Why do RFID credit cards broadcast your actual account number and info?

[CZroe]

For the last 10 years I assumed that these kind of things didn't broadcast your actual info, especially when the news came out about older systems in other countries (I think India was one of them) were the only ones "hacked" so that cards and info could be cloned/stolen.

Firstly, I figured that it would work more like the CVV system, where your info is only associated by a remote database (CVV is not in the mag stripe and can not be generated by the card number, for example. The only way to associate it is to have both and have it remotely verified by the card company). So I expected it to be a completely different set of info than your card number, name, and expiration date.

Secondly, it just seemed logical to me that it would work kind like an HID/Prox card where the field generates enough inductive current to power a small chip which then responds to a randomized inquiry to make a calculation and return a result BASED on the info, but not return the actual info, thus, results could be compared based on the same inquiry at the remote end to verify the same data set and a sniffed session would do no good because the random seed would be different.

Then, my mother started freaking out because of something she saw on Fox News:
http://www.idstronghold.com/

Are these guys for real? They certainly seem it. Also, they say that it is enough info to make a mag strip on a clone card, which I always thought had a lot more than just your card number and expiration date and required an ACTUAL skim to copy?

If it only transmitted the first and last four and then their readout fooled people with random numbers in between (or using that formula for valid card numbers), then they are liars who deserve to go to jail (I can imagine first and last 4 being acceptable to transmit). If they could really make a functional mag swipe for the copied info without skimming, I'd also be surprised. I don't think they are lying, considering the high profile reports they are working with, but they are a company that sells products that profit off of scaring people, so I wouldn't put it past them. They obviously do stretch the truth (if he could really get 2,000+ numbers at an event he would need to tap the wallets of 8,000 men who happen to keep their wallets there... and catch them all among a lot more women and such who don't), all without being noticed at the gate tapping everyone in the ass. Obviously, they will stretch the truth if they make that claim.

That said, if it's all true, why DON'T these technologies work the way I always thought they did? Who was stupid enough to make them transmit this info directly? Even without a random-seeded challenge/response based on a unique number, a unique number that can only be associated to the account by the credit provider is the only way I would have ever considered transmitting fixed info.

 

[Mark R]

Your main card details need to be transmitted in the clear for the benefit of the retailer - so they have a record of which cards were used, as a backup (in case of some sort of dispute, or legal issue).

This is exactly the same thing that happens with a mag-stripe card (or, indeed, the mechanical fallback method, where they take an impression of the raised numbers on the card).

The card number/exp date alone are not sufficient to authorize a transaction. They only identify the account.

Transactions need additional verification. In the case of a telephone or online transaction, the CVV number will be included. In the case of a postal transaction, or face-to-face transaction (without electronic verification) it will include a signature, which will be kept on file by the retailer or card-provider.

In the case of an electronically verified transaction (contact chip or RFID), the card will generate a cryptographically signed message giving the transaction details (amount, retailer details, terminal details, card details, whether the cardholder entered a PIN, etc.). The digital signature is generated using the card's internal, and heavily protected, private key (which is unique to that card, and known only to the card provider). The message and signature will sent to the card-provider electronically, and a copy of the digital signature kept on file by the retailer (either electronically, or in printed form). The presence of the secure signature, prevents the cloning of digital cards.

Further, the whole electronic (contacted or RFID) transaction between card and reader is encrypted. The only practical attack at present, is to get a genuine contactless POS card reader, and EFTPOS software (or emulator). The reason it works, is because it is a genuine POS reader, and the card goes through the genuine authorization process, giving the data that the retailer is legally required to hold on file.

While the card number and exp date are the main identifiers on the mag stripe. There is additional verification data on the mag stripe (recorded in a proprietary format, not using the conventional magstripe format that the main card data is recorded in) - and can't be copied without a physical skim. However, I'm unsure how extensively this extra data is used. My understanding is that it is used in ATMs and some POS systems, but not all.

 

[silverpig]

The card number/exp date alone are not sufficient to authorize a transaction. They only identify the account.

Transactions need additional verification. In the case of a telephone or online transaction, the CVV number will be included. In the case of a postal transaction, or face-to-face transaction (without electronic verification) it will include a signature, which will be kept on file by the retailer or card-provider.

AFAIK this is not true. A charge can be made with just a name, CC# and expiry date. CVV2 and signature just reduce the fees that the merchant pays because if you can record a swipe and have a signature, then that is a reasonable guarantee that the owner used the card. If it's just a CC#, expiry, and name online, then there's a huge risk that it's a fraudulent transaction and the CC company thus charges a very high transaction fee to the merchant.

 

[CZroe]

Thanks for the info. Now, the question is, why isn't there at least card-specific "sub account number" that needs to be there with the full account number to print a proper mag stipe? Why would they ever design a system without something like that? I would expect the raised numbering + CVV, mag stripe, and RFID technologies to all have a different set of credentials linked by the same account number as the most basic form of security so that you could not use one to forge the other. Basically, a system where the mag does not include CVV; printed info does not include mag-specifc sub account numbers; RFID does not include mag-specific sub account numbers or CVV but includes it's own sub account number; all three include the basic account number needed to make a transaction without electronic authorization. I honestly don't see how it could have developed any other way and I am shocked to learn that it has. A "proprietary" extention to each particular standard does nothing unless specific POS operators implement it, which would not stop theives from using other retailers which would render it mostly ineffective.

 

[DrPizza]

fwiw, the cards do not "broadcast" - RFIDs are passive, not active.

 

[disappoint]

fwiw, the cards do not "broadcast" - RFIDs are passive, not active.

That would be a neat trick. The worlds first crystal set transmitter.

 

[CZroe]

fwiw, the cards do not "broadcast" - RFIDs are passive, not active.

Yes they do. The current is generated by the field they pass through, but my understanding is that they do emit a modified frequency.

 

[silverpig]

fwiw, the cards do not "broadcast" - RFIDs are passive, not active.

There are active RFIDs too AFAIK.

 

[guyver01]

Credit Cards don't carry around a 9V battery. The battery in Smart Credit Cards are only strong enough to transmit the data a couple of inches. Next time you use your Smart Credit Card at a wireless receiver, see how close you have to get it to read it. That's how close a thief would have to get with a RFID reader to be able to steal your info.

 

[CZroe]

Credit Cards don't carry around a 9V battery. The battery in Smart Credit Cards are only strong enough to transmit the data a couple of inches. Next time you use your Smart Credit Card at a wireless receiver, see how close you have to get it to read it. That's how close a thief would have to get with a RFID reader to be able to steal your info.

It's not a battery in your typical CC, and passing within a couple inches isn't hard to do when you know where the vast majority of men keep their wallets, as demonstrated in the videos on the website in the OP. I doubt that it would work well if their wallet had more than one, like mine.

 

[guyver01]

I doubt that it would work well if their wallet had more than one, like mine.

It wouldnt. They don't broadcast on "individual frequencies" ... they basically spam the airwaves.. and it would be impossible to separate individual information. If you're in a mall... you might pick up hundreds on pieces of data... but wouldn't know which would go with which.

 

[Mark R]

Thanks for the info. Now, the question is, why isn't there at least card-specific "sub account number" that needs to be there with the full account number to print a proper mag stipe? Why would they ever design a system without something like that?

I guess, at the time credit cards were designed, it wasn't considered to be necessary. Don't forget that credit cards have been around for a long time - things like the CVV are only very recent additions.

I suspect that this is why the credit card companies are trying hard to phase-out magstripes. They're getting their in Europe, but not doing well in the US.

In Europe, the credit card contracts have changed. It is a breach of the terms and conditions for a retailer to swipe the magstripe of a card if the card has a chip on it. To enforce this, if a retailer magswipes a chip card, the retailer loses the ability to contest a chargeback on that transaction - as a result, most stores will refuse to swipe a card, if the chip doesn't work (or will only accept a card with a 'chip malfunction' after a thorough examination of the card +/- additional ID checks).