Hacking Through the Air | Contactless Payments and NFC
ฝัง
- เผยแพร่เมื่อ 2 พ.ค. 2024
- So, there’s a high probability that you’ve used a contactless payment method today, whether that’s for your morning ‘decaf soy latte with an extra shot’ or for the underground fare, it all depends on your daily routine and lifestyle.
With solutions such as Apple Pay, our phones are basically becoming our wallets too. However, that’s literally an ‘all eggs in one basket’ situation.
To stay safe in the digital jungle, it’s important to keep up to date with the latest technologies, their vulnerabilities and techniques for their mitigation.
In today's video, we’re going to squeeze out the juice of Near-Field Communication’s pros and cons.
Chapters:
00:00 - Intro
06:15 - Hard
09:25 - Magnetic Stripes
11:18 - PIN code
17:12 - EMV
18:41 - Near-Field Communications
20:33 - DIY POS terminal
23:00 - Conclusion
Useful videos:
Watch This Before You Buy Bitcoin
• Bitcoin Is Not Anonymo...
How To Disappear Completely and Never Be Found
• How To Disappear Compl...
How To Remove Your Personal Data From The Internet | Tutorial
• How To Remove Your Per...
#digitalSecurity #Sumsub #Personaldata
Sumsub - empowering compliance and anti-fraud teams to fight money laundering, terrorist financing, and online fraud.
More about us:
sumsub.com
/ sumsubcom
/ sumsubcom
/ admin - วิทยาศาสตร์และเทคโนโลยี
I don’t get how this channel doesn’t have millions of subscribers. The videos are so informative and well-produced. Definitely underrated!
Channels not even a year old yet
I don't even want people to know this channel ,
@@I_Unintentionally_Morph why?
For real
@@I_Unintentionally_Morph why not?
Are you a scammer? xD
Are we just going to ignore the ever changing high quality spaces you film in?!
Sumsub is a company, I guess that help in having access to all these filming locations.
We are running away from the hackers trying to catch us, that's why
@@Pysslis no way?? This is all sponcon??? 😭😭😭
@@hb3393 I'm not complaining tho. They're not in-your-face hard sellers. There doesn't even seem to be an agenda to these videos other than information. I didn't even know this till I read this thread. It's not deceptive imo
@@hb3393 so what? what's so bad about this?
layers and layers of valuable information here 💡
I'm amazed at averything, and specially, at how high quality this channel's content is!
Keep it up!
Thanks for your support!
Thanks. I noticed a video trying to sell expensive "radio theft proof" wallets and came searching for an explanation. Luckily I found it here and realized that the people trying to sell you fancy wallets are the real scammers. There is no threat of someone stealing your credit card information by walking by you with a scanner.
Fun fact: The foil between the card and reader doesn't necessarily need to "block" the signal, it just needs to soak up enough of the energy that's coming off of the reader to make the card unusable. This is fairly easy to do because of how little energy readers use.
Another great video.
Maybe because I rarely do small transactions (no coffee shot habit here, thanks) I've actually never done a phone pay or NFC card transaction. Some of the grocery stores here in fairly average suburban and small city USA, don't even reliably read the chip on credit cards, and often then do work upon swiping the magnetic stripe! Likewise at gas (petrol) stations.
Holding 4 different credit cards in front of a Chrismas laser array shows that 1 is totally opaque, 1 is almost opaque but allows some light (both green and red) through the borderlines of the CPU chip, 1 lets a bit of red show through the card, and one has its empty innards well lit up by the red array. But no NFC coil in any of them.
I've never asked for an NFC version of my cards, but I've also not ever refused any offer where they push out new types of cards.
Generally NFC cards will have a symbol on them that looks like a wifi symbol, The NFC antenna won't always be a circular loop but may be rectangular or close to the outside edge of the card if you look with a light.
Personally i've always found NFC to be the most reliable method of card payment, it very rarely fails compared to chips or magnetic strip (my cards have all three options).
Recently got into programming basics and this channel has potentially set me on the route of cyber security and penetration testing (@John Hammond is responsible too though tbh)
You should checkout Live Overflow's channel! th-cam.com/users/LiveOverflow Specifically his older "Basics" series. You can learn a lot about many flavors of cyber security, he pretty much got me excited for it in the first place - I now work with browser security on a daily basis and I have to thank him for introducing me to it.
@@kcnl2522 what do you mean? 😅🤔
@@tatka_5470 thanks! will definitely check it out
@@kcnl2522 the advice is very much appreciated, thank you kind sir! I've had trouble with that, my solution is to find one and only one tutorial/course i find interesting, when i do i put all other study topics on hold and just burn through that one course without dispersing my energy. Once I've completed it, only then do I go on to other things/topics/courses/tutorials. Keeps things nice and compartmentalised, and stops me wasting energy on a thousand things
@@tatka_5470 thanks
Stunning set design, everytime
this channel must be the best one i subscribed to in the past 10 years alone
Your Russian pronunciation of the Kavrakov's full name was extremely good, was pleasantly surprised. Great breakdown, great vid. Keep it up
Yea same, it surprised me too
Brilliant breakdown, I sent this very video to my mother to alleviate her fears
This is my favorite channel on youtube. Thank you for making such insteresting videos!
Our pleasure!
16:35 this instant transition to a perfect russian accent really caught me off guard lol
This channel is god tier,fr.
There's ways to extend the range on the card readers using certain antennas, people put them in backpacks and capture cards in small space like elevators. This method is useful for capturing cards to enter buildings, garages and the like. It won't be able to capture a smart bank card due to the configuration. It can however damage them, I do that to old cards I don't use anymore.
Alas, as you noticed you can't capture more than one at a time, putting an old card behind the new one blocks both.
Skimmers that go on the line between the bank and the terminal are still an issue.
Hey, Im interested in learning how you did this and How its replicate able, Any way we can get in contact?
@@nopeyep2089 I don't put personal details on here or "break the wall".
Essentially all you can do is optimise the coil. At some point amplifiers or filters just won't work as there's no signal there to boost.
A lot of devices have deficient coils and you can usually get a bit extra out of it. They also have orientation and mere positioning can be the difference between getting a signal and not.
There's a reason the readers on public car garages use massive coils.
what a great channel i just found , love your approach cheers from NZ
first time in your channel....such good quality. I'm living for..+ one subscriber
Thanks so much! Welcome on board. :)
X files theme song in the outro? 😃
Thank you
Spectacular Bradventure!
Awesome content bro. Thanks
Usually your content is very up to date and informative on cutting edge tech. I had a nfc app on my Samsung galaxy s7 able to read through wallets in 2016…
Yeah reading really isn't the hard part. No matter how good your reader is, you can only ever get the card number and expiration date - the card simply doesn't transmit anything else. The only place where that is useful is online, but there you also need the CVC and these days often a second factor (SMS/app code). Also, the point about multiple cards is still valid I don't know of any commercial NFC readers that can handle multiple cards.
I disagree with a couple of key points. The main protocol of the bank cards, emv, is fully open. It's actually pretty easy to implement, I've done it for both contact (stick the card into a reader) and contactless (nfc). Furthermore, multiple stacked cards are definitely readable. The underlying standard (iso14443) has a built in mechanism to allow reading multiple cards "at the same time" (not exactly, it quickly switches between them), but since most people don't need it, it's often not implemented.
While i'd agree that for the most part the things he talks about in videos are not 110% Technically correct, I'd argue that is probably a good thing, the things he makes videos on are correct enough to make your average Joe re-think things.
If he where to bombard people with all of the 110% Technically correct information. the average Joe would be half way through some other video before sumsub covered 5% of the Technically correct info. and at the end of the day most of his videos i have seen are aimed at making your average Joe more aware of things they may have taken for granted or not put much thought into.
@@Tr3m0rz sure, but he's wrong on some fundamental points, which leads to a false sense of security. While a bank card is almost impossible to clone, it's not because two cars together can't be read. An NFC blocking waller is still important for a lot of other applications
@@jetseverschuren I really can't comment on the bank card thing, i'v never really done any research into them or their technologies beyond a cursory glance, i was more referring to his video's in general.
Though i do agree that NFC Blocking wallets have their purpose, there are devices available for purchase, or diy build-able that will quite easily pull data from every person in an elevator or from a casual stroll past in a busy shopping centre for instance without needing to get close enough to warrant any suspicion from the targets, paired with some other similar devices one could take all of this accumulated data and load it onto a device capable of storing a great number of these and replaying them to any reader.
I'm being intentionally vague with the wording of that, but i get the feeling you're more than aware of these devices.
Thank you Bradley
Brilliant! Nice video, keep growing!
Good job hope you get more exposure .
Perfect opportunity for Ridge Wallet as a sponsor
Awesome video bro!
Thanks a ton
I Love this
I am doing fyp of NFC security, I think the general of talking give me sort of idea on it. Thanks man, you're handsome
Our Myki ticket system in Melbourne has that issue if you hold two cards together that have NFC it comes up on the screen with multiple card read
very underrated channel
The Knowledge never ends !!!!
There are already phone apps around that can read card number and name using nfc. I worked for a card reader company before. I'm sure a malicious programmer who have worked in similar company/technology can make apps that can steal more info.
Great content, just subscribed!
Happy to see ..🔥🔥
Nice man 💯
This guy really did his homework
Love your videos!!
We love you too!
A lot of this information is very UK? non-US specific. As in they went to chips far before we did and we still didn't implement them right when we did it. Most of the history is quite good. It's just that we still have actual magnetic strips and chips and tap.
Dat audio clip at the very end though 😍
how does the usbmon work with the hydra and do you have a arduino or something with it also tutorial for the last parts :D
A shame this video got little views so far but this is what i call long term relevant content. Its not super time sensitive and very educational. Might even blow up in the future.
Awesome video as usual
Bruuuh! This homie got me cracking up at 5am! 😂
Greetings from Rīga! Nice video!
P.S. we don't give tips by card, it's not possible here. Only cash, even if you paid by card for your order. And tipping is not so widespread as in UK or USA.
Here in India digital payment system is so ingrained you can basically max out your credit card limit in single contact less payment if you want. I am a student hence have small credit card limit of ₹25k but can do single 25k transaction if I really want ofcourse given I have usable limit.
Oh my god the Black Books reference was 👌👌
Really nice explanation
Glad you think so!
I always use 2 cards, one with no nfc that I use for larger transactions, and one with nfc from a different account that has very less balance
Smart man
Same I have limited credit card limit and also daily limit of contactless payment no matter how much unused limit I have.
The only think that bothers me is that these card controls are wildly different from one bank to other. It's frustrating. I have a card that allows for daily limit but not per transaction limit. Another that does the opposite. I want both damn it. 😂
It’s called contactless but 99% of people rub their card or phone all over the the thing anyway
Yes I absolutely hate it.
Please can u use cookies be used go get your information ?? Eg credit card details
Very educational Bradley Best regards Andrew
Thanks Andrew, I'm glad you enjoyed it.
16:34 that pronunciation was on point!
the stores often threw the carbons in the garbage so anyone rummaging the store's dumpster could get the carbons and get the info.
also stores had telephone directories of stolen numbers they would get on a monthly update and would have to look up the numbers.
make it a standard at the credit card co side to always ask for the security code on the card and 2fa (if set up by customer) then even if the terminal does not support that the transaction will not work.
I downloaded an app on my phone it lets me on select NFC cards tap on phone get full 16 card nber cvv exp other cards request my pin to access it. It's hit and miss
Could you make a video about the most secure SSD or external drive for Android and IOS? And we as a daily user, how do we protect important or sensitive data from that SSD? Hope you notice me, from the Philippines. Your channel is worth to watch.
As long as there are clever individuals inclined to break such security measures, they'll always eventually become vulnerable somehow. It's just the way things are 😁
That's just the way it is 🎵
@@Sumsubcom whoa I'm all giddy I got a reply 🤣🤣. Love all your stuff, as a security guy myself, I completely realize the value in bringing this info to the people! It's needed now more than ever, keep up the good work!
People being scared of new things is normal, like you say. It's dumb when you don't try to understand it then.
Thanks for the great video
love it hehe
I have a friend who told me she discovered several transactions had been made from her bank account from a city nowhere near us, while none of her bankcards had been stolen. The bank reimbursed her for the fraudulent payments and told her the thieves had used a "fake card". I couldn't understand how that could be remotely possible for the reasons given in this video. The only clue was that the transactions were small and over a short amount of time, like they were within the pay-wave limit.
I don't understand how it was done! I looked into CNP transactions, but that's for credit cards. I was hoping the NFC reader you made would provide some clues.
get the word out..use cash
@@filmaker256 going back to being a luddite doesn't help. The card, issued to her by her bank in person, STAYED IN HER WALLET THE ENTIRE TIME. It could have stayed locked in a vault in her home and she paid for everything down to her road toll with cash in person. It would not make any difference! How could a duplicate possibly be made?
I like banknotes and coins, they are filled with history and mistakes that can sell for more. Just think, you may soon have some with King Charles, making the one's you have now, with "The never to be equaled Queen Elizabeth" left to grab up in a frenzy ♥
Even if, in principle, they are secure, implementers are too often lazy, which can introduce implementation flaws or even design vulnerabilities (which take a long time to remove ue to compatibility). The fact that _any_ private data is being passed unencrypted (and subject to eavesdropping) is a red flag, when there is little reason establishing a secure link couldn't be a first mandatory step.
Use cash anything electronic Is awful .
Can someone post the link the the HOW I DO video where the guy puts magnetic dust on the credit card. Thanks
Speak to this guy to join the dark side ^
Not for payment but i've long been considering making NFC cufflinks (Okay, maybe more so RFID but the idea is the same.) but im too busy making soldering balls instead lol.
It's all about the cameras isn't it. I always cover up my card number with my thumb when I'm making a contactless
I can talk about this now, but a friend of mine figured out how the credit card companies create card numbers and the security numbers using an algorithm. She got paid but sadly was caught and passed away in Chesapeake city jail.
Hey, thanks for existing, bye.
Guess what, if you use the Lloyds banking app, there is a section on there that shows your pin just in case you forget it. I’ve had to use it a couple of times. So the pin is stored. It’s accessible on your online banking app….
I never leave without my wallet Ive literally been detained and taken to a station for not having my ID on me but then Im Black. I was released 10 min after getting to the station but not driven back to where they stopped me just told I could leave.
had this happen to me once on the bus. dunno why the person that got the info bought cow skin rugs but atleast the bank took my side without a fight
Contactless doesn't transmit your actual card number. It uses alternates linked to your account for each purchase.
Can you make a video on how Machine learning is used in cyberspace or cybersecurity please😁😁
Sounds like a good idea!
@@Sumsubcom give a heart for the comment dude😂
So what you're saying is that someone could theoretically run Doom on their credit card chip?
Yee buddy
What bothers me is that the Contact Less payment option on Credit Card cannot be disabled by the user. A thief stealing your purse can just tap and keep purchasing items on a whim within the limit. Now I just leave the card at home ,The nincompoops that run these companies don't understand that shoving features that customers don't need, just makes the customers not use it at all.
They don't even need to steal the purse or wallet, they can just tap it. There are mobile apps around that can read card info (dunno if that is legal). You can test if it can read a stack of cards. Haven't tried it, but aluminum foil works it blocks nfc.
What are you talking about? Lol. Every credit card I have here have card controls that too very refined controls as well. All credit card have card controls you can even turn off contactless if you really want. My card although also support daily limit as well which I have dropped to just 1k for contactless. You can even control the all spending limit. I have credit card that gives me limit of 25k I have limited that to 10k.
Basically it is practically impossible to have credit cards that doesn't provide card controls. Contact your bank how to do it. Usually their usual banking app will work just fine unless ofcourse they have specific credit card management app. Usually they don't do it separately.
@@rapiddu6482You cannot "turn off contactless" unless you substract the receiver from the card..
What you are doing os telling the bank to restrict payments from either the magnetic band or the nfc module..
But those physical containers still react to a signal.
I just disabled contactless on my phone, and card
video starts 20:34
If the government/business/police/etc: to go digital contactless via the use of a mobile/cell 'phone, then they must give me one for free. If I am forced to have I.D. then they have to give me that for free. If I must use digital to buy or sell anything, then they must give it to me for free. I will never use "contactless" readers. I live in Australia, and I will not let a cab driver force me to "Wave My Money Away". I never use the magnetic strip. I only use a system that requires me to enter my PIN code.
Setting up Apple Pay is free for a lot of banks, and you can set it up even with a non-nfc card :) You just need an iPhone that supports NFC. (My 2016 iPhone 7 does)
Like for perfectly correct pronunciation of Konstantin's name!
0:13 the same key chain I have...
5:11 in Latvija we dont really give tips, our servers and bartenders get paid more then enough to live comfortably.
Sounds perfect
Bank Notes might be immune from power outages ( Best feature ever ) but tellers don't know how to make change.
CAsh is best
Lmao
Woot
The law in Romania 🇷🇴 insists on a receipt. 😊
Hold up. You can actually pull cc details with a bog standard android that has NFC built in but ok mate
Nope no contactless over here plus I'm planning on microwaving it when I do. I mean come on the ability to wirelessly transmit information seems like mag stripe scamming was so much more of a hassle.
For you you might have to spend many years decoding a proprietary system with hidden flaws but let's say there is a $100,000 reward if you break it........
There are already phone apps around that can read card number and name using nfc. I worked for a card reader company before. I'm sure a malicious programmer who have worked in similar company/technology can make apps that can steal more info, but this will be specific to a bank or merchant only.
Yes use cash.
And who DOESN'T stack several cards one behind the other?
This is exactly the situation where you will tire yourself explaining how nuclear energy is the most environment friendly and safest energy generation you have but they won't understand because of all the unnecessary paranoia they have.
man, I could've told you that scanning an NFC credit card shows everything except the CVC (or pin, obviously). this isn't new.
Yeah!!! Brazil making to Sumsub. Brazilian banking system is very advanced but criminals are very resourceful lol.
hello bradley
I personaly learnt nothing from this video. What works for me is, I only use contactless / phone payments in reputable establishments and, only debit from an account with the bare minimum in it and, have TWO low cash accounts from different banks. PLUS, as the young gentleman said, carry some 'emergency' cash.
17:34 "But can it run Doom?"
I’m kinda annoyed that the companies that make “secure wallets” deceive customers the way they do.
Indeed
Keep the jacket buttoned up or sit down... choose one
wait so technicly could you play doom on a credit card
16:34 that's a great Russian accent
👀
All World afraid of Hacking NFC
Indians: Hold My Bear... Use UPI😂😂😂