The Magspoof device can also accurately predict new credit card numbers.
Samy Kamkar, the inventor of numerous hacking tools, has created yet another incredible device, which can accurately read and predict credit card, and bypass the chip & PIN safeguards built into modern cards.
The device, called MagSpoof, uses information stored on credit/debit cards, and inside the magstripe (magnetic strip) standard.
Hackers can analyze the magnetic field produced by this magnetic stripe, and then store it in MagSpoof. Since the magstripe is used to validate card transactions, the card number and other details are encoded in the magnetic stripe itself.
MagSpoof can make payments by placing it in the area of the card reader
Data can be extracted from the magstripe using magstripe readers, or by eye, using metal powder that sticks to the magnetic parts of the magstripe and allows anyone to read the barcode.
By taking this data and putting it into MagSpoof, Kamkar says he is able to make financial transactions simply by placing the device next to magstripe-based PoS payment readers.
This was possible because MagSpoof, using the magstripe elements, reproduced the magnetic field at a higher intensity, allowing Kamkar to trigger the payment wirelessly, without using the card.
Kamkar also says that data from multiple magstripes can be stored on his device at the same time, and that MagSpoof can also disable chip & PIN (CNP).
MagSpoof can fool card readers into thinking it's a chipless (and PINless) card.
Because PIN requirements are encoded as a bit inside the magstripe that tells the card reader to ask for a PIN, Kamkar changed only that bit so that the card would have no CNP support.
Additionally, due to some of the processes used when issuing credit/debit cards, Kamkar has also added a feature that can predict numbers based on the expiration date of the previous card.
This feature, if it ever falls into the wrong hands, would allow criminals to use a credit card after it has been canceled, by simply adjusting the magstripe data based on Kamkar's algorithm.
MagSpoof costs about $10/€0.93 to build and has only been tested with American Express cards. The source code is available on GitHub, but Kamkar has removed the parts that would allow hackers to exploit it for fraudulent actions.
