chip manufacturers, finding production faults by etching off layers using warm nitric acid and reading the secrets out of the circuit using a microscope. That technique can be used to make many copies of a card but nobody bothers because it's too time expensive and there are easier ways.
Ross Anderson's group in Cambridge are real experts in the chip and pin technology, they know that security implementation flaws often make cards vulnerable, for example see http://www.lightbluetouchpaper.org/2012/09/10/chip-and-skim-cloning-emv-cards-with-the-pre-play-attack/
Many parts of the world still use only the magnetic strip. For years while Europe waited for the US to deploy chip and pin we saw European CC numbers being used in the US. Now NFC will make it easier for US based cloners to get just enough data from your cards to send to their cousins in other countries.
a shielded wallet then.
I've tested cardtest and seen it fail on some cards, curious to know of other apps that do that.
If you carry a standard building access proxcard, such as one for an apartment or office building, you will have a tough time reading anything off the cards for the interference. I can't get the store terminals to read my card without it being out of my -TYVEK- wallet with my building access card in it and if you have several cards you'll get such a jumble of data...
That said, woven stainless-steel wallets are looking pretty nice; and durable...
CAPTCHA: Grayness