Cellphones as Credit Cards? Americans Must Wait

[Moderator Snip]

Knowing how relatively simple it is to clone some cell phones this scares the crap out of me.

On Thu, 29 Jan 2009, T posted:

Cloning a cell phone would do no good. The technology works via a RFID chip, typically in the back cover of the phone. It's basically a stored-value card embedded in the phone.

Thus, an attacker would have to attack the mechanism by which value is loaded onto the chip. On mobile phones, this is done by an application that runs on the phone, and has various registration/authorization hoops that need to be jumped.

I suspect that I'd be far easier to steal a phone than it would be to crack this system to steal from an authorized user. The Japanese have a lot of experience with security weaknesses with stored-value cards (they've pretty much given up entirely on passive magnetic data cards since those were cracked long ago).

The other possible form of attack (which was done on the passive cards) is not to steal from any authorized user, but rather to load false value on an card and/or to hack the card to report value that doesn't exist. But for that attack, why waste a mobile phone when you can buy a completely anonymous standalone card.

-- Mark --

is two wolves and a sheep deciding what to eat for lunch. Liberty is a well-armed sheep contesting the vote.