Android app swipes contactless credit card | Hacker News Reader

Android app swipes contactless credit card

newscientist.com

38 pointsdlapiduz15 comments

The one mentioned in the article is no longer in the Play Store. However, this one is still available for download: https://play.google.com/store/apps/details?id=com.idstrongho...

I gave it a quick try with some credit cards I have and it immediately displayed information.

Here's the github link to the App for anyone who wants more details: https://github.com/thomasskora/android-nfc-paycardreader#rea...

It 404s now.

wow that was quick, guess it was kind of inevitable, wonder if all the forks will have gone as well

Here is a clone which is still up at github: https://github.com/rayyan/android-nfc-paycardreader and this is the most "interesting" bit of source : https://github.com/rayyan/android-nfc-paycardreader/blob/mas... - it can identify card types and that's about it...

Looks like it's not quite up to date - it doesn't have the latest pull request in it

00 A4 04 0C 07 A0 00 00 00 XX XX XX

03 10 10 Visa

04 99 99 MasterCard

04 30 60 Maestro

04 60 00 Cirrus

03 20 10 Visa Electron

03 20 20 Visa V Pay

03 80 10 Visa V Pay

So what's the exploit here? Is it a bug in the cards or the protocol or what? Or is the card info considered "public" by the protocol (i.e. I could imagine an authentication scheme where the card could provide its number but the bank would only honor charges via the secure contactless scheme which came with a RSA cookie or whatenot).

Sorry.. Am calling BS on this... To read any protected memory regions on an NFC card a fairly complicated handshake has to occur with various exchanges of keys - you can't just read details with your average NFC reader in an Android phone using an app that doesn't even require root...

The app is designed to be used with the German GeldKarte which appears to use an old NFC technology. It isn't a credit card, you have to load cash onto it before you can spend it, and doesn't use the same security as modern contactless bank cards.

Also it appears this isn't the first app to do this:

http://www.nfc.cc/2011/12/11/nfc-geldkarte-broken-by-design/

Not exactly BS - it depends on the cards. In the UK this has been demonstrated to work on Visa cards from a few different banks. I did a quick demo for Channel 4 News at their request a little while ago, video:

http://www.channel4.com/news/millions-of-barclays-card-users...

Also did one in a crowded lift for BBC Watchdog and live on This Morning breakfast show. It is pretty old news (as in years old) and is not exactly an effective way to lift lots of details. But makes a cute demo.

Along these lines - are there any good 'hacker' tools out there for the various phone platforms? I know there are port scanners and some other things out there but is this a well-developed space?

Depends what you're interested in, but as an iOS developer I highly recommend Jonathan Zdziarski's "Hacking and Securing iOS Applications", published by O'Reilly. It's a good primer, and covers a wide variety of both exploits and hacks.

http://shop.oreilly.com/product/0636920023234.do

On Android, apart from being able to run Backtrack on certain Android devices you have tools to MITM WiFi and other fun stuff (on rooted phones) and there is some movement in making it into a developed product, e.g. ANTI: http://www.zimperium.com/Android_Network_Toolkit.html

It seems it's already removed from Google Play.

Reply on news.ycombinator.com