BajaNomad
Not logged in [Login - Register]

Go To Bottom
Printable Version  
 Pages:  1  2
Author: Subject: Credit Card Chip Fraud DAMNED IMPORTANT YOU SEE THIS
SFandH
Elite Nomad
******




Posts: 7084
Registered: 8-5-2011
Member Is Offline


[*] posted on 8-30-2013 at 08:26 AM


It would be interesting to know exactly what information is contained on the chips.

I guess I could buy a reader.

UHF Handheld RFID Reader, Order Now!




Want to adopt a mellow Baja dog or cat? - https://www.facebook.com/bajaanimalsanctuary/
View user's profile
Bruce R Leech
Elite Nomad
******


Avatar


Posts: 6796
Registered: 9-20-2004
Location: Ensenada formerly Mulege
Member Is Offline

Mood: A lot cooler than Mulege

[*] posted on 8-30-2013 at 08:45 AM


try this
https://www.youtube.com/watch?feature=player_embedded&v=...




Bruce R Leech
Ensenada

View user's profile
Bruce R Leech
Elite Nomad
******


Avatar


Posts: 6796
Registered: 9-20-2004
Location: Ensenada formerly Mulege
Member Is Offline

Mood: A lot cooler than Mulege

[*] posted on 8-30-2013 at 09:35 AM


some readers can work from up to 12 feet away and can write info on your card also



Bruce R Leech
Ensenada

View user's profile
DavidE
Ultra Nomad
*****




Posts: 3814
Registered: 12-1-2003
Location: Baja California México
Member Is Offline

Mood: 'At home we demand facts and get them. In Mexico one subsists on rumor and never demands anything.' Charles Flandrau,

[*] posted on 8-30-2013 at 12:47 PM


I'd like to clone Carlos Slims' black American Express card on my hotel room access card. New Bugatti? No problemo! Hire a 175' schooner for an around the world trip? No problemo.

I could rig up a 9 volt thyristor fired pulse that would cause the magic black smoke to rise from any reader, counterfeit or no.

Actually, I had a nice talk with Wells Fargo. They are clued that an attempt to secure 1st class airfare to Damascus for 12, would more than likely not be legit. Same for one ATM withdrawal in Montpelier at 9:00AM and another in Tijuana at 1:00PM. If I purchase something online, it is sent to my PO box in Chula Vista. Otherwise it's all mid-Baja California usage.




A Lot To See And A Lot To Do
View user's profile
elbeau
Nomad
**




Posts: 256
Registered: 3-2-2011
Location: Austin, TX
Member Is Offline


[*] posted on 8-30-2013 at 01:09 PM


Quote:
Originally posted by MitchMan
elbeau,
Just how far away from a reader (inches, feet?) can a credit card be read in most cases?


That's a trickier question than you may think. RFID chips like those in credit cards do not have any internal power source like a battery. They get powered by an electrical field that is generally produced by the same device that listens for the RFID transmission but there's no reason that the RFID reader can't be decoupled from the device producing the electrical field.

If you are purely interested in the "read range" of the credit card regardless of the electrical field range powering the tag, then very long ranges can be achieved. All you need is a sensitive antenna. When a credit card comes within the electric field produced by an RFID credit card machine it starts broadcasting your credit card information. People assume that only the nearby credit card machine can pick up the signal that is being broadcast but this is not true. All you have to do is point a decent antenna towards a legitimate RFID credit card machine and you will see people's credit card numbers when they use their cards.

So, to answer your question more directly, the power source creating the electric field that powers the RFID chip must be fairly close to the card but the antenna picking up the signal can be far away.
View user's profile Visit user's homepage
elbeau
Nomad
**




Posts: 256
Registered: 3-2-2011
Location: Austin, TX
Member Is Offline


[*] posted on 8-30-2013 at 01:32 PM


Quote:
Originally posted by Bruce R Leech
some readers can work from up to 12 feet away and can write info on your card also


It is true that almost all passive RFID chips like the ones in credit cards support 2-way communication and that is what blows my mind about the unencrypted implementations. You could make the whole implementation perfectly safe by doing asymmetric encryption. Let me explain:

Right now your credit card's RFID chip broadcasts your actual credit card number when the RFID reader powers the chip. Instead of doing this the reader should first contact the credit card company and obtain a token piece of text to send to the tag. The tag could then append your credit card number to the random text, encrypt the result, and broadcast the encrypted text instead of broadcasting your credit card number. The reader never needs to see your unencrypted number, it can just pass the encrypted message to the bank. The bank can decrypt the message to get your credit card number, check that the token is valid, and check that the token came from the machine it was initially issued to.

That may sound a little complicated but it's very easy to implement and is commonly used in other applications. The result is that the RFID works just the same for the consumer but your information is never broadcast out unencrypted. The merchant can't even see your credit card number which makes it much more secure than swiping your card.
View user's profile Visit user's homepage
DavidE
Ultra Nomad
*****




Posts: 3814
Registered: 12-1-2003
Location: Baja California México
Member Is Offline

Mood: 'At home we demand facts and get them. In Mexico one subsists on rumor and never demands anything.' Charles Flandrau,

[*] posted on 8-30-2013 at 02:49 PM


When an unauthorized reader queries the chip let an unauthorized transponder reply with a 10 watt full course reply. Enough to fuse their circuitry.



A Lot To See And A Lot To Do
View user's profile
chuckie
Elite Nomad
******




Posts: 6082
Registered: 2-20-2012
Location: Kansas Prairies
Member Is Offline

Mood: Weary

[*] posted on 8-30-2013 at 02:55 PM


Do we get the transponder on Ebay, how big is it, does it fit in a wallet?



View user's profile
elbeau
Nomad
**




Posts: 256
Registered: 3-2-2011
Location: Austin, TX
Member Is Offline


[*] posted on 8-30-2013 at 02:56 PM


Quote:
Originally posted by DavidE
When an unauthorized reader queries the chip let an unauthorized transponder reply with a 10 watt full course reply. Enough to fuse their circuitry.


That's also very true. It doesn't take much effort to fry the chips. It's not uncommon for passive tags to fry randomly with normal use. Intentionally frying them is very easy.
View user's profile Visit user's homepage
elbeau
Nomad
**




Posts: 256
Registered: 3-2-2011
Location: Austin, TX
Member Is Offline


[*] posted on 8-30-2013 at 02:58 PM


Quote:
Originally posted by chuckie
Do we get the transponder on Ebay, how big is it, does it fit in a wallet?


Umm...I'm starting to worry about why you want to know :P
View user's profile Visit user's homepage
MitchMan
Super Nomad
****




Posts: 1856
Registered: 3-9-2009
Member Is Offline


[*] posted on 8-30-2013 at 03:00 PM


Thanks, elbeau.

Let me see if I understand. It sounds as though the credit card's RFID chip is capable of being empowered with electromagnetic energy (electromagnetic field) from an external source (such as an RFID reader) and then it, the credit card's RFID chip, then broadcasts electromagnetic energy waves that contain the credit card info.

It sounds like the credit card has to be close enough to the reader to be within the readers energizing field. Right? Also, once the credit card RFID chip is energized and broadcasting, such broadcasted info can be picked up by an adequately "sensitive' antenna that could be far away, right?

All this, if I am correct, sounds like the RFID reader needs to be close to the credit card, but the antenna picking up the info broadcast by the energized credit card RFID chip can be much farther away from the credit card than the reader, right?

Lastly, it sounds like the RFID reader can be as far away from the RFID credit card as 12 feet.

Man, if I am right about this, that is absolutely and totally unacceptable.

elbeau, the method you described to provide security by employing the "token" text (or "key") coupled with encryption should be the only way this thing is implemented. Seems similar to the way that networks and password routines work.
View user's profile Visit user's homepage
MrBillM
Platinum Nomad
********




Posts: 21656
Registered: 8-20-2003
Location: Out and About
Member Is Offline

Mood: It's a Zip-a-Dee-Doo-Dah Day

[*] posted on 8-30-2013 at 03:08 PM
EBay ?


http://www.ebay.com/sch/i.html?_nkw=RFID+reader

Amazon ?

http://www.amazon.com/s?ie=UTF8&page=1&rh=i%3Aaps%2C...
View user's profile
elbeau
Nomad
**




Posts: 256
Registered: 3-2-2011
Location: Austin, TX
Member Is Offline


[*] posted on 8-30-2013 at 03:09 PM


Quote:
Originally posted by MitchMan
Thanks, elbeau.

Let me see if I understand. It sounds as though the credit card's RFID chip is capable of being empowered with electromagnetic energy (electromagnetic field) from an external source (such as an RFID reader) and then it, the credit card's RFID chip, then broadcasts electromagnetic energy waves that contain the credit card info.

It sounds like the credit card has to be close enough to the reader to be within the readers energizing field. Right? Also, once the credit card RFID chip is energized and broadcasting, such broadcasted info can be picked up by an adequately "sensitive' antenna that could be far away, right?

All this, if I am correct, sounds like the RFID reader needs to be close to the credit card, but the antenna picking up the info broadcast by the energized credit card RFID chip can be much farther away from the credit card than the reader, right?

Lastly, it sounds like the RFID reader can be as far away from the RFID credit card as 12 feet.

Man, if I am right about this, that is absolutely and totally unacceptable.

elbeau, the method you described to provide security by employing the "token" text (or "key") coupled with encryption should be the only way this thing is implemented. Seems similar to the way that networks and password routines work.


You are correct about how it works, but the reader can be much farther away than 12 feet. The electric field size can't get much larger than that without breaking a lot of EM emission regulations, but the antenna can be much farther away.

Yes, the encryption protocols are commonly used in networking and are not specific to RFID implementations.
View user's profile Visit user's homepage
elbeau
Nomad
**




Posts: 256
Registered: 3-2-2011
Location: Austin, TX
Member Is Offline


[*] posted on 8-30-2013 at 03:16 PM


Quote:
Originally posted by elbeau
You are correct about how it works, but the reader can be much farther away than 12 feet. The electric field size can't get much larger than that without breaking a lot of EM emission regulations, but the antenna can be much farther away.


I just re-read what I wrote and need to clarify that the "reader" is the device reading the signal from the antenna, not the device creating the electric field, so the reader/antenna can be much farther away than 12 feet, but the device creating the electric field needs to be within several feet of the RFID tag.
View user's profile Visit user's homepage
MitchMan
Super Nomad
****




Posts: 1856
Registered: 3-9-2009
Member Is Offline


[*] posted on 8-30-2013 at 03:29 PM


Thanks again, elbeau. That last post with clarification was invaluable.
View user's profile Visit user's homepage
dasubergeek
Senior Nomad
***




Posts: 694
Registered: 8-17-2013
Member Is Offline


[*] posted on 9-1-2013 at 10:26 PM


All this tin-foil hat business. Look at your credit card. Find the little radio signal icon. Smash it with a hammer (try not to hit your magnetic strip, because that would be bad).

Done and done.
View user's profile Visit user's homepage
 Pages:  1  2

  Go To Top

 






All Content Copyright 1997- Q87 International; All Rights Reserved.
Powered by XMB; XMB Forum Software © 2001-2014 The XMB Group






"If it were lush and rich, one could understand the pull, but it is fierce and hostile and sullen. The stone mountains pile up to the sky and there is little fresh water. But we know we must go back if we live, and we don't know why." - Steinbeck, Log from the Sea of Cortez

 

"People don't care how much you know, until they know how much you care." - Theodore Roosevelt

 

"You can easily judge the character of others by how they treat those who they think can do nothing for them or to them." - Malcolm Forbes

 

"Let others lead small lives, but not you. Let others argue over small things, but not you. Let others cry over small hurts, but not you. Let others leave their future in someone else's hands, but not you." - Jim Rohn

 

"The best way to get the right answer on the internet is not to ask a question; it's to post the wrong answer." - Cunningham's Law







Thank you to Baja Bound Mexico Insurance Services for your long-term support of the BajaNomad.com Forums site.







Emergency Baja Contacts Include:

Desert Hawks; El Rosario-based ambulance transport; Emergency #: (616) 103-0262