3

I recently got a magnetic card reader that plugs into my computer because I was bored. I decided to scan my ID and bank card through it and I was surprised to see my ID number/bank card number show up plainly on the screen. Therefore, can you load a custom value onto a blank card (say, another number or SQL injection string) easily with off-the-shelf equipment? And do these attacks occur frequently?

1

1 Answer 1

1

The ID and bank card number isn't exactly private information. After all, these numbers are simply printed on the physical card, so it makes sense that they can be read out as-is by an electronic card reader. This information is analogous to a user name of an email account, for instance.

Actions that involve using the card's embedded microchip, except the most basic ones, require its holder to successfully authenticate, usually done by entering the card's associated Personal Identification Number (PIN).

The cards contain (at least) one certificate (usually X.509), which can be used to sign a document digitally, e.g. a financial transaction (among other things). The document's receiver can then use the digital signature to validate the signer's identity claim.

The certificate(s) comes from a trusted certificate authority (CA), which are also digitally signed by the same CA. In the case of an electronic identity card, this is most commonly the government who issued the card.

So can you easily forge an chipped ID or bank card? The answer is no, because

  1. You'll need more than just the card to use it effectively;
  2. The certificate on the card is very difficult to forge.
3
  • You are conflating the magstripe with the EMV chip.
    – eggyal
    Commented Apr 25, 2014 at 19:33
  • Indeed, my answer is about the microchip. I edited my answer to make this more clear. I haven't encountered an identity card that has a magnetic stripe. Commented Apr 26, 2014 at 6:23
  • Unfortunately, in the US, that is all we have. Commented Apr 26, 2014 at 6:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .