Security researchers process stolen card numbers

Security researchers have demonstrated two potential vulnerabilities in Square's mobile payment system, which can reportedly be used to process fraudulent transactions. In a demonstration at the Black Hat security conference, Aperture Labs directors Adam Laurie and Zac Franken converted magnetic stripe data into a sound file to trick the Square mobile app into believing a card was being run through the swipe dongle for smartphones.

Custom software enabled the researchers to mimic the beeps of the genuine dongle, however the signal was transmitted to the smartphone using a stereo cable. Although the demonstration used cards that Laurie skimmed himself, the same technique is said to be effective if used with card data sold on the black market.

A second demonstration focuses on Square's dongle, which was used to skim data from a credit card to make a cloned copy. The researchers created code to convert the dongle's been signal into readable card information, as the Square hardware is said to lack encryption or other forms of protection.

Laurie suggests the vulnerability enables users to skim credit cards without any specialized hardware, all while appearing to process a legitimate transaction.

The researchers claim to have confronted Square in February, however the company reportedly dismissed the threat by claiming criminals will gravitate toward easier methods to accomplish credit card fraud. [via CNET]

By Electronista Staff

Post tools:

TAGS :  

security, hacks, Square