News for hackers. Stuff that matters.

A comment on Asus refunds Zenfone buyer for failing to provide bootloader unlock tools. Parent comment

Re:Asus refunds Zenfone buyer for failing to provide bootloa... by jjmarr on Saturday April 06, 2024 @12:15PM (#39953399)
They do, but you can't get the card number from reading the chip. The protocol is a challenge-response one based on a private key stored within the chip.

https://en.wikipedia.org/wiki/Chip_Authentication_Program

You need to read the entire card number + cvc2 + expiry date with your camera. That's not skimming, that's just taking a photo of the card.

[ Parent | on HN ]
Re:Asus refunds Zenfone buyer for failing to provide bootloa... by worewood on Saturday April 06, 2024 @12:24PM (#39953468)
Yeah, and it's easily solvable with a sticker or a dremel to scrape the number off
[ Parent | on HN ]
Re:Asus refunds Zenfone buyer for failing to provide bootloa... by lxgr on Saturday April 06, 2024 @03:01PM (#39954578)
You can't dremel it out of the chip, though.
[ Parent | on HN ]
Re:Asus refunds Zenfone buyer for failing to provide bootloa... by justinclift on Saturday April 06, 2024 @08:42PM (#39957090)
Well technically you can. The card won't be so usable after that though. ;)
[ Parent | on HN ]
Re:Asus refunds Zenfone buyer for failing to provide bootloa... by lxgr on Saturday April 06, 2024 @10:28PM (#39957654)
Destroying the chip is easy, actually chiseling away the correct trapped electrons making up the PAN in the EEPROM is the challenge ;)
[ Parent | on HN ]
Re:Asus refunds Zenfone buyer for failing to provide bootloa... by lxgr on Saturday April 06, 2024 @02:04PM (#39954215)
No, you can most certainly get the card number and expiry via the chip and even over contactless, as it’s a vital part of transaction routing/processing. There are Android apps that can do it.
[ Parent | on HN ]
Re:Asus refunds Zenfone buyer for failing to provide bootloa... by jjmarr on Saturday April 06, 2024 @04:17PM (#39955131)
If I could I'd delete my original comment since I did more research and you're right.

https://stackoverflow.com/questions/14861908/apdu-command-to...

[ Parent | on HN ]