EEVblog #890 - ArmourCard Active RFID Jamming Teardown - Page 1
Forum section: electronics / general

author: EEVblog
author_rank: Unknown
timestamp: June 15, 2016, 05:42:40 am
content: What's inside the ArmourCard active RFID jammer for NFC contactless credit cards?Does it work? Will it protect you from skimming?Patent:https://www.google.com/patents/WO2014085862A1Lithium Battery:http://www.gmbattery.com/dl/cp4/CP/CP142828.pdf

author: Muttley Snickers
author_rank: Unknown
timestamp: June 15, 2016, 06:01:39 am
content: My cheques are good but my cash bounces and I have no clue what the cards are up to with her in charge.If you need one of those Rosslare vandal proof keypads with a built in proximity reader to have a play with then I have one or two spare hanging about that I could send up along with a truck load of various card formats mostly old stock and rip outs.

author: ataradov
author_rank: Super Contributor
timestamp: June 15, 2016, 06:38:21 am
content: "L 536" looks like it may be STM8L-series device, their first line is marked as "L xxx". But I can't find which one exactly.Edit: Although, if there are no exceptions, then the part would be STM8L536, which does not exist.

author: JoeMuc2013
author_rank: Contributor
timestamp: June 15, 2016, 08:06:53 am
content: Here is an open solution that uses the scanner's own power against it. No batteries. Love it!http://hackaday.com/2016/02/18/guardbunny-active-rfid-protection-going-open-hardware/

author: EEVblog
author_rank: Unknown
timestamp: June 15, 2016, 08:09:24 am
content: Quote from: JoeMuc2013 on June 15, 2016, 08:06:53 amStill a massively over-engineered solution. You just need al-foil

author: rch
author_rank: Regular Contributor
timestamp: June 15, 2016, 09:58:12 am
content: Quote from: EEVblog on June 15, 2016, 08:09:24 amHow does the aluminium foil work? Does it need to be a shorted turn? Or don't we really know?

author: EEVblog
author_rank: Unknown
timestamp: June 15, 2016, 10:03:20 am
content: Quote from: rch on June 15, 2016, 09:58:12 amMust be an eddy current effect.

author: freman
author_rank: Contributor
timestamp: June 15, 2016, 11:09:36 am
content: Hi there.Long time watcher first time poster. I thought it was extremely important to bring this up.Dave has repeatably said that they need to perform a transaction simply scanning the card won't help them (paraphrasing), however this is entirely incorrect.You can actually read the credit card number, the expiry date, and a bunch of recent transactions from the card.Try using an app like this on your phone -https://github.com/devnied/EMV-NFC-Paycard-Enrollment.Might not sound like enough but you note Dave tapes up the credit card number and expiry so you can't read it, and there's no way you'd post a photo of your card online.Combine that number, expiry, with the transactions, and a little social engineering - it doesn't take much - and you can convince a phone monkey you need a password reset.

author: EEVblog
author_rank: Unknown
timestamp: June 15, 2016, 11:27:38 am
content: Quote from: freman on June 15, 2016, 11:09:36 amAs I understand it, early generation cards gave the card number and name, but newer ones are encrypted?

author: freman
author_rank: Contributor
timestamp: June 15, 2016, 11:31:25 am
content: Quote from: EEVblog on June 15, 2016, 11:27:38 amI've a card issued early this year, the name isn't exposed but the number, expiry, brand (ie, the retailer that I got it through, not just "mastercard") 10 recent transactions (date, time and amount) are all available.Edit. I don't mean to sound like a paranoid nut, but people have to be aware that there's not only enough information exposed to complete a manual transaction but that there's enough to start someone down the path of identity theft and I think Dave might have left people feeling a little more secure than they are in reality (having said that, attacks are still amazingly rare considering how many of these cards are in existence.)

author: EEVblog
author_rank: Unknown
timestamp: June 15, 2016, 11:50:33 am
content: Quote from: freman on June 15, 2016, 11:31:25 amOk, I tried three cards with another app and I got the card number and expiry date. No name. Only one gave a transaction history and card issuer, they other two didn't.QuoteProbably a bit hard without the CVV these days?QuoteAnd there is likely a reason it's rare, likely because it's not as easy or profitable as you think.

author: freman
author_rank: Contributor
timestamp: June 15, 2016, 12:02:25 pm
content: Quote from: EEVblog on June 15, 2016, 11:50:33 amI happily hope your sample set is reflected in the market, unfortunately my sample set has shown the opposite - perhaps that's a reflection of the company we keepQuoteNo actually, was only a couple of weeks ago a friend placed a purchase for his mum at Bunnings, $497, they asked to speak with the card holder over the phone, date and number were all that was required. I was there cos I'm a tagalong bum, just getting out of the house you knowQuoteNo, I never imagined it was profitable, or easy. Knowing someones card number, it's expiry date and last few transactions is one thing. Figuring out their home address or date of birth actually requires social engineering and most people I know with the smarts to pull this are either not that way inclined, or couldn't social engineer their way out of a paper bag.I'm a security conscious person, part of the job, part of the industry I find myself in, part of my job is foreseeing this - if I can imagine it, someone's doing it. Do I wear tin foil on my head... or indeed my wallet? No. Because while the possibility is there, the probability isn't, and hey, that's what insurance is for right?

author: wikktor
author_rank: Newbie
timestamp: June 15, 2016, 12:59:34 pm
content: I would like to see how the foill will work if you would use more powerfull reader like:Is this the same "rfid":http://www.rfidseal.com/products/fixed-reader.html? I do not see any information about ISO15693, but they claim 3 - 25 m.Foil may not work for this from 30 cm distance.

author: sutfuf
author_rank: Newbie
timestamp: June 15, 2016, 01:45:53 pm
content: Not sure if anyone noticed.. 13.56Mhz/16 = 847.5KHz ;-) i.e.: carrier / 16 is the modulated freq. Shift right... Love it.Anyway, I came across  a while back when researching passive jamming techniques.. then HaD beat me to the punch. Anyway, the paper's a good read even if you don't want to make a cheap high longish range reader. Share and Enjoy. :-) -https://www.usenix.org/legacy/event/sec06/tech/kirschenbaum.html

author: Urs42
author_rank: Unknown
timestamp: June 15, 2016, 04:31:27 pm
content: I cut the coil in all RFID Credit Cards. The terms and conditions here say that i'm responsible for all payments that are done with NFC, i can't get a card without RFID.And yes, some people are using mobile card terminals to steal money.

author: SeanB
author_rank: Super Contributor
timestamp: June 15, 2016, 05:33:12 pm
content: Simplest and better will be a copper sheet both sides of the card in your wallet. Did that with my ones, so not likely they will be read in a drive by scan. Sure a simple piece of blank unetched PCB material either side will do the same, I just used some copper sheet I had around, cut to the same size as the cards. 1mm thick, so definitely a good attenuator.

author: richnormand
author_rank: Unknown
timestamp: June 15, 2016, 07:43:39 pm
content: Given the secondary coil transformer geometry would it be possible for the card makers to integrate a pressure sensitive area, with something similar to a thin dome switch or resistive contact as used in cheap keyboards or TV remotes?That could be integrated with a void in a middle layer, top and bottom layers of the card would have the metalised contacts for the coil continuity. Pinching the card completes the coil circuit only while tapping it. At all other times the card would not be active.A reading of your card would require your intervention. This probably means an extra cent or two in cost and overall reliability is the other factor.

author: f4eru
author_rank: Super Contributor
timestamp: June 15, 2016, 09:51:50 pm
content: Quote from: EEVblog on June 15, 2016, 08:09:24 amNope. With al foil, you just need 20dB higher power. That's easy.And a more sensitive receiver.The constant modulated jammer is not so good, can also be overcome.Concerning the detector : 3 diodes in series ? that's quite bad...Concerning the risk : There is a serious security risk. It will get exploited in a short time, don't worry. Or do worry

author: adh
author_rank: Contributor
timestamp: June 15, 2016, 11:40:26 pm
content: Quote from: EEVblog on June 15, 2016, 11:50:33 amFor card not present transactions that completely depends on how much the acquiring bank trusts the merchant (or how they don't care).

author: EEVblog
author_rank: Unknown
timestamp: June 15, 2016, 11:52:26 pm
content: Quote from: f4eru on June 15, 2016, 09:51:50 pmRFID cards have been around a long time now (like a decade), they are not new. Contactless skimming fraud is pretty minimal after all this time. There must be a reason for this.

author: R005T3r
author_rank: Frequent Contributor
timestamp: June 15, 2016, 11:59:42 pm
content: Guys, If you are traveling with these just be careful: in Italy (and also other countries) possessing or using any kind of jammer is illegal. In my country, I've discovered that the reason behind this choice is what happend (or maybe more correctly happens) 2 years ago that some thieves made a robbery in an entire apartment array and alarms didn't triggered because they had a jammer...

author: chicken
author_rank: Frequent Contributor
timestamp: June 16, 2016, 01:57:48 am
content: Quote from: ataradov on June 15, 2016, 06:38:21 amMy first guess as well. The font is definitely STM'ish.Pin 1 nReset and pin 28 SWIM in the patent also fit nicely with the STM8L datasheets. E.g. STM8L101F1.http://www.st.com/content/st_com/en/products/microcontrollers/stm8-8-bit-mcus/stm8l-series/stm8l101/stm8l101f1.html

author: CaptCrash
author_rank: Regular Contributor
timestamp: June 16, 2016, 11:55:59 am
content: Quote from: EEVblog on June 15, 2016, 11:52:26 pmI don't get how you can make such a point.As far as I am aware fraud/skimming statistics are not publicly provided for traditional Vs contactless cards. The latest report is for 2015 with data from 2014.http://www.apca.com.au/docs/fraud-statistics/Australian-payments-fraud-details-and-data-2015.pdfIn terms of skimming and then card not present fraud, its simple and it works to the tune of $300 million in 2014 (a 42% increase) on credit cards plus an additional $23 million on debit cards (a 25% increase)."The total rate of fraud on Australian payment cards and cheques increased from 16.2 cents per $1,000 transacted in 2013 to 20.8 cents per $1,000 transacted in 2014."Quite ironically the fraud rate on cheques is significantly lower than with credit cards, checks have a fraud rate of 0.5c per $1000Overall the report presents quite a bit of detail that can be summarised into criminals are looking to get the best return on the investments they have made (magstripe readers/writers). If you have a process for collecting data, putting it on mag stripes, then keep doing that until you can't anymore (the significant increases in skimming and overseas card not present transactions) lead to this, though this is my interpretation of what they are saying.

author: Dave Turner
author_rank: Frequent Contributor
timestamp: June 16, 2016, 02:15:39 pm
content: Sort of surprised that someone hasn't punched out credit card sized pieces of aluminium, painted them, added a logo and tried to sell them at an extortionate price. Or have they?

author: Tek_TDS220
author_rank: Regular Contributor
timestamp: June 16, 2016, 03:47:39 pm
content: The 'patent' that Dave showed is an application, not a patent. This means that the decision as to whether the applicant will have any of their claims allowed is pending. It is common in these applications to start with very broad claims that will probably be rejected, followed by more narrow claims that the applicants really want to be allowed.

author: f4eru
author_rank: Super Contributor
timestamp: June 16, 2016, 05:19:52 pm
content: Quote from: EEVblog on June 15, 2016, 11:52:26 pmYeah. GSM has been around also 10 years before massive security breaches have been openly available.The same for other technologies where security breaches have not be very profitable.But.The RFID cards have gone from a low value to very high value (100$ it seems) lately. That for sure will increase fraud.The most obvious technique is a relay based system to a uncooperative vendor. The same kind has been used to breach passive acess on cars lately This also took over 10 years to be in the wild, and the manufacturers all knew it will come one day (I know the subject

author: mikerj
author_rank: Super Contributor
timestamp: June 17, 2016, 09:03:17 am
content: Quote from: ataradov on June 15, 2016, 06:38:21 amDefinitely an STM8L and probably an STML151 variant, but I can't find a list of package markings for their UFQFPN packages. The 151x2/151x3 datasheet gives an example marking of "L526".

author: FrankD
author_rank: Contributor
timestamp: June 17, 2016, 06:59:36 pm
content: I had problems with my public transport rfid card. Scanning at an entrance point was failing because all the cards in my wallet interfered with the handshaking.My solution was to laminate alu foil in a card size format. I use two with the bank passes in between and the public transport card on the outside.Never had a problem with interfering since.

author: Bud
author_rank: Super Contributor
timestamp: June 17, 2016, 07:09:47 pm
content: This thread is about a solution for a non-existent problem.

author: f4eru
author_rank: Super Contributor
timestamp: June 18, 2016, 09:06:15 am
content: The problem is non existent for you today. That may change.RFID relays have been implemented. It's a physical weakness of the system, and cannot be countered by redesign of the card or reader.it has now great monetary value. it will be (and has probably been) exploited.an example of POC :https://online.tugraz.at/tug_online/voe_main2.getvolltext?pCurrPk=72600This one has a big lag time, that can be detected by the system, if the system is designed for it. But the lag can be reduced to undetectable levels, and then you have a breached system that cannot be corrected. So there is a real problem.An extremely simple proof of concept is just a coax cable with two coils.It's not really practical, but adding amplifiers and low-lag transceivers make it really exploitable.

author: f4eru
author_rank: Super Contributor
timestamp: June 18, 2016, 09:38:35 am
content: Just a word on Credit card fraud :Fraud is rampant in this industry, but it's actually at a manageable level.But if an important breach comes out, it will scale very quickly. That has happened many times.It's really a technology war.The state of the art skimmer is now miniaturized to a point they physically insert it into the card reader :http://krebsonsecurity.com/2016/06/atm-insert-skimmers-in-action/Walking in doing "tech support" :http://krebsonsecurity.com/2016/06/banks-credit-card-breach-at-cicis-pizza/Old fashionned skimmers still going strong:http://krebsonsecurity.com/2016/05/skimmers-found-at-walmart-a-closer-look/

author: kalleboo
author_rank: Regular Contributor
timestamp: June 18, 2016, 01:05:41 pm
content: Quote from: f4eru on June 18, 2016, 09:38:35 amIt was years ago I started considering just scraping off the magstripe off my debit card, since any store I go to the past how many years uses a chip reader. But the question is, what ATMs still use magstripe vs chip? There's no way to tell. When are EU banks going to kill the magstripe? Maybe issue a separate card for travel to the US and other third-world countries?

author: Fungus
author_rank: Super Contributor
timestamp: June 18, 2016, 04:17:36 pm
content: Quote from: kalleboo on June 18, 2016, 01:05:41 pmA lot of ATMs require the magstripe to be present just so you can insert the card. The card slot is blocked until it detects the presence of a magstripe.Quote from: kalleboo on June 18, 2016, 01:05:41 pmSure there is. Scrape it off and do a survey.

author: f4eru
author_rank: Super Contributor
timestamp: June 18, 2016, 05:20:44 pm
content: You don't need to scrape it off.Cover it with 3-5 layers of electrical tape, and it should be reversibly deactivated.For a permanent erase, pass some strong magnets over it

author: System Error Message
author_rank: Frequent Contributor
timestamp: June 23, 2016, 05:32:55 am
content: lol at the store, the jammer next to the reader. Good marketing bad impractical.If you have a big wallet get 2 of these and put 1 at either side.

author: Urs42
author_rank: Unknown
timestamp: June 29, 2016, 04:18:16 pm
content: I got some interesting information from a bank. They are giving out RFID shield sleeves with each card. They get about two complaints about unathorized payments each day...