Slashdot Mirror
At Black Hat: Square Reader To Credit Card Skimmer In 10 Minutes
New submitter arit writes with word that three recent Boston University grads have demonstrated at Black Hat software and hardware attacks on the Square Reader used by many mobile vendors to process credit card transactions. One of the attacks converts a standard reader into an efficient credit card skimmer (conference slides) with very little effort. Always keep Scott Adams' object lesson in mind.
We have card readers attached to our pay-for-print release stations. Turns out if you open Notepad on the release station, the card reader instantly becomes a card skimmer, because, well, card readers read cards.
The square reader to skimmer trick has been around for YEARS. Cripes all you had to do was record the audio and send the audio files to your skimmer.
Pretty sad that Black Hat has turned into a n00b conference. Was there also a talk on how you can use keyloggers?
Do not look at laser with remaining good eye.
Did anybody expect us to believe something you plugged into a cell phone speaker jack was actually secure in any sense of the word?
Here's a good rule of thumb: if it's a piece of consumer electronics, or involves your phone ... it's probably got terrible security.
The first time I saw a commercial for that I pretty much said "yeah, I would not trust a vendor who uses one of those".
The damned thing is almost guaranteed to be something which can be exploited. Sadly, just like every other piece of consumer electronics which tries to add network connectivity.
Companies don't care about, don't know about, and aren't accountable for security. Stop trusting that they do.
Lost at C:>. Found at C.
Gen 1 was always unencrypted. They didn't hack the gen2 or gen3 hardware to unencrypt it.
I can't tell from the slides whether they used a gen1, gen2, or gen3 reader to do their playback attack.
Even before Square, you could buy card readers on eBay. This doesn't really bring anything to the table.
You are all cows. Cows say moo. MOOOOOOOO! MOOOOOOO! Moo cows MOOOOOO! Moo say the cows. YOU SKIMMED MILK COWS!!
Machine designed to read credit cards hacked to read credit cards. Story at 11.
Do you know about this system where you can't fake transactions? Bitcoins.
This story brought a quote from Gibson to mind for me: "The street finds its own uses for things." (from "Burning Chrome")
Be who you are...and be it in style!
Now add contactless cards, that makes everything better!!
and while we are at it we can become a cashless society too because they are cool!!!!!
Why do so many people seem to want to switch to card technologies that don't even need to be put into the reader to be skimmed and then remove their safer backup systems? Other than the banks I mean, their interest in becoming the only way to pay is obvious, 2% of everything in fees is a lot.
Good job Black Hat for once again exposing what the hacker community has had available for years.
... that anyone would expect this to be particularly hard to do. After all you're just reading bits off a magnetic stripe.
Vendors like to talk as if the security of a system is determined by the toughest component in the system, because then they can simply buy some whiz-bang encryption chip, slap it in their product, and claim their product is nigh unbreakable by ordinary mortals. But the truth is the security of a system is determined by its *weakest* component, and in this case that starts with the card itself. Trying to secure that is like trying to secure your butter by nailing it to the butter dish.
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
Taking a photo of both sides of a credit card is also quite efficient as a recording mechanism. There's nothing special on the stripe. Credit cards, payments, security: choose any two.
Nice job Google advertising, an article about Square being "hacked" and your advertising Square, with a Free card reader! I agree though this seems like a lot of "controversy" over something that should be obvious to anyone who understands ANYTHING about technology. And as with most payment methods you have to trust the person on the other side of the register to a degree because even with hardened POS terminals there are often childishly easy ways to slip a system inbetween to skim card numbers.
When will the US finally abandon this stupid magnetic stripe + signature on a piece of paper and actually enforce proper chip & pin cards ? The technology has been available for 30 years now !
It is totally impossible to secure credit cards given the way that credit card transactions work. I simply don't understand how come credit cards work the way they do. There's absolutely no authorization step involved.
You just slashdotted Dilbert.
That's an accomplishment.
I can see the fnords!
Unless things have changed in the last decade, the magnetic stripe on a credit card simply contains the card number, expiry date, and name on the card. There is nothing on the stripe that isn't visible on the card. It isn't a security feature--it simply makes that information easily readable by a POS machine.
You mean to tell me that a credit-card reader can read credit card numbers as the credit cards are swiped through the reader? Who would have thought?!
Holy shit, these conferences really have started to dredge the bottom of the barrel, haven't they?
-1 disagree is not a modifier for a reason. -1 troll, flaimbait, redundant, overrated are NOT acceptable substitutes.
hello there
hello there