Categories: Mobile

Mobile payment system Square can be hacked, claims researchers

Square enables smartphone users to process credit card transactions remotely

Two researchers attending the Black Hat security conference yesterday in Las Vegas have demonstrated a simple hacking technique that could allow unscrupulous individuals to purchase items using the mobile payment system Square and stolen credit card data. With this technique, would-be hackers could use stolen credit card data to withdraw funds without the need to be in possession of the physical credit card.

This hacking technique is made possible by the way in which Square works. Square is a mobile payment system that exists as a physical smartphone attachment or dongle and an Android or iOS mobile app. Users pay for goods by swiping their credit card through the Square dongle. The dongle creates a simple audio file containing the user’s credit card data that is then sent to the Square mobile app, processed and authorised by the appropriate credit card issuer. As it stands however, the audio files’ origins are not verified by the app so don’t necessarily have to be generated by the official dongle.

The two researchers, Adam Laurie and Zac Franken, created a simple program themselves that reads magnetic strip data from credit cards which is then converted to an audio file. This audio file can then be played into the Square dongle and the data is sent directly to the Square app for processing. The app does not distinguish between a proper credit card swipe and an audio file played into the device.

In this regard, stolen credit cards data could be stored efficiently in audio files and sold to dubious buyers. The Square app is due to be updated in the near future and will likely patch this vulnerability. Or instead, Square may issue new dongles that encrypt audio file data.

Albizu Garcia

Albizu Garcia is the Co-Founder and CEO of Gain -- a marketing technology company that automates the social media and content publishing workflow for agencies and social media managers, their clients and anyone working in teams.

Recent Posts

GAN, Tec de Monterrey partnership highlights cross-border startup ecosystem building in Latin America amid trade dispute

Despite recent tensions between the United States government and Latin American countries over migration and…

2 days ago

This founder started out with US $5K to his name. Now, he owns a multi-million-dollar global business

Meet Nitin Seth, the Co-Founder and CEO of Screen Magic (SMS Magic), a messaging leader…

3 days ago

Building smarter: AI, the ultimate tool transforming an old-age industry

In this Brains Byte Back, we sit down with Hari Vasudevan, founder and CEO of…

3 days ago

When AI Goes Rogue: 8 Lessons from Implementing LLMs in the Healthcare Industry that Could Save the Future

By Santosh Shevade, Principal Data Consultant at Gramener – A Straive company All pharmaceutical companies…

4 days ago

Digital Public Infrastructure will enable public, private entities to control your access to essential goods, services & mobility

Digital Public Infrastructure is a top-down agenda coming from unelected globalists, bureaucrats, and their partners…

1 week ago

Open Source Claims to Be a Meritocracy—So Why Are Companies Buying Their Way In?

Imagine that you are a maintainer of a widely used open source project relied upon…

1 week ago