1

I am relatively new to security and I would call myself an amateur researcher as I do not even work in IT.

However, I remember having a MS605 card reader / writer / encoder and I loved playing around with it and reading data off random cards I had laying around my house. It had always dawn on me if it were possible to perform a buffer overflow by using the card, or maybe a dos attack (really anything malicious). I would think it would be possible to perform something similar to an SQL injection attack where the input escapes itself, and maybe allowing for command injection?

I am no expert but I have always been curious about this. Does anyone know if it’s even possible? I don’t even know what the security is like on say a gas pump or atm when it comes to validating a credit card. I just assume with carefully crafted input something malicious could be done here.

Improve this question
1
  • The strip or the reader is not even close to the point. The only relevant part is your last point: it all has to do with the software that processes the data from the card. So your question is like asking "is it possible that a piece of software has a vulnerability?" and the answer is "sure it's possible"
    – schroeder ♦
    May 22 at 15:50

1 Answer 1

Reset to default
1

Theoretically Possible but unlikely.

Due to:

  • The small size of the magstrip, because the compromise needs to be contained in the strip itself, my smallest commandline injection attack was `touch /tmp/a`.

Although thinking of it:

  1. Using a series of cards to create a shell script a i.e. `echo "#/bin/bash">/tmp/a.`
  2. Then executing a `/tmp/a`
  3. Then laughing all the way to the bank.

This seems to be very like the good old days with punch card computer computing.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.