4
\$\begingroup\$

I ordered a Square reader so I can take it apart. I guess it used to be they just used a raw magnetic values from the strip. In order to encrypt it they must have some processor that takes power? Are they powering it off the stereo wires?

\$\endgroup\$
9
\$\begingroup\$

I can't really answer this because I don't have a Square card reader and don't have access to design files, but I think I can make some decent conjectures about the nature of the problem of credit card reader encryption.

What's the acccusation?

I assume you're referring to the encryption suggested in this post by Square competitor VeriFone, which says in part:

Square's hardware is poorly constructed and lacks all ability to encrypt consumers' data, creating a window for criminals to turn the device into a skimming machine in a matter of minutes.

Yes, this is basically true. However, every credit card reader is basically a skimming machine. Whenever you give your card to someone or something, you have lost all security.

What's involved in reading a card?

The data on your card is stored in magnetic stripes in a well-documented format, described in the international standard IEC-7811, available to anyone for about $100, which is nothing to a criminal (who could also probably pirate it from somewhere), or in abbreviated format in various places around the net, such as here. Data on a credit card not encrypted or protected in any way except that you're supposed to only swipe your card in readers that you trust.

Magnetic stripes operate on the same principle as magnetic hard drives: Moving a magnet past a coil produces a current. Whether the current is positive or negative depends on the polarity of the magnet. By embedding a series of magnets with various polarities, information can be presented by the card. As a result, every single credit card reader contains a coil which reads the data. Some read multiple stripes, the original Square reader only read one stripe, which contains the Account Number, Name, and Expiration Date of the card.

The original Stripe reader was as simple as possible; it was little more than a coil which output a voltage to the phone's microphone input. Here is a teardown picture, click for the teardown photostream:

photo by Adam Davis
By the way, the use of a resistor with heat-shrink connection to a wire like this is bad design. The solder and solid copper resistor lead are brittle and will eventually crack. Always use stranded wire with strain relief on anything that can move!

Under the green potting compound is a coil which interfaces with the magnetic stripe. The blue thing is a 51-ohm 1% resistor to protect the mic input in case someone swipes a card too fast. There's another resistor under the potting compound between the two wires in parallel with the coil. This setup produces an analog voltage, and the microphone circuitry on the phone can read this analog voltage and determines the data on the credit card.

Other credit card readers contain the circuitry that changes these analog voltages into digital data within the reader, duplicating (essentially) the circuitry in the smartphone's microphone input circuit. The data obtained from these circuits is then sent over a USB or serial link. Whether or not the data is encrypted on these links is unknown, and it really doesn't matter.

If you assume that a malicious party has physical access to your scanner, it's game over. The same circuitry is present in the new Square readers and in VeriFone readers, they just decode the signal in the reader and send the encrypted signal over a digital protocol.

What's a thief to do?

Note: Don't do any of this. You'll end up in jail. I'm not liable for anything resulting from this information, it's simply collated from other sources online, including this HackerNews discussion.

The encryption does nothing. A reader with the supposed vulnerability could be created from one of the fancy new Stripe encrypted readers, a new Paypal blue Dorito, or an old-fashioned VeriFone reader. Simply strip out all of the fancy encryption circuitry (no code-cracking needed), solder on a resistor and some wires, and plug it into a microphone jack: this produces the same 'vulnerability' as existed before. You then need to write the smartphone app, which I suggest will take significantly longer than the hour suggested by the article. Instead of going to all that work, why not just buy one online? Here's one for $20. Plug it in, open Notepad, and swipe a card: Viola! the Account Number, Name, and Expiration Date are typed into the computer.

The even easier way to steal this data is to open the camera app on the smartphone and take a picture of the front of the card as you lift it towards the reader. This nets you everything contained on the stripe. Turn it over and snap another picture on the way down, and the thief also has the 'security code' and their signature! Or, a waiter could use their excellent memory to remember the information. Or they could write it down on their order scratch pad.

A credit card reader cannot be made secure.

What's a concerned citizen to do?

You have three options:

  • Pay with cash
  • Diligently check for and report fraud on your credit card
  • Use bitcoins

Ok, so only two of these are viable right now. To be serious: Any credit card which is visible to a person or camera, in the proximity of an RFID reader (for the new-ish PayPass RFID cards), or in a reader or computer system you don't control is insecure by nature.

\$\endgroup\$
  • \$\begingroup\$ I understand what you wrote but the issue with square is that the are taking the input from the microphone so you can create a signal generator and enter valid numbers into the square app. The second issue is a merchant can use a square reader to get a users credit card data. Suppose square encrypted the data from device to microphone in that case only square can use data. \$\endgroup\$ – SamFisher83 Mar 25 '12 at 2:51
  • \$\begingroup\$ @SamFisher83 - With respect to the signal generator problem, for that you can just buy or build a card writer and run the card through anything, or open the Square reader and swap the coil for your signal generator. Once again, physical access to the device means game over. Or, even easier, just manually enter the data into the app like in any other POS system. \$\endgroup\$ – Kevin Vermeer Mar 25 '12 at 5:40
  • 1
    \$\begingroup\$ With respect to the idea that a merchant could hypothetically use a square reader to get a users credit card data: yes, yes they can. Encryption between the coil and the mic doesn't help with that. Sure, the path from Square over the internet to your bank should be encrypted so network snoops (not the merchant) can't get your data. Sure, the app itself should be encrypted so virus authors (not the merchant) can't get it. However, there's no way to create security between the app and your card. \$\endgroup\$ – Kevin Vermeer Mar 25 '12 at 5:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.