Tag Info

Hot answers tagged

163

You can't clone the chip. A magnetic strip holds a secret number, and if someone knows that number they can claim to be the owner of the card. But if a bad guy swipes the card, they then know the number, and can make their own card, i.e. "cloning". This has turned out to be a major practical problem with magstripe cards. A chip also holds a secret number. ...


52

The chip carries out a cryptographic operation on data passed to it that requires knowledge of the key that is strongly protected within the chip - so an attacker cannot easily copy the card. That said, there have been some successful research papers on timing or power attacks, but these are from lab conditions, and probably not a real worry in the wild. ...


41

Any Faraday cage will do the trick. So a shielding of just about anything conductive, be it aluminum foil, conductive paint, wire mesh, or any of a number of similar alternatives is going to be opaque to radiation. That means no radio waves in or out, which means the RFID signal is blocked. Note that the size of the mesh has to be significantly smaller than ...


26

That code isn't necessary. This may cause more fraud and more chargebacks, but Amazon keeps those numbers low so that they can offer a faster shopping experience such as one-click. The only thing necessary to make a purchase is the card number, whether in number form or magnetic. You don't even need the expiration date. Most systems require more information ...


26

You don't actually need the CVV to perform transactions, they're just required by most retailers as a means of verifying that you have the physical card in your possession. From Wikipedia (unsourced): It is not mandatory for a merchant to require the security code for making a transaction, hence the card is still prone to fraud even if only its number ...


24

I'm not an expert at using stolen credit cards... but from what I know: You could resell the numbers on the black market. You could buy stuff and have it shipped to a rube who reships it to you. You could "quickswap" on eBay. (Use the credit card to purchase an item that is shipped directly to the auction winner, and you pocket the money from the auction ...


22

Amazon pays a slightly higher rate to accept your payment without the CVV, but the CVV is not strictly required to present a transaction - everybody uses CVV because they get a lower rate if it is present (less risk, less cost). Nobody who knows what they are doing will store your CVV - if the card networks suspect that you are storing CVV, you will have ...


21

"None of us are security experts" and "I wouldn't feel comfortable with a company storing my credit card information in this manner" are completely valid arguments. From a technical perspective (on the merits), they ought to end the discussion. But if you're arguing with folks who are not security experts, they may not be in a position to recognize good ...


21

The magnetic strip contains the exact information used to identify the card. The chip holds a piece of information that it doesn't share, but that it can use to prove it has that information. Thus, a magnetic stripe is dumb and can be copied, but since the chip doesn't give out its secret, a vendor can't simply copy it when you use it. A magnetic stripe ...


20

Yes, that last someone is correct, in addition to encryption (confidentiality) HTTPS gives you the assurances that the form is coming from where you think it is (authentication), and that it has not been interfered with in transit (integrity). Without HTTPS the form could be modified by a MITM as described. It'sNot using HTTPS for this is simply bad ...


19

From an end user perspective, i usually give the reader and surrounding plates a good whack with my fist and i try and peel back any of the faceplates with my keys or a knife. The fact of the matter is, the best quality skimmers aren't detectable. POS machines can be hacked which results in an almost undetectable scenario. Your best bet, if you want to avoid ...


18

Storing card numbers means you must comply with the requirements of PCI-DSS, or you risk fines and breach of your merchant account contract. PCI-DSS has an enormous set of requirements - some sensible, some onerous, some of questionable usefulness - and the cost of complying with it, and certifying that you've complied with it, can be very high. Download ...


18

Next time you go to the shop leave your card in your wallet and try as much as you can to pay for your purchase. Try with several different card readers to be sure. If you can't pay, then it's pretty well protected. If you can, well... I can't speak for that particular wallet but it is certainly possible to block RFID in that manner. It just depends if they ...


16

Cardholder name, 4 last digits of CC number and its expiration date are all NOT sensitive data. The cardholder name and expiration date only require protection if you are storing them with the full primary account number, not the truncated 4 digit number. If you are storing, processing, or transmitting cardholder data then you must meet all of the other PCI ...


15

Aside from the already mentioned attacks involving unauthorized usage of a credit card, the credit card information can also be used for social engineering and identity theft. As a somewhat current example, see how Mat Honan got hacked last summer : http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-honan-hacking/all/ In his case, Apple only required ...


14

Other answers already given are correct, but I would like to give the following as an answer with no technical background required on part of the person asking: When you use a magnetic strip Credit Card, the device is saying to the card: "My user will input a PIN to verify, let me read your strip so I can check it". ( EDIT: OK, the above paragraph is not ...


13

Basically, someone stealing CC numbers will need to find a way to monetize them. This can be done for instance by printing fake cards with the stolen info, using them to buy goods and then sell those goods again. For someone who only wants to do the hacking part (not the real-life monetizing part that includes shopping), selling the stolen CC no's to people ...


12

Here's an example of a scam to pull money from stolen credit cards by gambling online: Obtain 10,000 credit card #s. Sign up for online gambling accounts using these cards, attempting to charge $100 to gamble with. Let's say 10% actually work - now you have 1,000 accounts and $100,000 to gamble with. Play these accounts, losing to a select few accounts. ...


12

Creating Luhn valid credit card numbers is not difficult, if you need them they're available here amongst other places. The trick for the criminal is tieing up the credit card number to the rest of the data to create a fraudulent transaction (CVV, expiry, name, perhaps address). Even if I have the customers name, expiry date and last 4 digits, brute force ...


12

To be precise, an aluminum foil can do the trick. I hope your RFID Blocking wallet is actually blocking them. I am afraid that it is hard to test the practical way as it is happening unless you are a an IT expert in that field Or a RFID hacker ;) However there are good products available that promises against RFID theft. sample : ...


10

You would need CVV and expiration date for verification, although expiration date is on the front face of a card. Also required is the billing address, or at a minimum, the zip code of the billing address, neither of which are on the front or back of the card. However, this depends on whether you're buying something retail, in person versus online. If you ...


10

The principle has been used before, your wallet will act as a Faraday cage. This means that the inside of your wallet cannot be affected by electronic fields. This prevents the RFID from being read out. However normally a Faraday cage is closed, so as long as your wallet is closed with the card inside and the metal completely covering your card, you should ...


9

It basically works like this: the server has a master key (the BDK) and each client device has a unique serial number and a counter (which when combined are the KSN). To set up a new device you encrypt the KSN using the master key (the BDK, the process described in the link in Yoav's answer) and you get a new key (the IPEK). It's kind of like where you ...


9

Couldn't find many resources online, but I imagine this should be spec'd quite comprehensively somewhere. What I did find out however is this description of the derivation process. If I understand this correctly, the derivation function works roughly as follows: The KSN is normalized using some form of padding The normalized KSN is then encrypted with the ...


9

You've asked a bunch of questions. Do we need a new protocol for credit card transactions? "Need" is not the right word. Credit card security is all about risk management: balancing the losses due to security problems, against the costs of a better security mechanism. In the credit card space, there are huge costs to changing the protocol, given the huge ...


9

The CVC (sometimes "CVV" or "CVV2") is supposed to indicate whether the card is present at the time of the transaction. Card companies require that it never be stored or recorded, but rather passed directly from the customer to the merchant gateway and then immediately forgotten. Therefore, any time you give that number to a merchant, they're supposed to use ...


9

The newest skimmers cannot be seen. These skimmers wafer thin and insert into the card reader: To make matters worse the modification can be purely software. ATMs can be hacked, their software can be modified to log the mag strips and pins of every user. This is a purely loosing battle and you take a chance every time you use an atm. Security is ...


9

For cardholder present transactions, there's very little in terms of physical security within the PCI DSS. Cardholders are responsible for their cards and aren't supposed to hand them over to others for third party storage. What should happen in this scenario to limit the access of all bartenders etc to the card is that a pre-authorisation of $0.01 should be ...


8

In the strictest sense the safest thing to do is to, of course, As you've no doubt found this can be difficult in a distributed environment. The specific vulnerability scanning tool you use can also add in some problems. Take Nessus for example. When building a scan profile there is an option called, "Check for PCI-DSS compliance." This makes a bunch of ...


8

A man in the middle could easily manipulate the post target, so it doesn't point to the secure HTTPS url anymore. The user cannot see whether the target is secure (without looking at the HTML code), so he just has to believe that the POST target is secure. This scheme of an unsecure HTTP form calling a secure HTTPS url, is always vulnerable to SSL-strip.



Only top voted, non community-wiki answers of a minimum length are eligible