Hacking RFID Credit Cards

H

HardOCP News

[H] News
Joined
Dec 31, 1969
Messages
0
For all of you with RFID enabled credit cards, look out...stealing your info is getting easier and easier. Imagine this guy with a tiny ASUS EeePC in a backpack with his card reader. Hit the link for the full video.

But on today's episode of Boing Boing tv, hacker and inventor Pablos Holman shows Xeni how you can use about $8 worth of gear bought on eBay to read personal data from those credit cards -- cardholder name, credit card number, and whatever else your bank embeds in this manner.
Click to expand...
 
There's guides out there on how to bust an RFID chip implemented in plastic cards. I highly recommend reading up on it; I personally will be break the RFID chips in any plastic cards I'm given in the future.
 
InorganicMatter said:
There's guides out there on how to bust an RFID chip implemented in plastic cards. I highly recommend reading up on it; I personally will be break the RFID chips in any plastic cards I'm given in the future.
Click to expand...

Linkage for the lazy?
 
We've been using RFID in the quarters and dollar coins up here in Canada for a while now. We use it a spy tool, no really we track every quarter on the globe with a big satellite *puts tinfoil hat on*

http://www.cbc.ca/technology/story/2007/01/10/rfid-defence.html

Its a definite security risk for a credit card - although it can be minimized by simply having an extremely low daily limit for RFID transfers (say $20) The convenience for most will probably outweigh the risk.

And if you believe Zeitgeist, the ulterior goal of RFID is far more sinister.
 
so why did the CC companies decided to use RFID ??
Click to expand...

It was driven by a time motion study at McDonalds drive thu's that determined that 87% of the time used to interact with a customer was accepting payment and making change. It was determined that by reading an RFID in a customers credit card as they were handed the food, that throughput at the drive thu could be more than doubled, pumping hundreds of millions per year into the general economy by increasing McDonalds profits, causing more McDonalds to be built thus providing low skill low wage jobs that are needed as as offshore interests eliminate our manufacturing and tech based jobs. Additional corporate profits are ensured by charging 18% interest on a $4.99 meal and a $39 late fee if you forget to pay the bill on time, further infusing the banking system with the billions of dollars they need to offset the disaster by giving every Tom Dick and Harriet a sub-standard balloon mortgage on an overpriced home. In short, its good for the country, reduces terrorism and will help find Bin Laden as his next Visa card will be specially encoded and if he ever gets near a fast food Hamburger joint we will have him, finally. If you are wondering if the McDonalds study might have been secretly funded by the DHS you are on the right track.


I plan on marketing a wallet incorporating a Faraday Cage as soon as the patent goes through. In the meantime don't put your tin foil hat on your head, wrap it around your credit card. Of course if you pull it out and actually attempt to use it, you are susceptible to being "snooped".
 
RFID is one step closer to Gattaca.

Really though, there are many that would prefer a unique RFID chip simply be implanted into every person at birth (along with other things like their medical ailments, genetic defects, social status, credit rating, military rank, etc..)

Its one of the scariest new technologies that I personally think can have serious detrimental effect, but also can achieve great social and economic prosperity *if not abused*

Bringing computers and software to the masses rarely had any detrimental downside, maybe just a little more waste in the landfills, but everything does that.
 
Easy problem to fix, just like the the passports with that ^#^% chip a hammer can solve that problem without requiring a new card.
 
Leadsled said:
Easy problem to fix, just like the the passports with that ^#^% chip a hammer can solve that problem without requiring a new card.
Click to expand...

That is against the law and punishable by up to 25 years in prison IIRC... and no one likes breaking the law... right? :rolleyes:

Then again, this technology looks like it will have some helpful uses, depending on what information is allowed to be legally tracked, stored, and for how long.

If you plan on breaking the law... essentially... use cash.
 
just imagine them 'turning off' the implanted chips so you can no longer buy or sell. You can be enslaved with a flick of the switch.
 
I love that name - BoingBoing! :D

I worry that they will eventual mandate these chips to be in driver's licenses via the Real ID Act.
 
I used to teach an RFID lab in college, things are not quite as bad as everyone is making it sound. ;) There are a number of security flaws with the credit card system that american express is using, but they're an exception. Most companies that are going to bring RFID to their business portfolio realize the need for security.

The "hacker" the video interviews is kind of a tool, I hate to say. He claims that credit card companies don't really care about your actual security, they only care about you're perceived security.....thats B/S. Most major credit card companies cover all fraudulent purchased. Pain in the ass if that happened yes, but its not THAT big of a deal.

I could go on forever about this if anyone wants, but just save it to say, don't be so freaked out.:eek:

Oh, and w/ regards to the passport issue, it is easy to break the encryption on the chip, yes, but all you're left w/ is a number that corresponds to you. Someone still needs access to the database where "everyone's" info is stored. People think that all their personal info is actually stored on the chip.
 
PyroHoltz said:
I used to teach an RFID lab in college, things are not quite as bad as everyone is making it sound. ;) There are a number of security flaws with the credit card system that american express is using, but they're an exception. Most companies that are going to bring RFID to their business portfolio realize the need for security.

The "hacker" the video interviews is kind of a tool, I hate to say. He claims that credit card companies don't really care about your actual security, they only care about you're perceived security.....thats B/S. Most major credit card companies cover all fraudulent purchased. Pain in the ass if that happened yes, but its not THAT big of a deal.

I could go on forever about this if anyone wants, but just save it to say, don't be so freaked out.:eek:

Oh, and w/ regards to the passport issue, it is easy to break the encryption on the chip, yes, but all you're left w/ is a number that corresponds to you. Someone still needs access to the database where "everyone's" info is stored. People think that all their personal info is actually stored on the chip.
Click to expand...


They only cover the charges on THAT card. When somebody steals all their info and uses your Social Security info to get more cards and lines of credit in your name, well you are shit out of luck. They will give you credit monitoring for a year after trying to hid the attack for about 2 or 3 months. That whole we will cover fraudulent purchases with our card is part of the perceived security. Just like with banks. It is cheaper to pay up when a problem arrises than put the money in place to keep it from happening in the first place. If you truely think that all of your info is 100% safe in the hands of a bank and CC company and that there is no chance of anything bad ever happening with your info you go right ahead and think that.
 
*waves hand* RFID is the future for shipping and tracking packages.

I work for the founder of RFID so its got its uses in the markets we sell to. No i dont have a chip in my body.
 
damn cant edit. Not founder but large inventer of tags and seller of equipment. I dont work with it at work though, its a different group.
 
If I receive RFID enabled cards, I always call up the bank/whatever to request a non-tagged card. I never use that feature (I have never even seen a terminal that supports any of those things like Mastercard Easypay) so it's nothing but a liability for me.

I'm too busy to look it up, but it sounds like these RFID tags are still transmitting in the clear. :rolleyes:
 
Exavior said:
They only cover the charges on THAT card. When somebody steals all their info and uses your Social Security info to get more cards and lines of credit in your name, well you are shit out of luck. They will give you credit monitoring for a year after trying to hid the attack for about 2 or 3 months. That whole we will cover fraudulent purchases with our card is part of the perceived security. Just like with banks. It is cheaper to pay up when a problem arrises than put the money in place to keep it from happening in the first place. If you truely think that all of your info is 100% safe in the hands of a bank and CC company and that there is no chance of anything bad ever happening with your info you go right ahead and think that.
Click to expand...

Your info will NEVER be 100% safe, pal. There will always be paranoid people who assume all sorts of inaccurate info. I'm not sure how you think someone will get your SSN. As for opening lines of credit in your name, thats ridiculous too, all of that documentation goes to your mailing address, not to one of "their" choice.

As someone has said, this is the future of shipping and receiving.
 
Exavior said:
They only cover the charges on THAT card. When somebody steals all their info and uses your Social Security info to get more cards and lines of credit in your name, well you are shit out of luck. They will give you credit monitoring for a year after trying to hid the attack for about 2 or 3 months. That whole we will cover fraudulent purchases with our card is part of the perceived security. Just like with banks. It is cheaper to pay up when a problem arrises than put the money in place to keep it from happening in the first place. If you truely think that all of your info is 100% safe in the hands of a bank and CC company and that there is no chance of anything bad ever happening with your info you go right ahead and think that.
Click to expand...

Your SSN is not stored in the credit card's rfid chip.
 
PyroHoltz said:
Your info will NEVER be 100% safe, pal. There will always be paranoid people who assume all sorts of inaccurate info. I'm not sure how you think someone will get your SSN. As for opening lines of credit in your name, thats ridiculous too, all of that documentation goes to your mailing address, not to one of "their" choice.

As someone has said, this is the future of shipping and receiving.
Click to expand...

S1N3R6Y said:
Your SSN is not stored in the credit card's rfid chip.
Click to expand...


I was refer to somebody hacking into the banks systems, or by some other means obtaining the CC companies data for all their customers, NOT them stealing it off the cards. It would seem that this is a pretty easy thing to do if you bother to read the news so that I how I think somebody will get my SSN.

As for opening lines of credit, that is a hell of a lot easier that you are making it to be. Have you ever purchased a car or got a store credit card? All you do is walk in and give them your SSN they don't mail you stuff before you get the line of credit. I have purchased multiple cars by just walking into the dealership, giving them my SSN and other info, and within 2 or 3 hours I was driving away in my new car. Same goes for any store card I have ever got. I walk in, fill out a form, they call it in and within about 10 minutes I have a new line of credit. When I was getting my house, I don't think anything was ever mailed to me till afterwords. All comunications occured between me and the realitor and loan officer via phone and email. I can't recall anything ever being mailed to me. As it would take a lot longer to tell me to come in and sign papers if they had to mail me a letter asking me to come in. So even there somebody could buy a house with your SSN.

How the hell can you think that idenity theft isn't real?
 
PyroHoltz said:
Your info will NEVER be 100% safe, pal. There will always be paranoid people who assume all sorts of inaccurate info. I'm not sure how you think someone will get your SSN. As for opening lines of credit in your name, thats ridiculous too, all of that documentation goes to your mailing address, not to one of "their" choice.

As someone has said, this is the future of shipping and receiving.
Click to expand...

Sure, RFID is probably great for inventory management and tracking. But what does that have to do with credit cards?
 
SockMan! said:
Sure, RFID is probably great for inventory management and tracking. But what does that have to do with credit cards?
Click to expand...

I agreed, RFID isn't the best technology to use for CC transactions. I am only saying, it's not quiet as unsafe as the interview/article is claiming.
 
Instead of passive RFIDs, I'd like to see transactions via cell phone become mainstream. We'd keep the current system for those who don't have cell phones.

But the Sprint, Verizon, etc would have to have the same standard and software and it would take forever for them to agree.
 
You must log in or register to reply here.
Back
Top