@iv wrote:
@Anonymous wrote:
How often is that even happening? I'm going to bet not much because the cards are pretty rare anyway. It's also probably the case that whatever cards do exist use EMV contactless since it started disappearing from cards around the time EMV started being a thing. Again, probably nothing to worry about.
BTW, AmEx's contactless cards are EMV contactless--tapping them at Walgreens makes the chip's application identifier (AID) show up on the receipt. Ironically, Apple Pay with AmEx is not.
Sure, it's not happening in practice except for research and demos... since as you said, they are very rare today.
But I can remember people telling me 20 years ago that magstripes were perfectly safe, "nothing to worry about"! Yeah, they could be "technically" copied, but it was "hard to get the equipment", and "too much effort"....
Yeah. Because no money has been lost to skimmers in the last 20 years.... Oh. Wait.
It's good to know that the newer Amex's are shipping with EMV contactless - that is at least far more secure than the older standard. At least it stops mass-collection of card data for later use.
But unless timing-based anti-repeater detection is added to the readers, targeted MitM is still possible. And once magstripe finally dies off, contactless will be THE low-hanging fruit for attackers.
I think getting people to download some malware that sends card numbers, passwords or whatever else they type is still going to be easier than trying to install some repeater device near a terminal. A potential hacker doesn't even need to write the malware themselves--just download one that someone else already wrote and pay for access on a botnet to send the needed spam. If only 1% of people get infected before anti-virus finds a solution for that particular malware they still come out ahead.
