9 ms·

Aren't credit cards nowadays basically physical private keys? IIRC transactions are one-time payloads signed specifically for that operations, so intercepting t

Aren't credit cards nowadays basically physical private keys? IIRC transactions are one-time payloads signed specifically for that operations, so intercepting that won't help you if I'm not mistaken about how cards work nowadays.

literalAardvark 1y ago
Kind of, but if you control the card reader you could charge more for the transaction without showing the amount, for instance. And maybe even send the money to a different account.
- Aurornis 1y ago
  Sending money to an arbitrary different account isn’t going to happen from the terminal reader itself. Banks don’t have wide open protocols where anyone can submit a credit card transaction and have it go to arbitrary accounts. Remember that credit card companies eat the cost of the fraudulent charges. They’re not going to make it easy for those to occur.
  - literalAardvark 1y ago
    Yeah, I did think of that. I've never played with one of those so I don't really have much of an imagination about what they could do with a cracked one.
    - lelanthran 1y ago
      > Yeah, I did think of that. I've never played with one of those so I don't really have much of an imagination about what they could do with a cracked one. I've got a couple on my desk right now; there's nothing I can do with them to steal money, even though they're in dev-mode.
      - literalAardvark 1y ago
        Someone in a parent post mentioned that you could change the merchant entirely, thus syphoning off the money to a potentially more accessible account.
        lelanthran 1y ago
        > Someone in a parent post mentioned that you could change the merchant entirely, thus syphoning off the money to a potentially more accessible account. That would be something I'd like to see. The terminals I have worked on do not store merchant details. A merchant ID is stored on the terminal, with the ID mapping to an actual merchant account on the backend. In order to have the merchant account on the backend, you need to be a customer of that terminal supplier. If you are a customer, they know: a) Where your terminals are deployed b) Your real details c) The terminal's ID and the terminal's serial that maps to that specific merchant ID. So, let's say we do change the merchant ID from `12` to `24` on the terminal. The request goes up with `transaction(<amt>, 24, 'sr-12345')`, and then the backend rejects because terminal sr-12345 is not mapped to merchant 24. Lets say we also manage to fake the serial number. Then the transaction is approved, but can be easily reversed because merchant 24 is a customer and we have: 1. Their bank account number 2. Their physical address 3. The company registration number 4. Verified ID copies of the owner, directors, managers, etc. 5. Their money (from their transactions). So, yeah, I'd love to know more about how they execute this hack; it would require complicity on the backend to a large degree. 3.
        literalAardvark 1y ago
        Yeah, ideally you'd need a valid merchant id, pos id and a way to siphon from the other merchant. Probably not worth the small amounts you could make before caught
  - thwarted 1y ago
    Credit card companies eat the cost of fraudulent charges that they can not pass on to/blame the merchant for.
    - Aurornis 1y ago
      Which is why they won’t have a public API that allows running transactions that send money to arbitrary accounts. If someone altered the terminal to charge more (a hypothetical suggestion above), they could recoup that money from the merchant’s account because they have an agreement in place. You can’t run arbitrary transactions to arbitrary accounts (the other proposed attack above) because there isn’t an agreement in place.
  - Arrowmaster 1y ago
    You should read up on the wonderful system they call ACH.
    - kortilla 1y ago
      That’s precisely why credit card readers aren’t attached to it
  - nine_k 1y ago
    Arbitrary account, no. An arbitrary merchant, yes.
    - account42 1y ago
      That typically doesn't even need root access though but only a numeric PIN. Of course rout access might let you conceal what you are doing better.
- lelanthran 1y ago
  > Kind of, but if you control the card reader you could charge more for the transaction without showing the amount, for instance. Not supposed to be possible on a certified terminal. The certification tests this particular case (the transaction is a hash of the keys, amount and a few other things. The display of the swipe/tap/insert screen and the pin-entry are under control of the certified kernel, so the userspacve application has no control of the amount that is displayed). > And maybe even send the money to a different account. Not from the card reader.
  - cesarb 1y ago
    I've heard of it happening here in Brazil. In the simplest variant, something is glued on top of the screen to hide the higher digits, making the value appear to be lower; supposedly, some more advanced variants of the scam have a damaged or tampered screen.
    - clait 1y ago
      I was victim on this attack in Argentina. Paid a taxi with my card, and got charged 50x the amount shown on the display.
weaksauce 1y ago
unless it's changed recently that only applies to tap and chip payments (which you should always prefer to avoid card skimmers) and not the old slide the ~~barcode~~ magnetic strip kinda payment.
- cesarb 1y ago
  Does anyone still use the magnetic strip? I think it's been over a decade since I've seen a credit card without the chip, and terminals have been able to read the chip since forever. I think the last few times a store tried to use the magnetic strip on my card (because the chip failed to read due to a bad contact), the transaction was simply rejected due to not using the chip.
  - bdangubic 1y ago
    2 times just this week I was asked to swipe, “issues with the chip reader” (CVS and Wegmans)
    - girvo 1y ago
      That's wild to me, the last time I had to swipe my card here in Australia was sometime in the early 2010s! Heck a lot of the terminals here can't swipe a card at all
    - joefife 1y ago
      Seems surprising to me. I've not swiped a UK card in many years. Honestly can't remember the last time. It's curious you're seeing so many stripe fallback incidents. Is this a USA issue?
      - bdangubic 1y ago
        possibly, can’t recall having any issues in europe where I reside over the summer.
    - jamwil 1y ago
      USA was very late to adopt chip/tap terminals, even relative to Canada. I could be wrong but IIRC it was only when Apple Pay came along that tap-enabled terminals began to hit critical mass.

literalAardvark 1y ago

Kind of, but if you control the card reader you could charge more for the transaction without showing the amount, for instance. And maybe even send the money to a different account.

Aurornis 1y ago
Sending money to an arbitrary different account isn’t going to happen from the terminal reader itself. Banks don’t have wide open protocols where anyone can submit a credit card transaction and have it go to arbitrary accounts. Remember that credit card companies eat the cost of the fraudulent charges. They’re not going to make it easy for those to occur.
- literalAardvark 1y ago
  Yeah, I did think of that. I've never played with one of those so I don't really have much of an imagination about what they could do with a cracked one.
  - lelanthran 1y ago
    > Yeah, I did think of that. I've never played with one of those so I don't really have much of an imagination about what they could do with a cracked one. I've got a couple on my desk right now; there's nothing I can do with them to steal money, even though they're in dev-mode.
    - literalAardvark 1y ago
      Someone in a parent post mentioned that you could change the merchant entirely, thus syphoning off the money to a potentially more accessible account.
      - lelanthran 1y ago
        > Someone in a parent post mentioned that you could change the merchant entirely, thus syphoning off the money to a potentially more accessible account. That would be something I'd like to see. The terminals I have worked on do not store merchant details. A merchant ID is stored on the terminal, with the ID mapping to an actual merchant account on the backend. In order to have the merchant account on the backend, you need to be a customer of that terminal supplier. If you are a customer, they know: a) Where your terminals are deployed b) Your real details c) The terminal's ID and the terminal's serial that maps to that specific merchant ID. So, let's say we do change the merchant ID from `12` to `24` on the terminal. The request goes up with `transaction(<amt>, 24, 'sr-12345')`, and then the backend rejects because terminal sr-12345 is not mapped to merchant 24. Lets say we also manage to fake the serial number. Then the transaction is approved, but can be easily reversed because merchant 24 is a customer and we have: 1. Their bank account number 2. Their physical address 3. The company registration number 4. Verified ID copies of the owner, directors, managers, etc. 5. Their money (from their transactions). So, yeah, I'd love to know more about how they execute this hack; it would require complicity on the backend to a large degree. 3.
        literalAardvark 1y ago
        Yeah, ideally you'd need a valid merchant id, pos id and a way to siphon from the other merchant. Probably not worth the small amounts you could make before caught
- thwarted 1y ago
  Credit card companies eat the cost of fraudulent charges that they can not pass on to/blame the merchant for.
  - Aurornis 1y ago
    Which is why they won’t have a public API that allows running transactions that send money to arbitrary accounts. If someone altered the terminal to charge more (a hypothetical suggestion above), they could recoup that money from the merchant’s account because they have an agreement in place. You can’t run arbitrary transactions to arbitrary accounts (the other proposed attack above) because there isn’t an agreement in place.
- Arrowmaster 1y ago
  You should read up on the wonderful system they call ACH.
  - kortilla 1y ago
    That’s precisely why credit card readers aren’t attached to it
- nine_k 1y ago
  Arbitrary account, no. An arbitrary merchant, yes.
  - account42 1y ago
    That typically doesn't even need root access though but only a numeric PIN. Of course rout access might let you conceal what you are doing better.
lelanthran 1y ago
> Kind of, but if you control the card reader you could charge more for the transaction without showing the amount, for instance. Not supposed to be possible on a certified terminal. The certification tests this particular case (the transaction is a hash of the keys, amount and a few other things. The display of the swipe/tap/insert screen and the pin-entry are under control of the certified kernel, so the userspacve application has no control of the amount that is displayed). > And maybe even send the money to a different account. Not from the card reader.
- cesarb 1y ago
  I've heard of it happening here in Brazil. In the simplest variant, something is glued on top of the screen to hide the higher digits, making the value appear to be lower; supposedly, some more advanced variants of the scam have a damaged or tampered screen.
  - clait 1y ago
    I was victim on this attack in Argentina. Paid a taxi with my card, and got charged 50x the amount shown on the display.

weaksauce 1y ago

unless it's changed recently that only applies to tap and chip payments (which you should always prefer to avoid card skimmers) and not the old slide the ~~barcode~~ magnetic strip kinda payment.

cesarb 1y ago
Does anyone still use the magnetic strip? I think it's been over a decade since I've seen a credit card without the chip, and terminals have been able to read the chip since forever. I think the last few times a store tried to use the magnetic strip on my card (because the chip failed to read due to a bad contact), the transaction was simply rejected due to not using the chip.
- bdangubic 1y ago
  2 times just this week I was asked to swipe, “issues with the chip reader” (CVS and Wegmans)
  - girvo 1y ago
    That's wild to me, the last time I had to swipe my card here in Australia was sometime in the early 2010s! Heck a lot of the terminals here can't swipe a card at all
  - joefife 1y ago
    Seems surprising to me. I've not swiped a UK card in many years. Honestly can't remember the last time. It's curious you're seeing so many stripe fallback incidents. Is this a USA issue?
    - bdangubic 1y ago
      possibly, can’t recall having any issues in europe where I reside over the summer.
  - jamwil 1y ago
    USA was very late to adopt chip/tap terminals, even relative to Canada. I could be wrong but IIRC it was only when Apple Pay came along that tap-enabled terminals began to hit critical mass.