Slashdot Mirror
New Device Sold On The Dark Web Can Clone Up To 15 Contactless Cards Per Second (softpedia.com)
An anonymous reader writes from a report via Softpedia: "A criminal group going under the name of The CC Buddies is selling a hi-tech device on the Dark Web that's capable of copying details from contactless debit cards if held as close as eight centimeters away from a victim's card," reports Softpedia. The device, named Contactless Infusion X5, is extremely dangerous because it can copy up to 15 bank cards per second, something that may come in handy if a crook is going through a crowd at a concert or through a crowded subway cart. The device can collect data such as the card's number and expiration date. If the debit card's RFID chip stores information such as the card holder's name, home address, and a mini statement, X5 can steal that data as well. The X5 is sold on the Dark Web for only 1.2 Bitcoin (~$825), and its creators say that each buyer will receive the X5 device, a USB cable for charging and data transfers, and 20 blank plastic cards.
Is there a way to increase the range with an antenna or something? 8cm is kind of a short range, even at a concert........
"First they came for the slanderers and i said nothing."
My initial reaction is duh. I have software on my phone for security audits that allow me to do the exact same thing. Only it's not meant to do 15 cards a sec. This is how contactless cards work. Maybe the PCI should just start listening to security professionals and do away with these things?
I bought mine here: https://nkna77c37nculpeh.onion... I'm sure they will ship it soon. Totally trustworthy.
Without any authentication is in my opinion is a "technology waiting for misuse" . So, I'm not surprised.
is probably the option that they will offer next for all ya non tech-savvy crooks.
its creators say that each buyer will receive the X5 device, a USB cable for charging and data transfers, and 20 blank plastic cards.
My last smartphone didn't come with a cable OR a charger. Fuck you HTC. ;)
I want peace on earth and goodwill toward man.
We are the United States Government! We don't do that sort of thing.
It also comes with 2 acres in Florida, for a limited time.
Does anyone know if this just clones the data already on the magnetic stripe or if this can copy the cryptographic data inside chip-and-PIN cards which require the user to enter a PIN to use their cards? I'd be interested to hear Brian Kreb's take on this.
in your wallet will defeat it.
Ugh.....3.14961 inches. Stupid Americans
Easy, do what I do. Wear this when out and keep cards in breast pocket. Also harder to pickpocket.
http://www.lessemf.com/personal.html#279
Don't be a tinfoil hat nerd. Cool alternatives exist.
Sure.
Just send the bitcoin, and you'll get the completely illegal and fraud inducing device sent by random strangers to a street address of your choice.
This in no way is a honeypot OR a scam. I mean, why would it be, right?
that's so slow
I got two turn tables and a Contactless Infusion X5!
I'm in Australia where we have had chip cards for years.
Once they became commonplace, the banks then 'upgraded' to contactless cards.
I think that the risk associated with contactless smartcards will only increase as Banks work out how to transfer liability to their merchants and customers.
The X5 is sold on the Dark Web for only 1.2 Bitcoin (~$825), and its creators say that each buyer will receive the X5 device, a USB cable for charging and data transfers, and 20 blank plastic cards.
Let's hope it also comes with a one-way ticket to sunny Guantanimo Bay, Cuba. ;-)
Fuck anyone who buys this.
The only person who gets within a penis length of my wallet is me.
Don't worry, the banks are working hard to solve this security hole... by telling anyone who will listen that these cards are secure, and sticking their fingers in their ears any time anyone says any different.
My bank graciously offered to turn off the feature on my card, from their end, not mine. Which, if you know anything about how these hacks work, means that they're willing to take away all the convenience of the feature, while carefully maintaining the security risks on my card. I declined and cut the antenna instead.
Right now in Canada it is almost impossible to get a credit card without this security hole baked in. They all have it, they brag about it. And worse yet, if someone does manage to clone the card, the bank will insist that it's not possible to do so, and hold you liable for all the fraudulent transactions, after all, the security on the cards is perfect, so you must have authorized it.
How can you arrange 15 cards on every second within a 8 cm radius?
products: https://www.google.ca/#q=rfid+...
QED.
Can we have a cash icon every time a criminal uses cash for a deal?
Oh wait, that's almost always...
(aka encrypted Internet)
There is nothing dark about it, it's your same computers it is just demonized like Ed Snowden.
Since Firefox 45 you can't spoof your timezone. Time logs are one of many ways to track your browser. Mozilla did it on purpose. Also the official Tails site is pumping compromised versions of Tails. Use 1.4.1. You will have to find it in a torrent or someplace because they took it down.
I covered a piece of flexible plastic (your average office plastic folder and scissors does the trick) with some aluminium foil that is the same size as a paper note. Then insert the new rfi blocker in the walled like a note. Now the tap and go doesn't work while the card is in the wallet I have to take it out. You can also get special card covers that do the same thing but my solution is cheap and works fine.
Therefore, the payment system remains secure.
Will an RFID sleeve stop this from happening?
Operating System compatibility:
-Microsoft WHQL 2000, XP, Vista, 7, 8, 10, Server 2003, Server 2008, Server 2008 R2, Server 2012
I'll wait for the linux port. ;)
Anons need not reply. Questions end with a question mark.
"Dark web" used to refer to stuff not found in google (or other well-known search engines, like, er... yeah.) so plenty of stuff not on tor would qualify too.
Then again, the "computer security" cottage industry really likes bandying words around so that their sitting around in office chairs all day sounds exciting and dangerous, like they're fighting the good fight and all that. In reality they're not part of the solution, but that's a discussion for another post.
Anyway, "it's not found on google so it's dark" is a good enough summary for the uninitiated.
You can copy NFC cards with your phone, numbnuts. All this is is a device that automates the process, like any number of issuers of NFC cards would need to use. You could build one yourself, if you wanted to. It's not even hard. And it won't clone a properly configured DESFire EV1 card, for example, because you need cryptographic keys to access the "applications" on the card. If the NFC cards you use in security applications need no authentication to get all data off them, then it's your bloody fault for choosing such deficient technology.
It could be 1000 scans per second, so what? 8mm proximity? I'm sure no one will have a problem with the guy walking around violating everyone's personal space.
An NFC chip would be extremely difficult to clone. The might be able to scrape some information off the NFC that is made public but it is highly doubtful that includes the PIN, the CVV2, the address or possibly even the name of the person. The NFC itself would implement challenge response so that wouldn't be much use either. It's not even obvious to me why point of sale terminals would even need to see what's on the magstripe but perhaps there is a reason. The obvious fix is if a payment card exposes this info then it should obfuscate it, or better yet not expose it at all. Whatever edge case requires it might not be a sufficient reason given any potential for theft.
Why is this a problem?
It seems like this should be completely legal to me.
The problem here is with banks not protecting their shit and implementing half assed security features.
If you are waling around broadcasting your bank details to the whole world that's your problem.
your lame tech is no match for a faraday cage wallet.
"RFID/NFC blocking" wallets are all the rage these days. That is a far bigger scam than this product, which is simply far too late. The only contactless payment method I have is my phone now, after my last contactless card expired a few years ago. I haven't seen a PayPass or payWave card in years, but average people see the chip in their card and believe it doesn't require contact for some reason (My parents and some older doctors I know went full on tinfoil hat when they first got them before I corrected them.)... Fear of the misunderstood or unknown severely affects a lot of people.
Mind you, this does have some potential abusive applications, they're just not really that lucrative. Most public transportation systems have started using contactless cards that have effectively zero protection. The most famous is the Oyster Card, but there are numerous branded versions out there. Toll passes are probably also subject to this kind of abuse. There is little incentive for these agencies to increase their security, too.
Is there some reason we're now using this term? Maybe it's just me, but it really sounds entirely Hollywood.
Can we just say internet? Or web?
Around here we have people that will walk into a mall with a scanner and just stick it on peoples wallet pocket or purse. When security is alerted, they just leave. Security says they weren't doing anything illegal.
As far as I know, any US vendor taking a fraudulent swipe or imprint transaction owns the loss as the bank/cc company won't stand behind a non chip transaction. This scanner won't help anyone make a chipped card. Its rare to have information like the card holders name be accessible in this manner.
So basically small vendors and people working art and wine festivals that are using those stripe scanners you plug into a cell phone will be on the hook until they get stuck with a bunch of bogus transactions, wise up and get a chip based scanner.
so the threat of a random gypsie is the only one (we dont have nigroes, which is awesome because gypsies are less athletic)
So that guy selling wallet protectors on Shark Tank wasn't crazy after all?