Hacking Passports and Credit Cards with Major Malfunction

Anything with a chip in it is vulnerable to attack. Your contactless credit card, your office key card, your passport-as more processes become automated, more opportunities open up to hackers.
In the third episode of Can I Hack It?, made possible by Mr Robot on Amazon Prime, we visit Adam Laurie, better known by his hacker name Major Malfunction.
Laurie specialises in hacking devices that use RFID, or radio frequency identification. He’s a white hat researcher who finds ways to hack into products in order to test their security, and he also runs the London chapter of the Defcon hacking community.
From his home in the British countryside, Laurie tells us how hacking has changed over the decades and demonstrates just how easy it is to pull information from a contactless card or clone a passport-but he promises he’s deleted the details he hacked from us.
WATCH NEXT:
The Man Biohacking Encryption From His Garage: bit.ly/2bCaUsT
Subscribe to MOTHERBOARD: bit.ly/Subscribe-To-MOTHERBOARD
Follow MOTHERBOARD
Facebook: / motherboardtv
Twitter: / motherboard
Tumblr: / motherboardtv
Instagram: / motherboardtv
More videos from the VICE network: www. vicevideo

[@uaebikers]

This woman is brilliant. Hands over her passport and leaves finger prints on his gun. Well well.....

[@MonoreX54]

Every white hat hacker has been a black hat for at least one day.

[@AtlanticaVI]

Lando _ N I G finish this word

[@cntrix2047]

@@AtlanticaVI NIGHT

[@victorshx]

@Lando _ He spoke the truth, with all due respect....stfu

[@victorshx]

Lando _ He spoke the truth.

[@victorshx]

Lando _ He spoke the truth.

[@xanny1651]

Behind the cameras he turns into an Indian tech support guy that takes your creditcard info.

[@OfficialBoominBeats]

lmfao

[@alkeryn1700]

Altough that's not the case, that was pretty fun rofl

[@anakinskywalkerrr]

Helo frend TODAA IM GOING TO SWOO UU

[@EVILPATHANHackLikePro]

😂😂😂

[@GetMotivated978]

What a few RFID's, Card Readers and Kali Linux can do is beyond amazing.

[@mochababy2]

Every Nigerians dream

[@trollingfridge4975]

LOOOOOOL

[@SharockoRAZR]

hahaha

[@kc-gd9ig]

🤣🤣🤣

[@AustineMiles22]

Columba Kelly NOOOOO that's a lie

[@PaakoBravoo]

😂😂😂😂

[@ca4778]

Somehow i find these “hacking” videos entertaining

[@winnrecked]

There you fucking go vice, this is the shit we've been missing.

[@LTZMusic]

Great upload Motherboard, lots of support from my little corner!

[@ottawadigs]

wasn't aware private citizens in England could posses handguns

[@Ebb0Productions]

Sure can, just need a license. However more importantly; firearm culture is completely different from what you see in the US. Different mindsets.

[@littlestworkshop]

You can't have hand held firearms since 1997 except in some special cases, these are probably air pistols, the ammunition shown was for rifles.

[@ottawadigs]

***** yea I think they were trying to make him appear to be a total badass

[@vladark138]

Is that so ? www.gov.uk/shotgun-and-firearm-certificates

[@littlestworkshop]

No handguns (other than air powered), other firearms and shotguns are allowed with a licence. en.wikipedia.org/wiki/Firearms_(Amendment)_(No._2)_Act_1997

[@aminexz2324]

credit card have a problem in NFC but can do aluminum for protected "Hz"

[@TruelyyKC]

Loving this series. Keep it up

[@raphaeloyedele1321]

Jimmy Cheong Message Johnnyhack50 on Instagram he would help you get money

[@ikonane]

Great content! Thanks!

[@Aaron66111]

Nice to see more hacking related stuff from actual figures in the scene as opposed to pseudo bullshit. Keep it up vice g.

[@maxel3g3nd]

Everything in Mr Robot is technically correct.

[@hindustanimiyabhai1767]

He said, trust me I am a Hacker.. 😂😆😁

[@seb5844]

i love that he gave her the gun, then takes it back to make sure it's not loaded. lol xd

[@flyingface]

lol I love how they've made all of this so overly dramatic

[@muskreality]

"can you delete that please"😁

[@IamColt13]

What sort of RFID reader does he have? Any affordable ones out there?

[@yoppindia]

If all else fails, I can shoot my way through!

[@Schradermusic]

"Evil hax0r" - that guy is really old school. I like that

[@blackphinix27]

This is some fucking nice Mansion

[@moonbeam112]

I think I'm on a watch list now.

[@SteviesHouseofRandom]

*Facepalm* Hacking has been happening way before the internet come on motherboard.

[@Ownage4lif31]

Yea it has, social engineering

[@SteviesHouseofRandom]

and anyone who made a machine work different :) Hacking existed long before computers, as long as machines have existed.

[@3-bits286]

@@Ownage4lif31 Honestly not that lol. You could hack and reverse engineer chips long before the internet was even close to being a thing. People who do that are real hackers, not retards who just sit on kali linux and use tools made by other people to skid.

[@glascosimith5038]

Buy your fake documents, ID, DL. fakeidgenerator.catalog.to

[@41fizzle]

How do you actually contact motherboard for a story?

[@r.p.gevolutions3024]

HE IS LEFT HANDED

[@goodmusic4eva]

R.P.G Evolutions you say that because of the watch i think? I'm a lefty and I put my watch on my left hand so it means nothing

[@alenpasnikov]

Thanks for pointing out!

[@kazimierz198]

This video is misleading. There are a lot of protections in place that make duplicating and changing the contents of an e-passport very difficult. First, info on the chip is signed by a digital certificate (same PKI technology that's used to secure HTTPS connections). Changing the contents would break the digital signature and the passport would be flagged as untrusted. Second, to unlock the info on the chip, the passport reader has to scan the MRZ lines (the two lines on the bottom of your passport page that has your details) which is then used to decrypt the chip. There are other optional measures that a country can put in place as outlined in the ICAO standard. Someone involved with this video could have done some basic research, Wikipedia is a good start: en.m.wikipedia.org/wiki/Biometric_passport

[@kazimierz198]

I'm not sure which passport they were scanning but I can guarantee you that they would not be able to duplicate a US or Canadian passport with the method shown in the video.

[@maxel3g3nd]

Yeah you need the info on the index/plastic page to decrypt the initial contents. On top of that you also need the secret key for the biometric/fingerprint data, which is not known to the public as far as I know.

[@rainbowometer6266]

best protection is the wire

[@urmum3032]

Was the house the same one from that movie with nick cage i think it’s calls American treasure

[@Superb_virg]

i see how he lives in the middle of nowhere looool

[@gopi6162]

how does he learn this kind of stuff, though?

[@DFMurray]

Clearly a non technical person was the producer. "Get a shot of that switch...oooohh blinky, oh what's that? Get a shot of the Compact Flash card reader, that is hacker AF!"

[@alfredcornflake5032]

No, he is portraying how little, cheap, and common equipment you need to do something like this.

[@reecethegreat9983]

he looks like he works for some action movie criminal. Illegal guns (in the uk), big mansion, badass setup and quiet location...

[@ravan01d]

Awesome Castle.

[@josesaladin4355]

His location has been compromised

[@tezasrajguru5067]

how do i secure personal info like credit card number and password.

[@neverstop6088]

what OS is he useing?

[@AbdulMajid-bc6xf]

What if one day the system shuts off n no electricity to support it . Will it be lost all together n what then .

[@user-jx3if1xn7g]

Contact [phone] on whatsapp Or via mail@ [e-mail] (he does not take upfront payment) if you need help Hacking your PayPal, To fix your credit card, To fix your credit score, Western Union hack, To hack into your cheating husband phone, Bank account, PayPal, Instagram verification, facebook and many more.. His fast and reliable............

[@thtRussian]

What's with the text on the tv? 1:30

[@user-ml3wv2yw7f]

What program or windows user...

[@MemesnShet]

Just wait till when we get chips in our brain

[@limeslush1e]

are handguns legal in the uk? i thought you could only get a licence for hunting rifles

[@real_rivolta]

Please, I need the keyboard hacking video at 0:22 can anyone send me the original one?

[@PhattyMo]

Didn't expect to see him on Vice.

[@tweakfinals173]

"When the robots rule the world!" ? •o•

[@KennyChu]

1:35 lol Vice or a MB show

[@__.__.__.___]

wish the video was longer not just 6 minutes

[@afteriszaidzia5826]

what laptop dies he use?

[@andreiionut8100]

"This is where you do hacking" i instantly closed the video..

[@ozzyfromspace]

Well, if I start an advanced technology company one day, I bet you know who I'm hiring.

[@DroneHDTV]

passport is unbreakable now. get one

[@habbo3411]

holy shit, expect this guy to go missing in the following weeks. what he knows is unique, damn

[@maxel3g3nd]

No. Take off your tinfoil hat. If you want suspicious deaths, take a look at Barnaby Jack en.wikipedia.org/wiki/Barnaby_Jack

[@Stunk4]

easter egg spotted : all your channels are belong to us

[@Jack__Reaper]

With a premium rate number

[@fornello123]

RFIDs are one of my special-i-ties

[@tophinski]

He didnt even get her a seat.. Chivalry is DED

[@mrmalfunction8486]

Very cool

[@Thehardgamer64]

WoW it's beautiful the keyboard Apple ! :=)

[@eggycat]

Always wondered how these people begin learning their craft. I mean even now, there always has to be an informal teacher involved...

[@maxel3g3nd]

No. A lot of people learn by asking questions, and the best place to ask are IRC channels, hacker spaces, non-script kiddie forums, etc. When I want to learn something new, I look into what I know, and what I will need to learn. Then I start googling, to see if someone else has already written information about what I want to know/learn. In most cases, someone has already written or done something. In some cases, I have to do a bit, or a lot of extensive testing, depending on the information available. Generally speaking though, learning hacking has never been easier. It was a lot harder 10-15 years ago than it is today.

[@eggycat]

+maxel3g3nd Precisely what I said about their being an informal teacher, reading knowledge shared by other people. What I really meant was - even if you were the first 'hacker', you'd just simply be applying knowledge from another area of expertise, for example, electrical engineering.

[@maxel3g3nd]

___ I agree. However, it is possible to learn entirely by yourself without having read or viewed anything made by anyone else. But this slows done the learning curve tremendously in literally any type of craft, unless the craft is to collect sand on a beach. In hacking, there are many areas you can specialize in. Hardware hackers often have good backgrounds or a large interest in electrical engineering for example. Other hackers may have an interest in physics in general, and some may be your average hacker that knows a programming and/or scripting language or two.

[@RogueAI16]

Scary...

[@Nedtur]

This is so sad.

[@AndreAmorim-AA]

I see that ...Major got applied cryptography 20th anniversary edition

[@retardedbucket151]

Why does he live in a freaking castle?

[@armv7-m603]

rich

[@XYZ-km9kg]

Retarded Bucket he's not rich look at his setup.

[@wm4437]

Where t-shirt can buy

[@eleasar2181]

To be completly honest, the things that he did shown in video actually arent that difficult to do. I did this once at a hotel to gain acces to the spa area.

[@gamblezz101]

Is that David bomball lol

[@sekytwo]

I bet the passport trick is how Mossad was able to Duplicate all those passports used in the Dubai assassination. Pretty awesome stuff

[@wingsdesire1]

Lol he only promises me he does white hat work, you know a black hat would say the same thing right?

[@Ye4rZero]

Yeah Major Malfunction!

[@macmaxim2203]

Hello. Your job is so professional. I think you have good cooperation with many department. Because many department and government need same as you professional for all of kind job. And I think you have good incoming too

[@johndarren9559]

When the robots rule the world I only ever have to fool the robots

[@josephstrongbow5522]

You should contact David Winter via email at [e-mail] or on instagram at winter_aility_ or whatsapp on [phone]. He helped solve my financial issues. He would provide all legitimate services for you on your credit card, bank account, bitcoin, forex account, PayPal, G-Cash, credit score cash app, stimulus and many more. He does not take upfront payment and he is fast and reliable.

[@MrMoodyKSA]

who here went to defcon?

[@cheesyvin8078]

So sad that Mr Robot got cancelled.

[@Jakeykerr]

How tf does he have handguns in the UK 😂

[@midamultitool1387]

I wish I was a nerd.

[@CrazyGame1]

what is the os he is using

[@issedev9053]

The Terminal looks like Ubuntu.

[@betasquadextra]

he is on point

[@christianarichards8698]

faguli gfg For any social media hack, Bank transfer or top up on paypal or credit card contact [e-mail] trust me he will deliver your job within specific time and he's trusted and reliable.

[@incorrect1844]

Hence I dont use contact less

[@paski702]

Tutorial please! ^^

[@rehanrai7726]

So it's Watch dogs irl

[@Vibinator]

she has the old british passport, anything different with the new one?

[@Tom-kt8lu]

And how does he have a handgun in Dorset??

[@edgargarcia209]

i used to work with people cellphomes repairs and stuff, i always hate when girls like this one or even guys kept asking me if i would hack their phones, and i was always like seriously dude like who are you a secret agent that might have a secret map for a bitcoin treasure? jeeee.

[@hazwaz7166]

i thought hand guns were illegal in the uk???

[@wil-fri]

Goes with a hacker and let him scan her passport[get married]

[@loisnana5720]

Hi there for your softwares,credit cards, and facebook account hackings contact @king_pin95 on instagram he is a real professional and he will get the job done without any excuses He helped me hack my credit card and cheating boyfriend's account. You can also contact him on WhatsApp [phone] OR Email him at [e-mail]

[@Super_Cool_Guy]

I thought hand guns were illegal in the U.K ?

[@doucebigg3815]

He kinda forgot that we have machines such as lie detectors that measure blood pressure and many other variables, as well as facial recognition that when the robots are finally capable of ruling the world they won’t fall for a chip. unless you created a chip that says you’re an admin but even then they could tell you were lying.

[@thangchanh2932]

YEEEEE PENGUINS ON THE SCREEN

[@aim2986]

U know... The file is still recoverable ;)

[@TheMatthewDMerrill]

I thought that the chips were suppose to be more secure? Guess not.

[@WhoIsAmaze]

it's better than the magnetic strip on the cards but yeah

[@kobenoyashi3394]

Wow, I thought the chip was supposed to be more secure than the stripe? Why did everyone's bank just make them switch?

[@kelvins7879]

efficiency I guess? pay wave,so transport card so on

[@OpTicBossaru]

asked a banker this. The chip doesn't share some parts of the code with the register, hence it's much harder to steal info from the chip then from the stripe, which had all the data on it. Also stores are now required to use the chip instead of the stripe if the card has one. Or else if someone commits credit card fraud the STORE is liable, not the bank. That's why they are forcing everyone to the chip. Interestingly, I got a new card last month and it didn't have a chip on it.

[@kelvins7879]

+[MsR] Master what replaced the chip?

[@OpTicBossaru]

Kelvin Seah the chip is the new one.

[@DoughBoy45]

+Kelvin Seah Chocolate replaced the chip.

[@dominusandofortnite3904]

lol hacker u serious? :DDD

[@SheIITear]

Wat

[@romoalex]

he lives in a fucken castle who knew security paid so much

[@evanwilliamson5800]

Hundreds of thousands of dollars

[@RivenbladeS]

this way(credit cards being hacked) is how they are gonna tell us to get chipped

[@emmanuelirizarry5302]

Using ubuntu.....I was hoping for Arch 😞

[@flyffycotton2037]

he is in the jail after the interview for sure

[@LindsayKay]

This dude's in the UK and he's got a couple of pistols hanging on the wall?

[@crabraptorjesus]

Handguns are illegal to own in the UK.... How come he has a few

[@josenegrete8751]

My fav movie

[@protobelt578]

Is that Papa John in the thumbnail

[@sebastiannielsen]

Information in this video is false. Most passport have a embedded private key, that cannot be extracted or read off, that will compose a signature of a "challenge". This authentication CANNOT be spoofed. Also all information of the passport is signed with a certificate, which also means that even if you make a valid copy and the airport terminal don't make any "active" authentication, you can't use it to for example board a airplane as the biometric information wouldn't biometrically validate against you. And no, changing the picture or biometric information will invalidate the signature. (in most automated check-in stations that also allow you to board the plane without human intervention, you have to look into a camera, or put your finger on a plate, and it will compare against the information stored on passport) When we come to credit cards, these do have, according to the EMV standard, a challenge-response system too, so you cannot copy them perfectly, as the terminal will send a random challenge that the card replies with, and then respond to the bank with. Same applies to PIN, it will send the encrypted PIN block to bank for validation. However, store-and-forward ("offline") transactions is very unsafe, and can be spoofed with both false credit cards, but also real credit cards without using a PIN or signature. This is also why, if you are a store owner, you should disable store-and-forward if possible. Talk to your aquirer about disabling store-and-forward or "offline" transactions. In other words, the terminal wil then become unuseable without internet connection.

[@glyph8632]

*trust me I'm a hacker* Famous last words

[@Jack__Reaper]

Jesus that guy has an amazing house. Thats got to be worth fucking millions!?