Universal credit card in the palm of your hand

universal_credit_card

Do you remember the magnetic card spoofer in Terminator 2? It was a bit farfetched because apparently the device could be swiped through a reader and magically come up with working account numbers and pin numbers. We’re getting close to that kind of magic with [Jaroslaw's] card spoofer that is button-programmable.

Building off of a project that allows spoofing via an iPod and electromagnet, [Jaroslaw] wanted something that doesn’t require a computer to put together the card code. He accomplished this by interfacing a 16-button keyboard and a character LCD with an AVR ATmega168 microcontroller. Card codes can be entered with the buttons and verified on the LCD. Of course this is still dependent on you knowing the code in the first place.

As you know, credit cards use this technology. We don’t think Walmart is going to be OK with you pulling this out in the checkout line, not to mention local five-oh. This technology is also used for building access in Universities, businesses, and hotels. If used in conjunction with some other spy technology you’ll be on your way to becoming a secret-agent-man.

Comments [29]

tagged: ATmega168, AVR, credit card, electromagnet, magnetic card, spoofer

Reader Comments

Needs to be installed in an old cell phone case for stealth.

Posted at 8:10 am on Sep 23rd, 2009 by dbear

sweet!

Posted at 8:12 am on Sep 23rd, 2009 by monkeyslayer56

awesome, thats really cool. btw why is the lcd upside down?

Posted at 8:18 am on Sep 23rd, 2009 by andrew

I think that this could be built to the same size and thickness of a credit card.
Wanna get rich? Move to Mexico and start producing them.

Posted at 8:29 am on Sep 23rd, 2009 by dbear

This is interesting, but if it works well, the IPod version is stealthier, and if instead of an iPod you use a smartphone, you could run the sound generating program from the device itself.

The IPod version is just an Ipod + Amplifier + Eletromagnet.
We just need to find a smartphone with room for the amplifier and stripe, and then have the stripe being ejected through a small slot.

Posted at 8:52 am on Sep 23rd, 2009 by IceBrain

I see 16 buttons, where are the other 4?

Posted at 8:53 am on Sep 23rd, 2009 by The Sharpie One

@The Sharpie One: Indeed, I guess counting isn’t my strong suit. Fixed

Posted at 8:59 am on Sep 23rd, 2009 by Mike Szczys

I think it would be cool if this would program a card on the fly, so you keep a dummy card laying around and punch in a code, swipe it through the machine then use it as normal, or like in a past update make it so it is tethered to a card that is able to change on the fly… many possible ways to make it less conspicuous.

Posted at 9:21 am on Sep 23rd, 2009 by Jack

In terminator 2 didn’t he have his step mums credit card and it just brute forced the pin number?

Posted at 9:30 am on Sep 23rd, 2009 by Cobolt

Magnetic stripes will be pretty scarce here in the EU in a few years time when all the credit cards switch to using the EMV chip instead… No more universal credit card since the EMV chips are very very difficult to duplicate.

Posted at 10:26 am on Sep 23rd, 2009 by Entropia

@Cobolt Your memory serves correctly.

Posted at 10:47 am on Sep 23rd, 2009 by redbeard

@dbear: i like where you’re going with this. on some short-lived sci-fi show called “Time Trax”, a 22nd century “fugitive retrieval” cop named “Darien Lambert” carried around a credit card sized supercomputer called “SELMA”. he had “unlimited credit” from any ATM and could hack any computer available.

A (super)computer that could be built to the same size and thickness of a credit card.

Just one more century to go!

Posted at 12:40 pm on Sep 23rd, 2009 by captain

Electronic Lock brute-forcing predates WWW. These devices have been shown in evidence in FBI documentaries. They are just almost non-existent in public view. The closest thing to documentation I’ve seen was work done about a year ago with a transformer or something in a cut out card.

The T2 thing is feasible given you could throw the ATM firmware in a loop through mag stripe data continuity or something. I doubt it’s possible now, but maybe back then.

Posted at 1:50 pm on Sep 23rd, 2009 by tjhooker

This could be even more stealthy if one were to use the magnetic strip on a credit card and had a ribbon cable back to the device. This could be fed through ones sleeves. This would make it look like you are actually using a real card.

Posted at 4:18 pm on Sep 23rd, 2009 by breeze

Nice! Now, put it in a professional package, and have a bunch of buttons; each corresponds to a different card. You can get rid of all your swipe cards that way! Though I suppose that unless you have upwards of 20 cards, that wouldn’t be all that worthwhile.

Posted at 4:20 pm on Sep 23rd, 2009 by 1up

Like Photography based key making I see this research having a short life most likely by legal influence.

Posted at 4:25 pm on Sep 23rd, 2009 by tjhooker

Why not setup your own card readers and locks? physical honey pots. Should work for RFID, pins, etc. or intercept the signal from the pad/reader. beware: most have light sensors underneath to detect removal-from-wall/tampering [and often cameras nearby]

–PidGin128

Posted at 11:04 pm on Sep 23rd, 2009 by PidGin128

The power of the sun, in the palm of my hand!

Posted at 11:12 pm on Sep 23rd, 2009 by Doc Oct

Sorry about that guys, here is the source in text form: http://www.soniktech.com/card.txt

Posted at 4:31 am on Sep 24th, 2009 by jarek

I like the comment on the instructables website: “Technically you can modify the source code to produce every possible number combination for one file and have it play them all in one huge file”

I wonder how big the wave file would be, and how long it would take to play the whole file back.. that would totally be James Bond.

Posted at 4:43 am on Sep 24th, 2009 by RHF

That’s a college door card scanner.

Posted at 6:35 am on Sep 24th, 2009 by taco

Blackboard access control. that is the newer style reader. was by ATT Campus Wide systems in early life. very expensive because of proprietary reader/controller configurations old ones ran on rs-485 they finally went the way of TCP/IP but still very expensive boards. and as with most magnetic physical contact type interfaces, they wear out. BB charges 150$ just to open the reader plus inflated parts charges… have 400 reader systems coming offline because of better technologies.. you want some?

Posted at 11:52 am on Sep 24th, 2009 by arcnemisis

I think that the device will not work if the reader has the full ISO1-2-3 heads, cause the electromagnet “sends” the same signal on all of three heads, that must have different signals. In my opinion, it can work only for a single ISO track reader.

Posted at 4:24 am on Sep 25th, 2009 by Emilio Ficara

easy money

Posted at 8:53 pm on Sep 25th, 2009 by sleepy

I had an idea like this. I was going to make the card spoofer from the instructable, but instead of using an ipods headphone jack i was going to use a bluetooth headset i have that got the speaker and mic ripped off (dog). i planned on putting a plug on the speaker for hooking it up to better headphones anyway.

Posted at 10:09 pm on Sep 25th, 2009 by Metalwolf

were is schema for this device

Posted at 11:56 am on Oct 5th, 2009 by bogdan

http://www.soniktech.com/SDMCE/schema.png

jest tam na stronie, ale uwazaj z nim, nie jest doskonaly

Posted at 12:29 pm on Oct 5th, 2009 by jarek

thanks and in detail part list

Posted at 1:03 pm on Oct 5th, 2009 by bogdan

Some years ago, in France, there was fake credit cards called “yescard”, and you could buy anything with any pin code in any shop.
Money was coming from nowhere (well, in the end it was the banks who were paying for it).

Posted at 3:11 pm on Oct 19th, 2009 by Olivier

Universal credit card in the palm of your hand

Recent Posts

Reader Comments

Leave a Reply

Hacks

Resources

RSS newsfeeds

Most commented on (30 days)

Recent comments