Slashdot Mirror
This Gizmo Knows Your Amex Card Number Before You've Received It (csoonline.com)
itwbennett writes: A small device built by legendary hacker Samy Kamkar can predict what new American Express card numbers will be and trick point-of-sale devices into accepting cards without a security microchip. Because American Express appears to have used a weak algorithm to generate new card numbers, the device, called MagSpoof, can predict what a new American Express card number will be based on a canceled card's number. The new expiration date can also be predicted based on when the replacement card was requested.
That sounds pretty damned broken to me.
Are these guys not even trying?
Lost at C:>. Found at C.
This isn't exactly an amazing product. The way Amex generates replacement card numbers is utterly trivial, the hardest part of it's calculating the new check digit. There's really no excuse for that kind of triviality, a replacement card should have a complete new number unrelated to the old one.
Really? I mean, really?!
Think out the implications of this. You have an Amex card, and your information gets comprised when a retailer's system is hacked. The standard response is for the credit card card companies to cancel your existing card and issue you a new one with a different account number.
Issuing you a new card is pointless if the new account number can be predicted by anyone who has the old one. The new expiration date is also predictable based on when the card was replaced, which should be pretty easy to guess in the case of mass replacements due to a hack.
>The new expiration date can also be predicted based on when the replacement card was requested.
You don't say.
Most linux users don't know this, but the man pages were named after Chuck Norris. Chuck Norris fsck'ing hates noobs!
0. Surprisingly, cards are compromised all the time.
1. Some issuers know that as many as 40% of their cards in force are actually compromised.
2. All issuers employ fraud detection systems intended to identify the first fraudulent transaction. They aren't 100% effective, but getting better.
3. EMV (chip) cards add a significantly better authentication step by verifying the physical card is in fact being used. But this does little or nothing for card-not-present (cnp) transactions, like buying from Amazon or eBay.
4. American Express probably first does the usual fraud detection, spots fraud, disabled the card, and when a new one is issued might very well already have that account under greater scrutiny, at least for a while. Maybe.
5. Some fraud may even be 'ignored' to gather more information.
6. Most importantly, however, a replacement card must be activated, acknowledging receipt by the card holder. The fraudster must also break into that process or wait for the card holder. That's weak point maybe.
7. And purchases can leave a trail.
I'm being this is not such a big deal as it seems, at and easily fixed.
deleting the extra space after periods so i can stay relevant, yeah.
Expiration dates are indeed predictable. One common trick used by subscription services is to merely bump it the appropriate number of years during their auto-renew phase rather than complaining to the user (and therefore offering a reminder that it exists, thus possibly getting the service canceled, and that's lost revenue!).
Giving a random range of -1 to +4 months from the standard shouldn't harm anything (except the aforementioned squirrelly services?) and would offer a lot more protection. Consider googling 4147 visa for example; you'll find a few expired credit cards. Now bump the expiration dates by 2 or 4 years. (Slashdot covered this two years ago.)
Use my userscript to add story images to Slashdot. There's no going back.
I had a different problem with Amex.
I had closed my account, but they still kept accepting charges on the card a year it was closed.
The charges were for a product I never signed up to; and although I eventually had them all reversed, it took many months of wrangling.
46137
Well, if we know which kind of Amex you apply to get, we can predict with nearly 100% certainty what the first five digits will be. This means only 10 digits need to be predicted.
Sig for hire.
I had this issue with a cancelled VISA card. It was even a recurring payment that was at one time legitimate.
I merely told the card provider that I had closed my account and if they wanted to keep giving money to that vendor then it was their choice as it was their money, as I'd clearly informed them that I was closing the account and that they shouldn't accept any payments on my behalf.
No idea whether they stopped the payments, but they did stop trying to bill me for them.
I have a corporate AMEX card and compared to my personal Visa/Mastercard cards, security is unbelievably worse.
For Visa/Mastercard cards issues by a local bank, authentication and operations like changing the PIN is done by an IVR system with a preshared password. Sometimes for extra security a live person asks some basic questions like the passphrase or you last weeks' expenses. In fact the bank warns me that I should NEVER tell anyone the card details such as its number, expiration date and CVC code. They rely on other details for authentication, which means if an unreliable bank employee or an eavesdropper records all this info, they will be unable to use it to spend your money.
When I activated my AMEX card, the customer rep asked me for all information printed on the card (including the number, all codes, expiration date etc.), and even was helpful enough to set the PIN retrieval number to the batch code of the card (printed clearly on the front of the card)!
Also, it appears they have no SecureCode/3DSecure system. Sometimes (but not always) online charges ask for your ZIP code (but not a one-time password like other banks do).
AMEX security looks like it was designed by a first-year student. Maybe it's a common thing for US banks to put convenience before security. European merchants frown upon chipless cards and ask for proper ID, and almost all online purchases require 3dSecure/SecureCode authentication with a one-time password (usually sent by SMS or a hardware token).
News for morons. Stuff that's dumbed down.
The problem with digital security is that to have enough security you need so huge numbers that you can't remember what was the original one. If you can't remember the stuff how would you expect to validate something? Humans will loose to machines in every way, so it's easier to make humans secure instead of machines secure.