Slashdot Mirror
Flaw in New Visa Cards Would Let Hackers Steal $1M Per Card
New submitter biomass writes with news about a flaw in Visa's contactless card that lets anyone charge $999,999 to it. According to researchers at Newcastle University in the UK, the card system developed by VISA for use in the United Kingdom fails to recognize transactions made in non-UK foreign currencies and can therefore be tricked into approving any transaction up to 999,999.99. "With just a mobile phone we created a POS terminal that could read a card through a wallet," Martin Emms, lead researcher of the project that uncovered the flaw, noted in a statement about the findings. "All the checks are carried out on the card rather than the terminal so at the point of transaction, there is nothing to raise suspicions. By pre-setting the amount you want to transfer, you can bump your mobile against someone's pocket or swipe your phone over a wallet left on a table and approve a transaction."
Not many VISA cards are authorised for £1M transactions.
It's embarrassing and worrying, but the headline is bullshit.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
The card may say yes or no, but it's not a promise to the merchant, let alone a transfer of funds.
Fuck these companies pushing contactless, NFC, whatever they want to call it. The risks are just too high. What is soooo hard about swiping a card that we can't do that anymore?
At least the way I read the article, the flaw allows a charge of 999,999.99 in ANY unit of currency, not specifically US dollars, or UK pounds, or Euros, or Dinars, or Rubles, or whatever.
Give me my freedom, and I'll take care of my own security, thank you.
I'll be interested once they get the stealable amount up to something more than chump change.
Normal criminals, not so much. Gotta be superhooman, see. Only special people! People with hats!
...and unlocked for this to work?
Any sufficiently unpopular but cohesive argument is indistinguishable from trolling.
(puts pinkie to corner of mouth)... "999,999 Zimbabwean Dollars!" (cronies laugh uproariously in background)
Left MS Windows for Linux Mint and never looked back!
Vote for Bernie in 2016!
a card without the NFC chip, then any transaction needs to be verified by PIN and physically placed into the POS card reader. The idea that these NFC cards are faster somehow is a fallacy. You still have to take the individual card out of your wallet, as inevitably you will end up with more than one card with NFC capabilities. Either the wrong card will be billed or the transaction will fail. At this point you might as well stick it in the reader and put in the PIN anyway.
I got used to bumping my wallet when making underground or bus journeys using an Oyster card. Just pulling out a wallet when passing through an underground station gate or getting on a bus is much more convenient than paying for my lunch 10 seconds quicker.
Wannabe nerd.
Where's my Tin Foil wallet when I need it!
I'm not sure why this is news... if you swipe the mag stripe at an untrustworthy place, they can charge up to $999,999.99 too.... the system limit for a Visa/Mastercard transaction. What they're saying is a RFID chip gets to close to an scamming receiver they create a charge. Thing is, if a charge that big hits your account, your cell phone can scream "BIG TRANSACTION DETECTED!" and then you can have the charge reversed. Remember, we live in the era of "$0 liability"... as long as you can tell them it's wrong fast enough, you don't pay.
So this is what happens when you use an NFC card while there's a sunspot aimed at us.
You do realize that this is easy to find.
Even without this flaw, you could still steal up to a certain amount. The flaw just let's you bypass the limit (20 pounds in the UK).
This is an argument against allowing transactions without pins. Yes, it's convenient yo wave your card at something and not have to put in a pin; but it's also dangerous.
Better: I like the active "I won't share my information unless a code is manually entered on me" method of some speculative card systems and of a (configured to require a pin) google wallet.
I''m a millionaire, Mom I did it!
"you can bump your mobile against someone's pocket "
This is a feature I won't enable on my Samsung S5 (piss poor phone), it just doesn't sound secure.
Even Bluetooth has the same flaw it had when it first came out. The trick was pulled on me recently so know it's an apparent feature. They even added a contact to my phone via Bluetooth.
One can sit in a mall and collect others contacts (for one) just by having Bluetooth on and passing a "collector", I've disabled Bluetooth again.
Just like the first days of BlueTooth.
And it just so happens that thinkGeek (TM) which is owned by the same company as /., happens to sell RFID wallets.
why not use on of these cheap and simple solutions?????
The *card* will approve $999,999, which is fucking meaningless, since the CC company servers wont. 'Hey', I can trick this card into telling me completely meaningless shit that doesn't benefit me in anyway!
From the article:
> "EMV cards don’t have to make contact with a reader to be used."
This is misleading. SOME EMV cards are contactless, but most normal (European) cards require a contact terminal and cannot be read / billed remotely.
The author somehow blames EMV itself on the vulnerability. EMV is a complex beast and there are many ways to get it wrong, but this here is something different.
Who was the bright and clever designer (or boss) at Visa that came up with the idea to give their card holders a contact less card that can authorize a transaction without any approval or human input (can you hear the warning bells ringing?)
Regardless if there's an upper limit or not the idea is bad pure and simple since anybody with that type of card can be robbed by rouge card reader as described, the bad guys won't have any trouble passing the offline-transactions of to some fraudulent "store" on the other side of the planet and start cashing in.
Then you've got your common pick-pocket thief that suddenly can get their hands on a much bigger bounty, anybody had their wallet stolen lately? Guess what would happen with your Visa card that contains infinite 20£ (approx 30$) transactions that can be pulled from it at a transaction/second using a simple NFC smartphone... your account would be drained in no-time.
The only gain for the cardholder here is earning a few seconds that it takes to punch in the PIN (laziness) but the loss is much higher. There's a bigger gain for the venues having small transactions (buses, subways) who could make use of the higher throughput. Not hard to figure out why this idea came to mind and who's been lobbying for it, the credit card industry has never put it's end-users needs first.
The poster obviously doesn't understand how credit cards word. Sure, we can do an offline transaction for whatever value we want, provided the merchant doesn't fall into any of the various restricted merchant category codes, like gambling companies and so forth. Even then, you've got an offline authorisation for almost a million dollars... you think you've stolen a million dollars? Nope! Firstly the point of sale system must upload a file containing the authorisations it's performed. The bank takes this, and generally a night, through a process called settlement, moves the appropriate funds around. A lot of the settlement processes are still performed with ALOT of human supervision. For one company I used to work at, which processed billions in credit card payments every year, there were 3 hardy engineers, ensuring the process went off without a hitch. Catching large or fraudulent transaction happens at this stage too. Most cards have an upper transaction value also, so when submitting a file containing a value over this, the entire batch would be rejected, and an engineer would have to regenerate a new file, minus the transactions and submit. The file submitter would get an automated report of what transactions failed to settle correctly, and from there they could investigate fraud...
laugh about POS meaning both Point-of-Sale and Piece-of-Shit....
And what about UK foreign currencies?
-- 29A the number of the Beast