Bitcoin Forum
November 24, 2017, 11:50:08 AM *
News: Latest stable version of Bitcoin Core: 0.15.1  [Torrent].
 
   Home   Help Search Donate Login Register  
Pages: [1]
  Print  
Author Topic: MagSpoof - V1 / V2  (Read 546 times)
MagSpoof
Newbie
*
Offline Offline

Activity: 2


View Profile
February 09, 2017, 01:13:18 AM
 #1

https://s30.postimg.org/6qib9grtd/cooltext230154049369196.png
Version 1

[COLOR="Lime"]https://youtu.be/Cueq3USAjcw[/COLOR]

I have build a handful of these devices originally built by samyk. I have taken the design from his build and made a much more powerful version with large mag coils for increased range and usability.

Also we have all the coding present and working for all bypass methods for EMV and card prediction generation...

  • Allows you to store all of your credit cards and magstripes in one device
  •     Works on traditional magstripe readers wirelessly (no NFC/RFID required)
  •     Can disable Chip-and-PIN
  •     Correctly predicts Amex credit card numbers + expirations from previous card number or canceled card!
  •     Supports all three magnetic stripe tracks, and even supports Track 1+2 simultaneously

https://s30.postimg.org/5b6tivjm9/magspoof_schematic_dip.png

As with samyk design we have improved the range of the device and we have all functioning modules working and present.

https://s24.postimg.org/6cj56laid/build1.jpg

https://s24.postimg.org/v778eekqd/Build2.jpg

https://s24.postimg.org/870l22mwl/Writing_To_Device.jpg

https://s27.postimg.org/6qwdbvolv/meter_small2.gif


One of the primary issues I've found is that some of the new forms of security (well, new in the US) are set in the "service code" portion of the magstripe, most specifically Chip-and-PIN.

The service code within a credit card magstripe defines several attributes of the card, including whether the card can dispense cash, where it can work (nationally, internationally), and most interestingly, whether the card has a built in IC (Chip) and if it has a pin (Chip-and-PIN / EMV).

If your card has a chip inside and you go to a retailer that supports Chip but swipe just your magstripe, the point of sale (PoS) system will ask you to dip your card/chip for additional security if it supports it.

However, the bits stating the card has Chip-and-PIN can be turned off from the magstripe. This means if you take a card to a retailer that would normally request you to dip, you can actually get away with not dipping your chip at all while performing a successful transaction, evading the security measures altogether.



Code:
#include <avr/sleep.h>
#include <avr/interrupt.h>

#define PIN_A 0
#define PIN_B 1
#define ENABLE_PIN 3 // also green LED
#define SWAP_PIN 4 // unused
#define BUTTON_PIN 2
#define CLOCK_US 200

#define BETWEEN_ZERO 53 // 53 zeros between track1 & 2

#define TRACKS 2

// consts get stored in flash as we don't adjust them
const char* tracks[] = {
"%B123456781234567^LASTNAME/FIRST^YYMMSSSDDDDDDDDDDDDDDDDDDDDDDDDD?\0", // Track 1
";123456781234567=YYMMSSSDDDDDDDDDDDDDD?\0" // Track 2
};

char revTrack[41];

const int sublen[] = {
  32, 48, 48 };
const int bitlen[] = {
  7, 5, 5 };

unsigned int curTrack = 0;
int dir;

void setup()
{
  pinMode(PIN_A, OUTPUT);
  pinMode(PIN_B, OUTPUT);
  pinMode(ENABLE_PIN, OUTPUT);
  pinMode(BUTTON_PIN, INPUT_PULLUP);

  // blink to show we started up
  blink(ENABLE_PIN, 200, 3);

  // store reverse track 2 to play later
  storeRevTrack(2);
}

void blink(int pin, int msdelay, int times)
{
  for (int i = 0; i < times; i++)
  {
    digitalWrite(pin, HIGH);
    delay(msdelay);
    digitalWrite(pin, LOW);
    delay(msdelay);
  }

https://s30.postimg.org/3nnc2f59d/Render_Board.png


I noticed many of the amex digits were similar.
I pulled up the numbers to several other Amex cards I had, and then compared against more than 20 other Amex cards and replacements and found a global pattern that allows me to accurately predict American Express card numbers by knowing a full card number, even if already reported lost or stolen.

Code:
MasterCard: ^(?:5[1-5][0-9]{2}|222[1-9]|22[3-9][0-9]|2[3-6][0-9]{2}|27[01][0-9]|2720)[0-9]{12}$ MasterCard numbers either start with the numbers 51 through 55 or with the numbers 2221 through 2720. All have 16 digits.
American Express: ^3[47][0-9]{13}$ American Express card numbers start with 34 or 37 and have 15 digits.
Diners Club: ^3(?:0[0-5]|[68][0-9])[0-9]{11}$ Diners Club card numbers begin with 300 through 305, 36 or 38. All have 14 digits. There are Diners Club cards that begin with 5 and have 16 digits. These are a joint venture between Diners Club and MasterCard, and should be processed like a MasterCard.
Discover: ^6(?:011|5[0-9]{2})[0-9]{12}$ Discover card numbers begin with 6011 or 65. All have 16 digits.
JCB: ^(?:2131|1800|35\d{3})\d{11}$ JCB cards beginning with 2131 or 1800 have 15 digits. JCB cards beginning with 35 have 16 digits.


This means if I were to obtain your Amex card and you called it in as lost or stolen, the moment you get a new card, I know your new credit card number.

I also know the new expiration date as the expiration date is fixed based on when the new card was requested, and you can determine if the new card has been requested by performing an auth on the existing card.

https://s29.postimg.org/fudxdrkl3/servicecodes.jpg


The CID (aka CVV2 on Visa) printed on the card is protected by a secret 3DES key that encrypts the PAN (Primary Account Number, aka credit card number), service code (see table above), and expiration. The service code can be easily determined as most cards will contain the same service code.

I also determined that the CSC (essentially behaves like a CID or CVV2 on the magstripe) for a lost or stolen card continues to work for a newer, predicted card. An attacker would be able to use a stolen card's CSC with the predicted card number and expiration to make actual purchases.

To actually perform the transaction without arousing suspicion, an attacker would be able to use a magstripe writer (e.g., the well known MSR605), or a device like MagSpoof, to "load" the newly devised card information onto a card like Coin. Coin itself does not actually verify the CID (CVV2), thus allowing an attacker to load data, and then use the Coin card in person without knowing the CID and exploiting these various issues, as well as disabling Chip-and-PIN.

Code:
void sleep()
{
  GIMSK |= _BV(PCIE);                     // Enable Pin Change Interrupts
  PCMSK |= _BV(PCINT2);                   // Use PB3 as interrupt pin
  ADCSRA &= ~_BV(ADEN);                   // ADC off
  set_sleep_mode(SLEEP_MODE_PWR_DOWN);    // replaces above statement

  MCUCR &= ~_BV(ISC01);
  MCUCR &= ~_BV(ISC00);       // Interrupt on rising edge
  sleep_enable();                         // Sets the Sleep Enable bit in the MCUCR Register (SE BIT)
  sei();                                  // Enable interrupts
  sleep_cpu();                            // sleep

  cli();                                  // Disable interrupts
  PCMSK &= ~_BV(PCINT2);                  // Turn off PB3 as interrupt pin
  sleep_disable();                        // Clear SE bit
  ADCSRA |= _BV(ADEN);                    // ADC on

  sei();                                  // Enable interrupts

I have a 5 available to ship and are working on a order based system from then on.

Payment BTC Only.

Price $2500 - Device With Full Source Code For Exploit

Device only - $1200

Device only comes with firmware loaded competent coder could write in around 10/15 day possibly also supplied are  resources related to our own project with device.


============ MagSpoof V2 - Card Spoofing Device ============

https://s24.postimg.org/4cbr2ekdh/cooltext230159254859625.png

Ladies and gentlemen let me introduce to you today MAGSPOOF V2
Its now time to SPOOF A CARD!!!


https://youtu.be/Cueq3USAjcw

Preorder is available!
https://s29.postimg.org/6ibuaobjb/Mag_Spoof_Front.png
https://s29.postimg.org/h6fl9ilif/Mag_Spoof_Top.png

Price $120.99
BTC Only
Limited first run of 20 cards!

More info soon!


https://s28.postimg.org/ateuvbt1p/cooltext230289135713059.png

We understand that securlty delivering this device world wide of this is paramount we ship via UPS / FEDEX / Or selected shipping of your choice to any location.
We also require when buying and sending your deliver address you encrypt this with PGP this is for your safety!

PM for our PGP Key

Delivery times can depending where in the world the device is being shipped.

All payments are final.. There are no refunds if your device gets lost in the post or intercepted. We will however reship if this happens and can be PROVED.


Jabber - magspoof@exploit.im
OTR Required!
Email - MILLW0RM@PROTONMAIL.COM

===List Of Tested Devices NFC===
http://]http://pastebin.com/du0uT8a4

Greets

Exploit.in - http://exploit.in/showthread.php?t=123870.3987
[Suspicious link removed] - [Suspicious link removed]/showthread.php?t=12198
FuckAV.ru - https://fuckav.ru/showthread.php?t=31577

 
1511524208
Hero Member
*
Offline Offline

Posts: 1511524208

View Profile Personal Message (Offline)

Ignore
1511524208
Reply with quote  #2

1511524208
Report to moderator
1511524208
Hero Member
*
Offline Offline

Posts: 1511524208

View Profile Personal Message (Offline)

Ignore
1511524208
Reply with quote  #2

1511524208
Report to moderator
1511524208
Hero Member
*
Offline Offline

Posts: 1511524208

View Profile Personal Message (Offline)

Ignore
1511524208
Reply with quote  #2

1511524208
Report to moderator
Join ICO Now A blockchain platform for effective freelancing
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction. Advertise here.
1511524208
Hero Member
*
Offline Offline

Posts: 1511524208

View Profile Personal Message (Offline)

Ignore
1511524208
Reply with quote  #2

1511524208
Report to moderator
1511524208
Hero Member
*
Offline Offline

Posts: 1511524208

View Profile Personal Message (Offline)

Ignore
1511524208
Reply with quote  #2

1511524208
Report to moderator
1511524208
Hero Member
*
Offline Offline

Posts: 1511524208

View Profile Personal Message (Offline)

Ignore
1511524208
Reply with quote  #2

1511524208
Report to moderator
awoland
Legendary
*
Offline Offline

Activity: 1442


Was mich nicht umbringt macht mich stärker [F.N.]


View Profile WWW
March 07, 2017, 10:04:11 AM
 #2

Не засирайте нам мозги! Всё можно срукожопить самостоятельно:
Samy Kamkar's MagSpoof
MagSpoof YT
MagSpoof GitHub.

Новость об этом устройстве и ссылки были здесь, если не ошибаюсь, ещё два года назад.
И покупать эту приблуду за $120.99 (на оф. сайте предзаказ за $60.00) считаю полной глупостью.

Лучше заказать Plastc Card за $155 (предзаказ).
После официального запуска стоимость заказа будет увеличена до $180:
- How much does the Plastc Card cost?

Plastc card will retail for $180. This includes the card, the card reader and the card charger, as well as a 12 month subscription.
During our preorder phase customers can place an order for $155 - which includes the card, card reader/charger, a two year warranty and a free 2 year subscription.

Рассылку предзаказов планируют начать во 2 квартале этого года:
- When will pre-orders ship?

Based on our current development and production forecast, we are slated to begin rolling the cards out in Q2 (April-June) of 2017. We will ship all the cards out as quickly as we can and the cards will ship in the order they were placed.

(Ниже есть ссылка для заказа со скидкой $20)
Это устройство поддерживает:
    Бесконтактный NFC
    Контактный EMV
    Программируемую эмуляцию контакной магнитной полосы
    Отображение штрихкодов на "электронных чернилах"
    Бесконтакную зарядку

Кроме самого устройства, за эту сумму вы получите в комплекте:
    2 year subscription to Plastc Services ($100 savings)
    Two-year warranty (Additional year of coverage)
    Proprietary Charger
    Card Reader


Plastc Card в сотоянии "запомнить" до 20 кредитных или дебетовых банковских пластиковых карт, карт лояльности или подарочных карт с чипом EMV, магнитной полосой или штрихкодом.
Управляется с помощью мобильного приложения для смартфона (Android & iOS), с которым соединяется по протоколу Bluetooth (BLE).
Смартфон нужен для управления, контроля и синхронизации. Есть система сигнализации о потере (краже) карты (при активации функция срабатывет на удалении карты в 100 футов от смартфона), дистанционной блокировки и обнуления данных при краже или утере. Сама Plastc Card в качестве платёжной карты может работать автономно без смартфона. Срок её работы в этом случае будет ограничен зарядом аккумулятора.

А если закажите Plastc Card по этой реферальной ссылке, получите скидку в $20 USD.


██████████████████            ██████████
████████████████              ██████████
██████████████          ▄█   ███████████
████████████         ▄████   ███████████
██████████        ▄███████  ████████████
████████        ▄█████████  ████████████
██████        ▄███████████  ████████████
████       ▄██████████████ █████████████
██      ▄███████████████████████████████
▀        ███████████████████████████████
▄          █████████████████████████████
██▄         ▀███████████████████████████
████▄        ▀██████████████████████████
██████▄        ▀████████████████████████
████████▄        ████████████████▀ █████
██████████▄       ▀█████████████  ██████
████████████▄       ██████████   ███████
██████████████▄      ▀██████    ████████
████████████████▄▄     ███     █████████
███████████████████▄    ▀     ██████████
█████████████████████▄       ███████████
███████████████████████▄   ▄████████████





▄█████████████████   ███             ███   ███   ███▄                ▄███            █████            ████████████████   ████████████████▄             █████
███▀                 ███             ███   ███   ████▄              ▄████           ███████           ███                ███           ▀███           ███████
███                  ███             ███   ███   █████▄            ▄█████          ███▀ ▀███          ███                ███            ███          ███▀ ▀███
███                  ███             ███   ███   ███ ███▄        ▄███ ███        ▄███▀   ▀███▄        ███                ███           ▄███        ▄███▀   ▀███▄
███                  ███████████████████   ███   ███  ▀██▄      ▄██▀  ███       ▄███▀     ▀███▄       ████████████████   ████████████████▀        ▄███▀     ▀███▄
███                  ███             ███   ███   ███   ▀███    ███▀   ███      ▄███▀       ▀███▄      ███                ███        ███          ▄███▀       ▀███▄
███                  ███             ███   ███   ███    ▀███  ███▀    ███     ▄███▀         ▀███▄     ███                ███         ███        ▄███▀         ▀███▄
███▄                 ███             ███   ███   ███      ██████      ███    ▄███             ███▄    ███                ███          ███      ▄███             ███▄
▀█████████████████   ███             ███   ███   ███       ████       ███   ▄███               ███▄   ████████████████   ███           ███    ▄███               ███▄

|
  TRUE BLOCKCHAIN GAMING PLATFORM 
DECENTRALISED AUTONOMOUS UNIVERSES

  HOME PAGE                                                                  WHITE PAPER 
|
nimogsm
Hero Member
*****
Online Online

Activity: 504



View Profile
March 07, 2017, 01:14:59 PM
 #3

Не засирайте нам мозги! Всё можно срукожопить самостоятельно:
Samy Kamkar's MagSpoof
MagSpoof YT
MagSpoof GitHub.

Новость об этом устройстве и ссылки были здесь, если не ошибаюсь, ещё два года назад.
И покупать эту приблуду за $120.99 (на оф. сайте предзаказ за $60.00) считаю полной глупостью.

Лучше заказать Plastc Card за $155 (предзаказ).
После официального запуска стоимость заказа будет увеличена до $180:
- How much does the Plastc Card cost?

Plastc card will retail for $180. This includes the card, the card reader and the card charger, as well as a 12 month subscription.
During our preorder phase customers can place an order for $155 - which includes the card, card reader/charger, a two year warranty and a free 2 year subscription.

Рассылку предзаказов планируют начать во 2 квартале этого года:
- When will pre-orders ship?

Based on our current development and production forecast, we are slated to begin rolling the cards out in Q2 (April-June) of 2017. We will ship all the cards out as quickly as we can and the cards will ship in the order they were placed.

(Ниже есть ссылка для заказа со скидкой $20)
Это устройство поддерживает:
    Бесконтактный NFC
    Контактный EMV
    Программируемую эмуляцию контакной магнитной полосы
    Отображение штрихкодов на "электронных чернилах"
    Бесконтакную зарядку

Кроме самого устройства, за эту сумму вы получите в комплекте:
    2 year subscription to Plastc Services ($100 savings)
    Two-year warranty (Additional year of coverage)
    Proprietary Charger
    Card Reader


Plastc Card в сотоянии "запомнить" до 20 кредитных или дебетовых банковских пластиковых карт, карт лояльности или подарочных карт с чипом EMV, магнитной полосой или штрихкодом.
Управляется с помощью мобильного приложения для смартфона (Android & iOS), с которым соединяется по протоколу Bluetooth (BLE).
Смартфон нужен для управления, контроля и синхронизации. Есть система сигнализации о потере (краже) карты (при активации функция срабатывет на удалении карты в 100 футов от смартфона), дистанционной блокировки и обнуления данных при краже или утере. Сама Plastc Card в качестве платёжной карты может работать автономно без смартфона. Срок её работы в этом случае будет ограничен зарядом аккумулятора.

А если закажите Plastc Card по этой реферальной ссылке, получите скидку в $20 USD.


Спасибо за инфу,вообще все по полочкам,присматриваюсь,по ссылочке перешел Wink

    ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄   
   ████████████████████████████████   
     ▀██████████████████████████▀     
        ▀████████████████████▀       
          ████████████████▀         
            █████████████           
            ▀████████████▀           
             ▀██████████▀             
              ██████████             
               ████████               
               ▀██████▀               
                ██████               
                  ▀                   
.
.trade.io.
██████
██████
███
███
███
███
███
███
███
███
███
██████
██████

▄██████████████████▄
███       ▀███████
███       █████████
███       █████████
███       █████████
███              ██
███   ▄▄▄▄▄▄▄▄   ███
███   ▄▄▄▄▄▄▄▄   ███
███              ███
███▄▄▄▄▄▄▄▄▄▄▄▄▄▄███
██████████████████▀

▄██████████████████▄
███████████▀ ███████
█████████▀   ███████
███████▀     ██▀ ███
███ ▀▀       █▄▄████
███          █▀▀▀▀██
███ ▄▄       ███████
██████▄     █▄ ▀███
█████████▄   ███▄███
███████████▄ ███████
▀██████████████████▀

▄██████████████████▄
████████████████████
███████████████▀▀ ██
█████████▀▀     ███
████▀▀     ▄█▀   ███
███▄    ▄██      ███
█████████▀      ▄██
█████████▄     ████
█████████████▄ ▄████
████████████████████
▀██████████████████▀
██████
██████
   ███
   ███
   ███
   ███
   ███
   ███
   ███
   ███
   ███
██████
██████
.
.Join the Trading Revolution.
Pages: [1]
  Print  
 
Jump to:  

Sponsored by , a Bitcoin-accepting VPN.
Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!