[ale] OT Fwd: Dc404-Chat New smart locks for your home

[Alex Carver]

On 6/20/2013 09:50, Ron Frazier (ALE) wrote:
> On 6/20/2013 10:49 AM, William Bagwell wrote:
>> On Thursday 20 June 2013, Alex Carver wrote:
>>> Ok, then use the bright light to illuminate the card from the edge.  If
>>> you get the light just right you should see a square dimple in the back
>>> of the card where the pocket for the chip is located.  On my card,
>>> looking at the back of the card with the mag stripe on top, it is
>>> located just 5mm (to the center of the dimple) below the bottom edge of
>>> the mag stripe and 10 mm in from the right edge.  A bright light shining
>>> across the card (the way you might shine light across a floor to look
>>> for a lost screw or other tiny part) should highlight the dimple.
>> Bingo! Barley detectable 'pad' about 5mm square. Confirmed on the
>> sacrificial
>> card - metallic foil and has the 2mm chip with in.
>>
>> On a Chase Slate it is above the mag stripe and the curved "Blink" symbol
>> points almost directly at it.
>
> I'm interested to know if that card had any writing, symbols, or legend
> on it to indicate that you can use it wirelessly.  What's the point of
> putting it in there if you don't notify the customer that he / she can
> use it that way?
>
> I used one of those 1,000,000 candle power hand held spotlights like you
> get at a tool or auto store to look through my cards.  The trick is to
> hold the card in such a way so you don't blind yourself in the process.
> I don't think any of them have the rf circuitry.  If they do, and I
> haven't been informed by the bank, I will be rather annoyed.
>
> I thought about getting a cheap rfid reader from amazon to tinker with
> and test the cards.  5 minutes of searching revealed a large enough
> disparity of pricing and technology that I gave up on that for the moment.
>
> The following google search yields a large number of results that could
> be interesting.  Haven't had time to sort through them.
>
> (destroy OR disable OR deactivate) rfid credit card
>

Yes, if the card has the technology it's marked.  AmEx uses a symbol 
similar to the radio wave symbol you might see on a WiFi device (do a 
google search for Wifi Symbol and it's the curved lines that you find in 
most of the symbols).  Their marketing lingo is ExpressPay.  Visa and 
Mastercard should have similar symbols or branding on the card.  THey 
don't put the technology in all of their cards so it has to be obvious 
which cards do have it.

I believe the RFID chip in a credit card is of the LF variety (kHz 
range).  There is also VHF and UHF RFID technology, too.  Some readers 
can handle all three types, others only one.  Sparkfun has a few 
readers, too.

While doing a search I found a YouTube video with Adam Savage (of 
Mythbuster fame) explaining to an audience at a tech show why 
Discovery/Mythbusters aren't allowed to do an RFID episode (hint, the 
credit card companies told them no).

I'm not a tinfoil hat type person but these things are hackable (same as 
the passport chips, too).  It wouldn't be much of a problem if the life 
cycle was shorter but the passports and credit cards are designed to 
hang around for a few years or more.  If a flaw is discovered that 
exposes information, there's a very large population of devices out in 
the field that have to get replaced quickly and that's not easy.