Can credit card data be stolen wirelessly?

I think anyone who owns a credit card with the wireless system enabled will have asked themselves: is it safe or should we be afraid? I asked myself the same question and for this reason I decided to learn more by doing a few small experiments, of which I will give you some details later. Before continuing, I should point out that I am a regular user of the credit card and I often use the wireless payment method; I also anticipate that I do not plan to change my habits, because I believe the risks are somewhat acceptable when considering the convenience, provided you pay attention. For example, how do you get around London on the Tube without a contactless card? ? That said, let’s try to understand whether there are real dangers or not. It’s worth introducing a few concepts just to contextualize what I will say next. When we talk about a wireless payment system we refer to the possibility of using the credit card by bringing it close to a device (Reader) that can read its contents via radio. This technology is known as NFC (Near-field communication) or communication in proximity.

The history of RF-ID (Radio-Frequency IDentification) goes back to World War II, during which this technology was already used to identify aircraft in flight and it continues to be used today in aviation and other sectors. The most common applications are, for example, identifying parts to facilitate maintenance and asset management. As is easy to guess, the general concept of RFID — i.e. a radio identification system — hides a variety of possible devices that essentially perform the basic identification function, but which exploit different technologies to respond appropriately to various usage scenarios. In any case, the basic technology can be reduced to two components: an RFID reader and a TAG (label).

The communication mechanism is very simple. The TAG is a chip normally switched off (passive: not powered — i.e. it does not use batteries to operate) that is placed inside printed labels but also inside objects; when it is brought close to a Reader, the latter is able, via radio, to provide it with enough energy to power the TAG and allow it to transmit the data stored in it to the Reader.

Avoiding going too deeply into the description of the various communication protocols and standards, let’s say that there are currently several: ISO 7816, ISO 10536, ISO 14443, ISO 15693, ISO 10373, ISO 11784, ISO 14223, ISO 10374, ISO 15960, ISO 15961, ISO 15962, ISO 15963, ISO 18000. Among the various types, one of the most common is NFC (Near-field communication), if only because today it is used in wireless payment systems.

The NFC standard, implemented on credit cards, is based on the communication protocols ISO 14443 and the new standards ISO 18092 NFCIP-1 and ISO 21841 NFCIP-2; furthermore, thanks to recent developments and the new standards, it is possible to have general compatibility even with older standards. In practice it is possible with a single device to read TAGs that implement different standards and this interesting novelty is found in our smartphones which are able to read various types of NFC TAGs and to emulate their operation.

(adsbygoogle = window.adsbygoogle || []).push({});

But what does this mean? In other words, it is possible to use our smartphone (which has NFC technology) both as a credit card and as a credit card reader. For the purposes of this article and in order to have a more comprehensive picture of RFID technology, let’s set the following classification, focusing on the functional aspect and the operational characteristics of TAGs:

RFID Characteristics by Frequency Band

Application Cases by Frequency Band

More in detail, the TAGs available to us operate on the following frequencies:

• 125/134 kHz (LF Low Frequencies, valid worldwide)
• 13.56 MHz (HF High Frequencies, valid worldwide) (this group includes NFC)
• 433 MHz (UHF Ultra High Frequencies low, only for Active tags, only in Europe)
• 860-960 MHz (UHF Ultra High Frequencies medium, depending on the continents they have different limited powers and different frequency bands)
• 2.4 GHz (UHF Ultra High Frequencies high, mainly for active TAGs, although passive TAGs also exist, worldwide)
• 5.8 GHz (SHF Super High Frequencies, only active tags, for example the active tag “Telepass” that many have in their cars in Italy for automatic access to toll motorways)
• greater than 5.8 GHz (UWB Ultra Wide Band (3.1 GHz-10.6 GHz), only Active tags)

To learn more you can take a look at the link mondo rfid.

Another possible classification of TAGs is by implementation. They can be classified as:

• Passive TAGs
• Active Tags

Passive tags are characterized by the fact that they do not have their own power source and use the energy provided by an RFID reader to operate. Their operating range varies depending on the frequency used. For TAGs that work up to 13.56 MHz (HF) the range is less than 1 meter, while it can reach up to 10 meters when using UHF 860-960 MHz TAGs. Active tags, on the other hand, are powered by a battery and the signal transmissions occur continuously. Active tags have a much longer read distance compared to passive tags and operate mainly at higher frequencies.

(adsbygoogle = window.adsbygoogle || []).push({});

Apps to read credit cards

Let’s move on to the sour notes; having understood that data can be written to and read from a TAG at a distance, I wondered: are they secure? Let’s start from the premise that my question is entirely rhetorical since it is well known that RFID and NFC are not famous for the robustness and security of their protocols. In any case, the matter deserves further analysis, but we will do that on other occasions to avoid getting too long-winded and straying too far from the subject of this article, namely: is a contactless credit card that implements NFC technology secure? Can the data be stolen? At this point I think it’s quite clear what the objective of my experiment was. Well yes! I tried to use my smartphone to read the data from my card and the result was interesting as well as expected. Put it this way: for those who trust others you can find ready-made tools to perform this check, but since I don’t trust, I tried to write some code, using third-party libraries. For the more trusting, therefore, I can recommend this app that runs on Android. In the specific case the author has made the source code available, although I must report that the published app is different from the one provided at the previous link. Ultimately, anyone with a bit of practice with Android Studio can try recompiling everything after perhaps taking a look at the code to verify its contents.

You may be wondering what the test result was?

Yes, it is possible, even very easily, to retrieve the credit card number and its expiration date (at least in my case on a Mastercard-type card). Well now we know for certain that anyone with an NFC Android smartphone can approach us without our knowledge and grab our credit card data. But what can be done with this data? In general, not much: to perform some transactions it would also be necessary to have the CVV (Card Verification Value), the 3-digit code that normally appears on the back of the card. But you will understand that after all it is not that complicated to decode 1,000 combinations and, in any case, for online transactions in most cases protection systems based on OTP (one time password) are now active — [for example, the bank token]. It is true, however, that there are still websites where purchases can be made without using the CVV code, so in those cases the problem could exist. The next question, therefore, could be: can contactless cards be cloned? and perhaps emulated directly with a smartphone? We know that credit cards that use NFC do not require codes or signatures for transactions and do not require the card to be physically inserted into the reader but are activated, as we have seen, in proximity to a reader. Is it therefore possible to exploit this peculiarity as a vulnerability? In general, literature indicates that it is possible, but since to perform an exhaustive test I need a POS, I will postpone my conclusions to another article.

For the moment, for the more anxious I recommend a shielded wallet or shielded credit card sleeves. You never know ? there are different types and prices available.

(adsbygoogle = window.adsbygoogle || []).push({});