Author Topic: Mythbusters Silenced by Credit Card Companies (Read 28021 times)

Ehtyar · « **on:** September 03, 2008, 04:36 PM »

A Mythbusters episode entailing an analysis of RFID tags (and how easily they're hacked) has been trodden on by "American Express, Visa, Discover, and everybody else...".

Screenshot - 4_09_2008 , 7_35_47 AM_thumb.png

Although it's no secret that RFID is easily hacked (see: train passes, passports, credit cards, one billion other cards, etc.) it's still not necessarily common knowledge, and it sounds like the major credit card companies want to keep it that way -- according to Adam Savage, Mythbusters was all set to do a show exposing the weak security behind most RFID implementations but was shut down by lawyers from "American Express, Visa, Discover, and everybody else... [who] absolutely made it really clear to Discovery that they were not going to air this episode." Since Discovery is an ad-supported channel, it's not surprising that it backed down, but we'd say that the credit card industry would be far better served spending money on actually improving security rather than lawyering up and trying to keep consumers in the dark.

Full Story

Ehtyar.

Eóin · « **Reply #1 on:** September 03, 2008, 05:24 PM »

I'm surprised by Discovery backing down, but at least controversy like this means the story will get more publicity than it could ever have hoped for.

Ehtyar · « **Reply #2 on:** September 03, 2008, 05:38 PM »

I imagine the first happened in order to lessen the effect of the second.

Ehtyar.

f0dder · « **Reply #3 on:** September 03, 2008, 05:47 PM »

Bastards.

Darwin · « **Reply #4 on:** September 03, 2008, 05:52 PM »

I'm surprised by Discovery backing down, but at least controversy like this means the story will get more publicity than it could ever have hoped for.
-Eóin (September 03, 2008, 05:24 PM)

I hope you're right. This is quite frightening and really needs to be addressed. We've got people talking in general terms about RFID (as implanted in credit cards, cell phones, car key remote fobs, etc.) being used to identify us and our shopping habits/preferences and stream targeted advertising to us in stores so the technology either needs to be made much more secure or scrapped. Right now there is a lot of excitement over it so I doubt that it's going to be scrapped...

kartal · « **Reply #5 on:** September 03, 2008, 05:53 PM »

If you have time

http://itc.conversat...shows/detail210.html

RFID -- Radio Frequency Identification -- is transforming the way companies track inventory, artwork and even law briefs, but some fear it could be used for more "Orwellian" pursuits. A panel of leading technology developers and pioneer end-user corporations explores this promising and yet maligned emerging technology that both empowers consumers and raises privacy issues.

Darwin · « **Reply #6 on:** September 03, 2008, 05:55 PM »

Bastards.
-f0dder (September 03, 2008, 05:47 PM)

Well said. Exactly how I feel. Once again profits trump public safety. Identity theft made possible at this level is a public safety issue and ignoring it while making billions off it is immoral. Hold on... This is eerily familiar, isn't it?

Darwin · « **Reply #7 on:** September 03, 2008, 05:56 PM »

If you have time

http://itc.conversat...shows/detail210.html

RFID -- Radio Frequency Identification -- is transforming the way companies track inventory, artwork and even law briefs, but some fear it could be used for more "Orwellian" pursuits. A panel of leading technology developers and pioneer end-user corporations explores this promising and yet maligned emerging technology that both empowers consumers and raises privacy issues.
-kartal (September 03, 2008, 05:53 PM)

I'm going to have to hunting for this, but there was a Danish graduate student who invented some sort of a "firewall" to protect against this... Read about it a year or two ago. I'll post a link when I can find it.

EDIT: That was easier than I thought, though it's not the same article I read back then: http://arstechnica.c...re/rfid-guardian.ars

zridling · « **Reply #8 on:** September 03, 2008, 07:03 PM »

Reminds me of Diebold Corporation's idiotic resolve not to release their buggy voting machine code, which conveniently dropped tens of thousands of votes in key districts every election.

Renegade · « **Reply #9 on:** September 03, 2008, 09:09 PM »

Bastards.
-f0dder (September 03, 2008, 05:47 PM)

Well said. Exactly how I feel. Once again profits trump public safety. Identity theft made possible at this level is a public safety issue and ignoring it while making billions off it is immoral. Hold on... This is eerily familiar, isn't it?
-Darwin (September 03, 2008, 05:55 PM)

+1000

I can't post more without resorting to an extreme rant filled with profanity.

Josh · « **Reply #10 on:** September 03, 2008, 09:45 PM »

Just blame mouser, he is at fault for it all

housetier · « **Reply #11 on:** September 04, 2008, 04:36 AM »

This just makes me feel good for not using nor even OWNING a credit card.

tomos · « **Reply #12 on:** September 04, 2008, 04:55 AM »

This just makes me feel good for not using nor even OWNING a credit card.
-housetier (September 04, 2008, 04:36 AM)

that's easier in germany all right - but some places it's very difficult to buy anything online without cc

oh no

my new avatar is kindof/very like yours housetier - take it as flattery

f0dder · « **Reply #13 on:** September 04, 2008, 05:31 AM »

This just makes me feel good for not using nor even OWNING a credit card.
-housetier (September 04, 2008, 04:36 AM)

You do own a debit card, though, don't you? I'd feel handicapped without one. Oh, and in .dk, many people generally call both debit & credit cards "kreditkort". Wasn't until ~5 years ago I realized what a credit card really is, and how awful an idea they are.

housetier · « **Reply #14 on:** September 04, 2008, 09:12 AM »

I don't have a debit card either. I always pay cash

f0dder · « **Reply #15 on:** September 04, 2008, 10:02 AM »

I don't have a debit card either. I always pay cash
-housetier (September 04, 2008, 09:12 AM)

Wow

That'd be way too inconvenient for me - it's very rare that I carry cash. And when I do, it's usually because I'm "up to no good"

Armando · « **Reply #16 on:** September 04, 2008, 11:21 AM »

I don't have a debit card either. I always pay cash
-housetier (September 04, 2008, 09:12 AM)

Nowadays, when you have to travel, it's almost impossible to not have a credit card. Need to rent a car ? Need some more cash but your debit card won't work in that country ? And here in Canada -- but I'm pretty sure that it's the same almost everywhere -- having a credit card allows one to build a good (or bad...) credit report and score... Handy if you need/want to buy a house or anything like that.

alivingspirit · « **Reply #17 on:** September 04, 2008, 11:57 AM »

This just makes me feel good for not using nor even OWNING a credit card.
-housetier (September 04, 2008, 04:36 AM)

that's easier in germany all right - but some places it's very difficult to buy anything online without cc

-tomos (September 04, 2008, 04:55 AM)

Shouldn't be to hard. Sign up for a virtual card.

http://www2.discover...napnap_sec_nap_soa_1

Or use paypal.

40hz · « **Reply #18 on:** September 04, 2008, 01:17 PM »

I suspect the card companies mostly wanted to hide how poorly conceived and implemented the whole RFID thing is. Because the big secret here is that there isn't any secret to it.

Unfortunately, all the info needed to perform the hack is readily available via a simple Google search. And anybody with the minimal technical acumen to pull it off already knows that. I doubt even the script-kiddies watch MythBusters for computer hacks.

The terrifyingly 'nordic' Xeni Jardin even has a vid up on Boing-boing showing it in action. There are no details presented. But I'd guess most of the crowd here at DC could glean enough from just seeing this interview to figure out the rest.:

http://tv.boingboing...o-hack-an-rfide.html

There's a great observation made during the interview about how RFID pushes the decryption of sensitive information out of a secure corporate data center and on to some merchant's card reader. Love it!

Ehtyar · « **Reply #19 on:** September 04, 2008, 07:16 PM »

Can anyone say scaaaaaaaaareh!!

Ehtyar.

Renegade · « **Reply #20 on:** September 04, 2008, 07:37 PM »

The credit card companies are seriously incompetent. They really piss me off too, because as a merchant, I end up paying for their mistakes!

RFID is just another way for them to be idiots and screw their customers without taking responsibility.

Ehtyar · « **Reply #21 on:** September 04, 2008, 07:54 PM »

The credit card companies are seriously incompetent. They really piss me off too, because as a merchant, I end up paying for their mistakes!

RFID is just another way for them to be idiots and screw their customers without taking responsibility.
-Renegade (September 04, 2008, 07:37 PM)

Very very true, I've seen it also.

Ehtyar.

housetier · « **Reply #22 on:** September 05, 2008, 07:36 AM »

... having a credit card allows one to build a good (or bad...) credit report and score...
-Armando (September 04, 2008, 11:21 AM)

It also allows for the opposite: build a very bad credit record. so bad in fact one can't even sign up with an ISP or phone company, much less rent an apartment.

I have been burnt by credit cards and can only say: ask yourself if you really have the money (i.e. is it really yours) are going to spend with it.

Armando · « **Reply #23 on:** September 06, 2008, 07:09 PM »

True.
I never use my credit card to spend money I don't have. When money becomes scarce, I re-budget, I find ways to spend less, etc., I'll even borrow (friends, parents...)... But I will usually not use my credit cards. Of course, context and mileage may vary...

Deozaan · « **Reply #24 on:** September 07, 2008, 12:51 AM »

I just got my passport and it also has RFID in it.