Dubbed asMagSpoof, Kamkars deviceis about the size of a U.S. quarter and a hackers dream.
Based on a cancelled cards number, MagSpoof can predict the new American Express card number.
If I were doing fraud, that would be pretty useful.
In a phone interview on Tuesday, Kamkar said One hundred percent of them followed my predictions.
The card generation algorithm is not very random.
Kamkar said he only needs the old card number and the expiration date to do the calculation.
The fraudster can go shopping, once the card is active.
In addition, the security code embedded in the card product would need to be verified.
She also noted that the company uses other security measures that it refused to disclose.
The American Express number prediction capability isnt the only interesting feature built into MagSpoof.
Kamkar did an intensive study of the magnetic stripe on the back of payment cards.
Kamkar argues that even chip-and-PIN protections on a victims card may not work to protect against his MagSpoof attack.
I was flabbergasted, he said.
Kamkar has released the software and schematics for MagSpoof.
This is really obvious.
Ive never heard of anyone finding this, but Id be surprised if someone hadnt figured it out.
source: www.techworm.net
