Get Smart about Business Spending
The hands-free way to steal a credit card
Update on February 22, 2008, at 3:20 p.m PST: This blog has been updated to include a response from American Express.
WASHINGTON D.C.--Adam Laurie, an RFID security expert, used the Black Hat DC 2008 conference here, to demonstrate a new Python script he's working on to read the contents of smart-chip-enabled credit cards.
As part of his presentation Wednesday, Laurie asked for someone from the audience to volunteer a smart card. Without taking the card out of the volunteer's wallet, Laurie both read and displayed its contents on the presentation screen--the person's name, account number, and expiration clearly visible.
Demonstrations like that show the potential misuse of RFID technology in the near future. Without touching someone, a thief could sniff the contents of an RFID-enabled credit card just in passing. The same is true for embedded RFID chips in the human body, work access badges, some public transit cards, and even the new passports in use in more than 45 countries.
As a disclaimer, Laurie said he spoke to American Express, the company that issued the volunteer's card. Laurie said that American Express told him: "We are comfortable with the security of our product." Laurie added that the company told him the number he displayed on the presentation screen was not the account number printed on the card, which Laurie proved by opening the wallet and comparing.
"The alias number on American Express' ExpressPay cannot be used for online transactions," said Molly Faust, American Express' Public Affairs representative, in an e-mail to CNET News.com. "ExpressPay has multiple security mechanisms. As the payment host, American Express would not verify/authorize an online transaction using just the alias account number. There are several other security mechanisms that would be required in order for payment authorization to take place."
The credit card industry has argued that use of the RFID-enabled cards will save customers time when processing payments.
An extreme example can be found in Spain. Laurie said a public beach there encourages visitors to have RFID tags injected into their bodies. The point? Merchants along the beach scan your wrist to obtain a unique ID from which they can debit your account. The advantage? You won't have to go to the beach with your wallet, which might get stolen.
Laurie, who has an injected RFID-tag, showed how easy it was not only to read the tag, but also to re-write the tag. During his demo, he used the coding sequence reserved for animal tagging to have his RFID chip declare him an animal.
On his RFIDiot Web site, Laurie offers the Python scripts free of charge and also sells the hardware necessary to read and write to RFID tags and cards.
As CNET's resident security expert, Robert Vamosi has been interviewed on the BBC, CNN, MSNBC, and other outlets to share his knowledge about the latest online threats and to offer advice on personal and corporate security. Listen to his podcast at securitybites.cnet.com or e-mail Robert with your questions and comments. 
Just think if everyone had this inserted into them. HEY close that
window, we don't want any more of our rights to fly out it
please!!!!!!
with passports and credit cards you don't need to be able to use the data in the manner card or passport issuer intended for the data to be dangerous. data of any kind can be used to identify or target an individual.
just because i can't easily use a credit card number to buy stuff doesn't mean having a person's credit card information is a good thing. you can still cause all manner of havoc with the information, using the card name or type in a scam, or just figuring out who has an american express card in their possession.
the trouble with RFID passports is that broadcasting your identity and nation of origin is not a good idea in any country, including the united states. being able to scan a crowd for american passports (or brits, or israelis) makes targeted kidnapping and bombing much more effective.
anyone with an ounce of security training will tell you that you should do your best to blend in when you are in a foreign country so you will not become a target for terrorism, crime, or espionage. having your credit card and passport broadcasting personally identifiable information via RFID is the opposite of blending in.
In the UK you can buy them at www.smartcardfocus.com/skimstopper
This seems a simple solution to a big problem.
I know they work hard and think they are doing the right thing by exposing potential dangers, but guess what most people don't know how to make a bomb until someone tells them step by step.
Expose the threat not the do it yourself!
- by julietroland90 August 30, 2009 10:53 AM PDT
- and i want u to mail me the number of the card
- Like this Reply to this comment
-
(10 Comments)