Slashdot Mirror
At Black Hat: Square Reader To Credit Card Skimmer In 10 Minutes
New submitter arit writes with word that three recent Boston University grads have demonstrated at Black Hat software and hardware attacks on the Square Reader used by many mobile vendors to process credit card transactions. One of the attacks converts a standard reader into an efficient credit card skimmer (conference slides) with very little effort. Always keep Scott Adams' object lesson in mind.
We have card readers attached to our pay-for-print release stations. Turns out if you open Notepad on the release station, the card reader instantly becomes a card skimmer, because, well, card readers read cards.
The square reader to skimmer trick has been around for YEARS. Cripes all you had to do was record the audio and send the audio files to your skimmer.
Pretty sad that Black Hat has turned into a n00b conference. Was there also a talk on how you can use keyloggers?
Do not look at laser with remaining good eye.
Did anybody expect us to believe something you plugged into a cell phone speaker jack was actually secure in any sense of the word?
Here's a good rule of thumb: if it's a piece of consumer electronics, or involves your phone ... it's probably got terrible security.
The first time I saw a commercial for that I pretty much said "yeah, I would not trust a vendor who uses one of those".
The damned thing is almost guaranteed to be something which can be exploited. Sadly, just like every other piece of consumer electronics which tries to add network connectivity.
Companies don't care about, don't know about, and aren't accountable for security. Stop trusting that they do.
Lost at C:>. Found at C.
Gen 1 was always unencrypted. They didn't hack the gen2 or gen3 hardware to unencrypt it.
I can't tell from the slides whether they used a gen1, gen2, or gen3 reader to do their playback attack.
Even before Square, you could buy card readers on eBay. This doesn't really bring anything to the table.
You are all cows. Cows say moo. MOOOOOOOO! MOOOOOOO! Moo cows MOOOOOO! Moo say the cows. YOU SKIMMED MILK COWS!!
Machine designed to read credit cards hacked to read credit cards. Story at 11.
Do you know about this system where you can't fake transactions? Bitcoins.
This story brought a quote from Gibson to mind for me: "The street finds its own uses for things." (from "Burning Chrome")
Be who you are...and be it in style!
Now add contactless cards, that makes everything better!!
and while we are at it we can become a cashless society too because they are cool!!!!!
Why do so many people seem to want to switch to card technologies that don't even need to be put into the reader to be skimmed and then remove their safer backup systems? Other than the banks I mean, their interest in becoming the only way to pay is obvious, 2% of everything in fees is a lot.
Good job Black Hat for once again exposing what the hacker community has had available for years.
... that anyone would expect this to be particularly hard to do. After all you're just reading bits off a magnetic stripe.
Vendors like to talk as if the security of a system is determined by the toughest component in the system, because then they can simply buy some whiz-bang encryption chip, slap it in their product, and claim their product is nigh unbreakable by ordinary mortals. But the truth is the security of a system is determined by its *weakest* component, and in this case that starts with the card itself. Trying to secure that is like trying to secure your butter by nailing it to the butter dish.
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
Taking a photo of both sides of a credit card is also quite efficient as a recording mechanism. There's nothing special on the stripe. Credit cards, payments, security: choose any two.
Nice job Google advertising, an article about Square being "hacked" and your advertising Square, with a Free card reader! I agree though this seems like a lot of "controversy" over something that should be obvious to anyone who understands ANYTHING about technology. And as with most payment methods you have to trust the person on the other side of the register to a degree because even with hardened POS terminals there are often childishly easy ways to slip a system inbetween to skim card numbers.
When will the US finally abandon this stupid magnetic stripe + signature on a piece of paper and actually enforce proper chip & pin cards ? The technology has been available for 30 years now !
It is totally impossible to secure credit cards given the way that credit card transactions work. I simply don't understand how come credit cards work the way they do. There's absolutely no authorization step involved.
You just slashdotted Dilbert.
That's an accomplishment.
I can see the fnords!
Unless things have changed in the last decade, the magnetic stripe on a credit card simply contains the card number, expiry date, and name on the card. There is nothing on the stripe that isn't visible on the card. It isn't a security feature--it simply makes that information easily readable by a POS machine.
nike tn You should dress perfectly according to the occasion. Your dressing reveals your nature and personality. All the gatherings or occasions will be having a particular theme behind. Shoes form the most important accessory that has to be taken cared. You should always wear a matching shoe along with your outfit. Sneakers will go in combination with jeans and tops. This is best for you and is also comfortable as it gives complete comfort to legs by covering them completely. None of sneaker lovers would hesitate to own a pair of Air Jordan Shoes. As lovers of Air Jordan Shoes keep close eyes on the updates on it. Whenever there is any news or rumor about release of Air Jordan Shoes, we will try to make it clear and get one of them. As the Air Jordan 11 anniversary, this year air Jordan shoes come back with more amazing style Nike Free pas cher . When the Air Jordan 11s were retroed in 2000-2001 they would prove to become the retro that sold in the highest quantity ever and also the fastest selling Air Jordan's of all time.
You mean to tell me that a credit-card reader can read credit card numbers as the credit cards are swiped through the reader? Who would have thought?!
Holy shit, these conferences really have started to dredge the bottom of the barrel, haven't they?
-1 disagree is not a modifier for a reason. -1 troll, flaimbait, redundant, overrated are NOT acceptable substitutes.
hello there
hello there
BE SMART AND BECOME RICH IN LESS THAN 3DAYS....It all depends on how fast you can be to get the new PROGRAMMED blank ATM card that is capable of hacking into any ATM machine,anywhere in the world. I got to know about this BLANK ATM CARD when I was searching for job online about a month ago..It has really changed my life for good and now I can say I'm rich and I can never be poor again. The least money I get in a day with it is about $2,000.(two thousand USD) Every now and then I keeping pumping money into my account. Though is illegal,there is no risk of being caught ,because it has been programmed in such a way that it is not traceable,it also has a technique that makes it impossible for the CCTVs to detect you..For details on how to get yours today, email the hackers on : (atmmachinehackes @ gmail.com). Tell your loved once too, and start to live large. That's the simple testimony of how my life changed for good...Love you all ...the email address again is atmmachinehackes @ gmail com