Stealing From Credit Cards Made Easy(ier)

In the old days, thieves using stolen credit cards had to go through the grueling process of purchasing items and then reselling them in order to get money. Now, a couple hackers found that new technology may help crooks skip the middle man and deposit money directly from a stolen credit card number into accounts.

Square is a dongle that can turn an iPhone or iPad into a credit card terminal, making it easier for small businesses and traveling sellers to scan a credit card's magnetic strip on-the-go. But Adam Laurie and Zac Franken from Aperture Labs, a computer security firm, were able to trick this software using a method that could potentially be done by thieves using stolen credit card numbers.

Here's how they did it according to Popular Science:

The dongle plugs into a headphone jack. Laurie realized this meant the device was converting magnetic information into sound waves that were interpreted by the app.

He realized he could trick the system into falsely reading audio data, so it would enter a transaction using a stolen credit card number.

He inserted a different wire into the iPad’s headphone jack, so the software thought a dongle was plugged in. Then he modified some software he had already written for translating magnetic stripe data (we mentioned he’s a hacker, right?) and then typed in a credit card number. The data was converted to sound, and the app read the information as if a real card had been swiped. Then he could deposit funds into his Square account, which are delivered within a day.

PhysOrg.com reported Laurie as saying:

"You'd have to set up dodgy accounts that don't trace back to you," Laurie said. "But, that is standard practice."

Laurie and Franken said that they shared their findings with Square in February only to be told that it wasn't seen as a threat and that traffic analysis would expose those kinds of transactions.

The hackers had also heard unconfirmed reports that Square planned to release new dongles that encrypt transaction data.

"Encryption would be a good thing," Franken said. "The way it is at the moment a cable between two devices and you can inject credit card numbers right into the system," he continued.

Here's one more reason to protect your credit card information.