Adventures in privacy: Disabling PayPass
User Rating: / 3
PoorBest 
Written by Braindead   
Friday, 17 March 2006 12:28
I just got a new ATM card from Charter One Bank, lo and behold.. they've implanted a free money for criminals device into the card.

For those not familier with PayPass, it's an RFID (Radio Frequency ID) chip that communicates with a reader in order to charge things to your account. That sounds fine and dandy, and if you believe what Mastercard tells you, it's safe.. but read more..

Hackers have demonstrated reading RFID's from up to 40 feet away, as well as breaking the systems that are currently used to disable cars (the tag is in the key), and the system put out years ago by Mobile for easy gas buying.

Now that Mastercard is forcing this on their customers (us and the banks), it'll be a ripe target for hackers. It'll be trivial to go to a bar and get enough information to scam dozens of people with a few minutes of work. Best of all you will have no idea they did it! It's not like you lost your wallet.. they'd be able to take the information at will!

Mastercard claims they offer the same fraud protection as with a regular card, but read the fine print.. that protection doesn't kick in until you notify them that your card has been lost or stolen.

Hopefully I'll have a sure fire way to disable this chip in a few days. There are several options being considered, the worst of which is 4 seconds in a microwave. My goal is to keep the ATM card functionality, but disable the RFID tag.. I hope to have a tested method soon.

Last Updated on Monday, 27 March 2006 16:10