Electronic Pickpockets

[leavemealone]

Turns out the paranoid people with tin foil on their heads weren’t completely wrong.

http://www.disinfo.com/2010/12/electron ... t-to-sto...

[ANYUSER969]

There are various reason to oppose implementation of RFID technology.

Not just paranoid religious folk who claim it's the mark of the beast.

Saying things like "paranoid people with tin foil on their heads" is a bit stupid

[freemanjack]

Wow, two posts and it walks like a duck. Wonder if it will Quack.
fmj.

[Sikufanya]

Chip and PIN uses a smartcard with a processor and memory to verify its own identity and that of its owner to a terminal belonging to a merchant. It is based on the EMV — Europay, MasterCard, Visa — protocol, and has been adopted practically universally within the UK for most retail card-based transactions.

The card itself runs part of the protocol on an embedded secure processor, meaning that certain secrets never leave it and are not readable from outside, no matter what.

The ­stripe on the back of a credit card is a magnetic stripe, often called a magstripe. The magstripe is made up of tiny iron-based magnetic particles in a plastic-like film. Each particle is really a very tiny bar magnet about 20 millionths of an inch long. The magstripe can be "written" because the tiny bar magnets can be magnetized in either a north or south pole direction. The magstripe on the back of the card is very similar to a piece of cassette tape fastened to the back of a card. (See How Tape Recorders Work.)

Instead of motors moving the tape so it can be read, your hand provides the motion as you "swipe" a credit card through a reader or insert it in a reader at the gas station pump.

I can't see how either of these methods could be scanned with any kind of radio waves.

I don't know about the new Oyster style Barclaycard though.

[leavemealone]

A contactless smart card is any pocket-sized card with embedded integrated circuits that can process and store data, and communicate with a terminal via radio waves. There are two broad categories of contactless smart cards. Memory cards contain non-volatile memory storage components, and perhaps some specific security logic. Contactless smart cards do not contain an ordinary read-only RFID, but they do contain a re-writable smart card microchip that can be transcribed via radio waves.

Smart cards with contactless interfaces are becoming increasingly popular for payment and ticketing applications such as mass transit. Visa and MasterCard have agreed to an easy-to-implement version currently being deployed (2004–2006) in the USA. Globally, contactless fare collection is being employed for efficiencies in public transit. The various standards emerging are local in focus and are not compatible, though the MIFARE Standard card from Philips has a large market share in the US and Europe.

Smart cards are being introduced in personal identification and entitlement schemes at regional, national, and international levels. Citizen cards, drivers’ licenses, and patient card schemes are becoming more prevalent. In Malaysia, the compulsory national ID scheme MyKad includes 8 different applications and is rolled out for 18 million users. Contactless smart cards are being integrated into ICAO biometric passports to enhance security for international travel.

[markie b]

go on youtube and see mythbusters rfid

is it possible to clone one of these cards and copy the details wirelessly ........ yes actually for about $800 i can get all the software needed the wireless card paddle reader and the device to process and re-distribute the encoded software and details from one card onto a blank card!also if you are willing to go into it even further you can buy a giant paddle (its a massive panel) you load it into the back of a car drive around and it can pick the details up of any rfid card be it passport,bank cards,drivers licenses,expensive car card keys ect ect basically anything that uses a rfid chip/smart chip it can decrypt and re-distribute to another!for a simple paddle you can get these off from ebay for about £15

[leavemealone]

Security Failures in Smart Card Payment Systems
http://www.youtube.com/watch?v=_lMqAseTjj0

Speaker: Steven J. Murdoch

Tampering the Tamper-Proof

PIN entry devices (PED) are used in the Chip & PIN (EMV) system to process customers' card details and PINs in stores world-wide. Because of the highly sensitive information they handle, PEDs are subject to an extensive security evaluation procedure. We have demonstrated that the tamper protection of two popular PEDs can be easily circumvented with a paperclip, some basic technical skills, and off-the-shelf electronics.

PIN entry devices (PEDs) are critical security components in Chip & PIN (EMV) smartcard payment systems as they receive a customer's card and PIN. Their approval is subject to an extensive suite of evaluation and certification procedures. We have demonstrated that the tamper proofing of PEDs is unsatisfactory, as is the certification process.

This talk will discuss practical low-cost attacks on two certified, widely-deployed PEDs -- the Ingenico i3300 and the Dione Xtreme. By tapping inadequately protected smartcard communications, an attacker with basic technical skills can expose card details and PINs, leaving cardholders open to fraud. The talk will describe the anti-tampering mechanisms of the two PEDs and show that, while the specific protection measures mostly work as intended, critical vulnerabilities arise because of the poor integration of cryptographic, physical and procedural protection.

These failures are important not only because they allow fraud to be committed, but also because of their affect on customer liability. As Chip & PIN was claimed to be foolproof, victims of fraud often find themselves accused of being negligent, or even complicit in the crime. The results of this work will help customers in this position argue that their losses should be refunded.

More information about the 25th Chaos Communication Congress can be found via the Chaos Communication Congress website: http://bit.ly/25c3_program

[leavemealone]

Chip and PIN is Broken
http://www.youtube.com/watch?v=gv3dxjvqk7Y
The fraudster performs a man-in-the-middle attack to trick the terminal into believing the PIN verified correctly, while telling the issuing bank that no PIN was entered at all. The paper considers how the flaws arose, why they remained unknown despite EMV's wide deployment for the best part of a decade, and how they might be fixed

[leavemealone]

think i've gone over the top on the smart card fraud stuff.

Electronic Pickpocket
http://www.youtube.com/watch?v=GJbtMclbatU" onclick="window.open(this.href);return false;
Think the credit card in your pocket is safe from thieves? Think again! This story will definitely get your attention.

[leavemealone]

Why the Mythbusters won't do RFID (last hope Adam Savage)
http://www.youtube.com/watch?v=X034R3yzDhw
Adam Savage at The Last Hope explaining why there will never be RFID on Mythbusters.