Contactless cards again! [OT in uk.d-i-y]

May 20, 2013 55 Replies

CapitalOne didn't provide an option of any kind - they just sent out the new cards. I had several irate phone conversations with their CS staff - all to no avail - so I told them to stuff their card!

I assume they believe that if transactions are easier to carry out, people will use them for small purchases in preference to cash, and they (the card companies) will get lots of extra revenue.

Do you have a template for where it needs to be drilled? [I assume that it's not as simple as drilling out the contactless icon].

If it's like our cards at work (mifare classic) then a small crack at the edge is enough to break the antenna and stop it working :-(

Darren

I believe it's £50/day max and they promise to refund any fraudulent transactions.

At 13.56 Mhz the wavelength is something around 20 metres so any sort of mesh with holes much smaller than that (hardly difficult!) would screen it very effectively.

Surely *someone* has access to an X-ray machine so that we can map how to disable them without shafting the chip!

By shining a bright LED torch though various MiFARE type cards I can easily see the aerial wires running round the cards, but on a Barclays contactless card I can't see anything other than the chip itself ...

So how do you prove that *you* didn't make the transaction?

Good thinking. Works on two of my site passes but not the third. Can't spot an obvious aeriel loop on any of my Visa cards, only one of them is marked contactless enabled. Perhaps it is behind the ferrite stripe or the tamper proof signature strip? One of the two holograms is "blotchy", the other is completely opaque.

I think the boot's on the other foot

formatting link

god knows where in that lot though ...

I think the reverification policy is actually an issue for the bank, based on the perceived level of risk. They, or the card, might well trigger a verification if there were a smaller number of transactions all very close to the limit, or on a random basis.

In part the amount at risk is chosen to similar to the amount of cash that might be lost to a pick pocket.

formatting link

Again, that's a mifare card - sounds like credit cards are different.

Darren

Mifare is a brand name. Contactless payment cards use the same physical layer and discovery protocols as Oyster, and can be read and written by Oyster card terminals. Oyster does use Mifare cards.

A lot of those materials are not specified at the frequencies used for the cards, which are in the short waves. Most of the materials seem to be designed for microwave use.

That *is* interesting since Dutch cryptographer at Nijmegen have totally broken the encryption on Oyster and all the cards of that ilk.

formatting link

I presume this particular vulnerability has been patched now.

Join the Discussion

Have something to add? Share your thoughts — no account required.

Didn't find your answer?

Ask the community — no account required