At the recent Black Hat security conference in Las Vegas, hacker Adam Laurie revealed a flaw in the Square credit card reader hardware/software that allows the injected emulation of credit card data to fraudulently obtain funds. This discovery highlights the importance of robust financial security.
He inserted a different wire into the iPad’s headphone jack, so the software thought a dongle was plugged in. Then he modified some software he had already written for translating magnetic stripe data (we mentioned he’s a hacker, right?) and then typed in a credit card number. The data was converted to sound, and the app read the information as if a real card had been swiped. Then he could deposit funds into his Square account, which are delivered within a day.
The hack works because the dongles do not encrypt the data, which is sent to the iPhone as audio. It is expected that Square will correct this with the release of new encrypted hardware.
Via Popsci.
I don’t get what all the fuss is about. It’s a novel hack, but a curiosity and nothing more. What the HELL does it matter if the reading hardware is encrypted if the card itself isn’t, so long as the communication to the net is? If you have physical access to a card, it’s insecure, period. That’s how the system works. There’s nothing to fix except the way data is stored on-card itself. Especially since, with square and most other payment processors, you can type the number in directly and it only costs about 1% more of the transaction – not a huge deal if you’re already committing fraud.
When the money isn’t there, they will catch on and track the person down. Don’t do it.
I personally wish Square would not update their dongle with encryption, because that would just be an admission that there is some merit to this attack. You still need access to the magnetic stripe and the CVV1 number that’s only on there. The only think this attack does is to make fraud slightly more convenient because you don’t need to create a fake magnetic stripe. Which I guess is something, but not enough to warrant much more expensive sophisticated encrypted dongles.
I guess Square has never heard of PCI or feels they for somereason do not need to follow Payment card indsutry standards regulations or best practice. read and learn. https://www.pcisecuritystandards.org/security_standards/index.php
Hey ‘security’, do you have some kind of actual document to link? The official standard is not publicly viewable, and so far you haven’t actually made any sort of argument except to say that Square is somehow wrong.
The fact remains, regardless of what that document says, there’s no security gained by encrypting the OFFLINE link between the magstripe reader and the phone. If the magstripe is unencrypted, it’s just unencrypted, period. Using a square dongle only saves a would-be thief a $20 or so entry cost to get a stripe reader, which are highly and cheaply available, square or not.
Encryption in the new reader will be useless for preventing the injection of card data. For the new readers, data can still be injected via a voice coil, transmitting it through the card reader head.
The “missing security” there between the reader and the Android/iOS device is the exact same thing you get when you buy a USB or “keyboard wedge” style reader – easily obtainable online. Buy one of those and open your favorite text editor, then swipe a card – presto, there’s your card data, in the clear.
This is neither new nor clever. Systems that transmit data in easily-portable formats, like audio (the square reader, the door keypad in that scene in Wargames), or serial data (keyboard wedge readers) are all easily subverted by man-in-the-middle attacks.
Even with encryption, this doesn’t prevent a replay attack, unless the square reader is going to have a small clock in it so it can be hashed against the time stamp and used as a form of authentication and sequencing. Even then…what type of encryption would this use?
If it used asymmetric key encryption…the damned software would give you the public key to encrypt the data you are sending every time. Thus making it useless.
If it used symmetric key encryption…then it would have to store a key on the square reader and the app. Chances are the key would be static, so it wouldn’t be long before someone cracked the key. And further more if the reader could store a key, it would be easy enough to sniff the traffic on the audio connector and figure out what the encryption key is. So all of these measures are kind of worthless.
And last but not least, why bother? If someone has a credit card number and the security key on the back, they can easily make purchases online. And if someone were foolish enough to do this, I think it wouldn’t take long before someone caught on. Even with falsified information.