This is an update to the original post from 07/31/2012.
I have got an answer from Eddie Lee - the author of this hack - regarding the pinpad types (our conversation is actually published here at Forbes.com):
"Hi Slava,
I’ve personally tested replay on live Vivopay and Verifone systems. My impression is that the readers do very little, if any, verification. I’m not sure which readers are PCI PTS certified (and contactless), so I don’t know if I’ve actually used one of those readers…certainly, there are a large number of existing/deployed readers that are still vulnerable. From my experience, there is little difference between the readers, so I would not be surprised if most/all systems are vulnerable to replay. Regardless, it would still be possible to skim and spend in proxy mode."
I have got an answer from Eddie Lee - the author of this hack - regarding the pinpad types (our conversation is actually published here at Forbes.com):
"Hi Slava,
I’ve personally tested replay on live Vivopay and Verifone systems. My impression is that the readers do very little, if any, verification. I’m not sure which readers are PCI PTS certified (and contactless), so I don’t know if I’ve actually used one of those readers…certainly, there are a large number of existing/deployed readers that are still vulnerable. From my experience, there is little difference between the readers, so I would not be surprised if most/all systems are vulnerable to replay. Regardless, it would still be possible to skim and spend in proxy mode."
RSS Feed
