Hacking Through the Air | Contactless Payments and NFC

[@kindlehaha]

I don’t get how this channel doesn’t have millions of subscribers. The videos are so informative and well-produced. Definitely underrated!

[@jeffbrownstain]

Channels not even a year old yet

[@I_Unintentionally_Morph]

I don't even want people to know this channel ,

[@honeybunny79]

@@I_Unintentionally_Morph why?

[@clawpa104]

For real

[@fireskorpion396]

@@I_Unintentionally_Morph why not? Are you a scammer? xD

[@AwokenEntertainment]

layers and layers of valuable information here 💡

[@sprinkles2765]

Fun fact: The foil between the card and reader doesn't necessarily need to "block" the signal, it just needs to soak up enough of the energy that's coming off of the reader to make the card unusable. This is fairly easy to do because of how little energy readers use.

[@ebermtheburn]

Thanks. I noticed a video trying to sell expensive "radio theft proof" wallets and came searching for an explanation. Luckily I found it here and realized that the people trying to sell you fancy wallets are the real scammers. There is no threat of someone stealing your credit card information by walking by you with a scanner.

[@Gaven7r]

I'm amazed at averything, and specially, at how high quality this channel's content is! Keep it up!

[@Sumsubcom]

Thanks for your support!

[@augustinasdoesarchitecture3900]

Are we just going to ignore the ever changing high quality spaces you film in?!

[@Pysslis]

Sumsub is a company, I guess that help in having access to all these filming locations.

[@Sumsubcom]

We are running away from the hackers trying to catch us, that's why

[@hb3393]

@@Pysslis no way?? This is all sponcon??? 😭😭😭

[@zucc4764]

@@hb3393 I'm not complaining tho. They're not in-your-face hard sellers. There doesn't even seem to be an agenda to these videos other than information. I didn't even know this till I read this thread. It's not deceptive imo

[@zekiz774]

@@hb3393 so what? what's so bad about this?

[@caladestine4540]

Your Russian pronunciation of the Kavrakov's full name was extremely good, was pleasantly surprised. Great breakdown, great vid. Keep it up

[@Mark-lu8ee]

Yea same, it surprised me too

[@at_oussama]

this channel must be the best one i subscribed to in the past 10 years alone

[@EfficientRVer]

Another great video. Maybe because I rarely do small transactions (no coffee shot habit here, thanks) I've actually never done a phone pay or NFC card transaction. Some of the grocery stores here in fairly average suburban and small city USA, don't even reliably read the chip on credit cards, and often then do work upon swiping the magnetic stripe! Likewise at gas (petrol) stations. Holding 4 different credit cards in front of a Chrismas laser array shows that 1 is totally opaque, 1 is almost opaque but allows some light (both green and red) through the borderlines of the CPU chip, 1 lets a bit of red show through the card, and one has its empty innards well lit up by the red array. But no NFC coil in any of them. I've never asked for an NFC version of my cards, but I've also not ever refused any offer where they push out new types of cards.

[@archygrey9093]

Generally NFC cards will have a symbol on them that looks like a wifi symbol, The NFC antenna won't always be a circular loop but may be rectangular or close to the outside edge of the card if you look with a light. Personally i've always found NFC to be the most reliable method of card payment, it very rarely fails compared to chips or magnetic strip (my cards have all three options).

[@hexstaticloonatic4194]

Recently got into programming basics and this channel has potentially set me on the route of cyber security and penetration testing (@John Hammond is responsible too though tbh)

[@tatka_5470]

You should checkout Live Overflow's channel! kzbin.info Specifically his older "Basics" series. You can learn a lot about many flavors of cyber security, he pretty much got me excited for it in the first place - I now work with browser security on a daily basis and I have to thank him for introducing me to it.

[@hexstaticloonatic4194]

@@kcnl2522 what do you mean? 😅🤔

[@hexstaticloonatic4194]

@@tatka_5470 thanks! will definitely check it out

[@hexstaticloonatic4194]

@@kcnl2522 the advice is very much appreciated, thank you kind sir! I've had trouble with that, my solution is to find one and only one tutorial/course i find interesting, when i do i put all other study topics on hold and just burn through that one course without dispersing my energy. Once I've completed it, only then do I go on to other things/topics/courses/tutorials. Keeps things nice and compartmentalised, and stops me wasting energy on a thousand things

[@ProudlyINDIAN360]

@@tatka_5470 thanks

[@stanleymakafui]

Stunning set design, everytime

[@itssooverweresoback]

This channel is god tier,fr.

[@notnth]

16:35 this instant transition to a perfect russian accent really caught me off guard lol

[@MissFoxification]

There's ways to extend the range on the card readers using certain antennas, people put them in backpacks and capture cards in small space like elevators. This method is useful for capturing cards to enter buildings, garages and the like. It won't be able to capture a smart bank card due to the configuration. It can however damage them, I do that to old cards I don't use anymore. Alas, as you noticed you can't capture more than one at a time, putting an old card behind the new one blocks both. Skimmers that go on the line between the bank and the terminal are still an issue.

[@nopeyep2089]

Hey, Im interested in learning how you did this and How its replicate able, Any way we can get in contact?

[@MissFoxification]

@@nopeyep2089 I don't put personal details on here or "break the wall". Essentially all you can do is optimise the coil. At some point amplifiers or filters just won't work as there's no signal there to boost. A lot of devices have deficient coils and you can usually get a bit extra out of it. They also have orientation and mere positioning can be the difference between getting a signal and not. There's a reason the readers on public car garages use massive coils.

[@jetseverschuren]

I disagree with a couple of key points. The main protocol of the bank cards, emv, is fully open. It's actually pretty easy to implement, I've done it for both contact (stick the card into a reader) and contactless (nfc). Furthermore, multiple stacked cards are definitely readable. The underlying standard (iso14443) has a built in mechanism to allow reading multiple cards "at the same time" (not exactly, it quickly switches between them), but since most people don't need it, it's often not implemented.

[@Tr3m0rz]

While i'd agree that for the most part the things he talks about in videos are not 110% Technically correct, I'd argue that is probably a good thing, the things he makes videos on are correct enough to make your average Joe re-think things. If he where to bombard people with all of the 110% Technically correct information. the average Joe would be half way through some other video before sumsub covered 5% of the Technically correct info. and at the end of the day most of his videos i have seen are aimed at making your average Joe more aware of things they may have taken for granted or not put much thought into.

[@jetseverschuren]

@@Tr3m0rz sure, but he's wrong on some fundamental points, which leads to a false sense of security. While a bank card is almost impossible to clone, it's not because two cars together can't be read. An NFC blocking waller is still important for a lot of other applications

[@Tr3m0rz]

@@jetseverschuren I really can't comment on the bank card thing, i'v never really done any research into them or their technologies beyond a cursory glance, i was more referring to his video's in general. Though i do agree that NFC Blocking wallets have their purpose, there are devices available for purchase, or diy build-able that will quite easily pull data from every person in an elevator or from a casual stroll past in a busy shopping centre for instance without needing to get close enough to warrant any suspicion from the targets, paired with some other similar devices one could take all of this accumulated data and load it onto a device capable of storing a great number of these and replaying them to any reader. I'm being intentionally vague with the wording of that, but i get the feeling you're more than aware of these devices.

[@piksler]

This is my favorite channel on youtube. Thank you for making such insteresting videos!

[@Sumsubcom]

Our pleasure!

[@cookbar55]

Excellent professional video very informative very impressed with the depth of research you have done and the way you present it including the comical inserts which I love. I feel I now know all I need to know about using my cards safely which I depend on so much many thanks much appreciated

[@tedclubberlane1638]

Usually your content is very up to date and informative on cutting edge tech. I had a nfc app on my Samsung galaxy s7 able to read through wallets in 2016…

[@FrangezM]

Yeah reading really isn't the hard part. No matter how good your reader is, you can only ever get the card number and expiration date - the card simply doesn't transmit anything else. The only place where that is useful is online, but there you also need the CVC and these days often a second factor (SMS/app code). Also, the point about multiple cards is still valid I don't know of any commercial NFC readers that can handle multiple cards.

[@garlicbread7344]

I am doing fyp of NFC security, I think the general of talking give me sort of idea on it. Thanks man, you're handsome

[@machinainc5812]

A shame this video got little views so far but this is what i call long term relevant content. Its not super time sensitive and very educational. Might even blow up in the future. Awesome video as usual

[@TripImmigration]

first time in your channel....such good quality. I'm living for..+ one subscriber

[@Sumsubcom]

Thanks so much! Welcome on board. :)

[@_GhostMiner]

X files theme song in the outro? 😃

[@velmu4463]

Spectacular Bradventure!

[@SpeedyGwen]

the thing that anoys me with nfc is how every bit of metal blocks its path, on my phone, I cant read one with the back of my phone because I have an aluminum heatsink and on the front glass it refuse to scan nfc tags and chips, its super anoying, my only consistent nfc reader is my nintendo 3ds and my left nintendo switch joycon

[@rokyo401]

Perfect opportunity for Ridge Wallet as a sponsor

[@aussiebob1315]

what a great channel i just found , love your approach cheers from NZ

[@purnasaimadala]

I always use 2 cards, one with no nfc that I use for larger transactions, and one with nfc from a different account that has very less balance

[@Sumsubcom]

Smart man

[@rapiddu6482]

Same I have limited credit card limit and also daily limit of contactless payment no matter how much unused limit I have. The only think that bothers me is that these card controls are wildly different from one bank to other. It's frustrating. I have a card that allows for daily limit but not per transaction limit. Another that does the opposite. I want both damn it. 😂

[@HagakureJunkie]

Brilliant breakdown, I sent this very video to my mother to alleviate her fears

[@CyberDevilSec]

Jesus this was before the flipper0 :') that is so beautifully done omg.

[@wavyseahill]

Greetings from Rīga! Nice video! P.S. we don't give tips by card, it's not possible here. Only cash, even if you paid by card for your order. And tipping is not so widespread as in UK or USA.

[@MichaelDude12345]

Oh my god the Black Books reference was 👌👌

[@OZTutoh]

I have a friend who told me she discovered several transactions had been made from her bank account from a city nowhere near us, while none of her bankcards had been stolen. The bank reimbursed her for the fraudulent payments and told her the thieves had used a "fake card". I couldn't understand how that could be remotely possible for the reasons given in this video. The only clue was that the transactions were small and over a short amount of time, like they were within the pay-wave limit. I don't understand how it was done! I looked into CNP transactions, but that's for credit cards. I was hoping the NFC reader you made would provide some clues.

[@filmaker256]

get the word out..use cash

[@OZTutoh]

@@filmaker256 going back to being a luddite doesn't help. The card, issued to her by her bank in person, STAYED IN HER WALLET THE ENTIRE TIME. It could have stayed locked in a vault in her home and she paid for everything down to her road toll with cash in person. It would not make any difference! How could a duplicate possibly be made?

[@coolnormalandwelladjusted]

It’s called contactless but 99% of people rub their card or phone all over the the thing anyway

[@Sumsubcom]

Yes I absolutely hate it.

[@E7ENEZER]

Bruuuh! This homie got me cracking up at 5am! 😂

[@steffm.4884]

Great content, just subscribed!

[@EstebanGM245]

Brilliant! Nice video, keep growing!

[@OmDahake]

Really nice explanation

[@Sumsubcom]

Glad you think so!

[@musakh_]

This guy really did his homework

[@hexstaticloonatic4194]

Dat audio clip at the very end though 😍

[@andrewsgarage796]

Very educational Bradley Best regards Andrew

[@Sumsubcom]

Thanks Andrew, I'm glad you enjoyed it.

[@rapiddu6482]

Here in India digital payment system is so ingrained you can basically max out your credit card limit in single contact less payment if you want. I am a student hence have small credit card limit of ₹25k but can do single 25k transaction if I really want ofcourse given I have usable limit.

[@harishannamalai8669]

What bothers me is that the Contact Less payment option on Credit Card cannot be disabled by the user. A thief stealing your purse can just tap and keep purchasing items on a whim within the limit. Now I just leave the card at home ,The nincompoops that run these companies don't understand that shoving features that customers don't need, just makes the customers not use it at all.

[@Xi_Jinping_is_Pooh]

They don't even need to steal the purse or wallet, they can just tap it. There are mobile apps around that can read card info (dunno if that is legal). You can test if it can read a stack of cards. Haven't tried it, but aluminum foil works it blocks nfc.

[@rapiddu6482]

What are you talking about? Lol. Every credit card I have here have card controls that too very refined controls as well. All credit card have card controls you can even turn off contactless if you really want. My card although also support daily limit as well which I have dropped to just 1k for contactless. You can even control the all spending limit. I have credit card that gives me limit of 25k I have limited that to 10k. Basically it is practically impossible to have credit cards that doesn't provide card controls. Contact your bank how to do it. Usually their usual banking app will work just fine unless ofcourse they have specific credit card management app. Usually they don't do it separately.

[@absolutium]

​@@rapiddu6482You cannot "turn off contactless" unless you substract the receiver from the card.. What you are doing os telling the bank to restrict payments from either the magnetic band or the nfc module.. But those physical containers still react to a signal.

[@gman83090]

Our Myki ticket system in Melbourne has that issue if you hold two cards together that have NFC it comes up on the screen with multiple card read

[@fromagperspective9428]

I never leave without my wallet Ive literally been detained and taken to a station for not having my ID on me but then Im Black. I was released 10 min after getting to the station but not driven back to where they stopped me just told I could leave.

[@FrancXPT]

Good job hope you get more exposure .

[@triularity]

Even if, in principle, they are secure, implementers are too often lazy, which can introduce implementation flaws or even design vulnerabilities (which take a long time to remove ue to compatibility). The fact that _any_ private data is being passed unencrypted (and subject to eavesdropping) is a red flag, when there is little reason establishing a secure link couldn't be a first mandatory step.

[@filmaker256]

Use cash anything electronic Is awful .

[@huggybare9]

Awesome content bro. Thanks

[@ejonesss]

the stores often threw the carbons in the garbage so anyone rummaging the store's dumpster could get the carbons and get the info. also stores had telephone directories of stolen numbers they would get on a monthly update and would have to look up the numbers. make it a standard at the credit card co side to always ask for the security code on the card and 2fa (if set up by customer) then even if the terminal does not support that the transaction will not work.

[@imark7777777]

A lot of this information is very UK? non-US specific. As in they went to chips far before we did and we still didn't implement them right when we did it. Most of the history is quite good. It's just that we still have actual magnetic strips and chips and tap.

[@Karlavaegen]

For me, expert at EMV and payment terminals, I can only enjoy your video :) Of course you are wrong in pretty much everything, but fine by me :) Security is what I care about, and this is a joke. I defend all

[@Mark-lu8ee]

16:34 that pronunciation was on point!

[@Charlie-js8rj]

So what you're saying is that someone could theoretically run Doom on their credit card chip?

[@Sumsubcom]

Yee buddy

[@j__m6081]

how does the usbmon work with the hydra and do you have a arduino or something with it also tutorial for the last parts :D

[@JesusLittleBear]

Time to get my Sumsub fix. Love this channel and Bradley, you are an amazing host to it!

[@Sumsubcom]

Thanks so much!

[@chidubem31]

The Knowledge never ends !!!!

[@Xi_Jinping_is_Pooh]

There are already phone apps around that can read card number and name using nfc. I worked for a card reader company before. I'm sure a malicious programmer who have worked in similar company/technology can make apps that can steal more info.

[@tyrinlowe]

Awesome video bro!

[@philomathicdude]

Happy to see ..🔥🔥

[@Maco_28]

video starts 20:34

[@fadedapollo]

Love your videos!!

[@Sumsubcom]

We love you too!

[@SpaceSponge]

I downloaded an app on my phone it lets me on select NFC cards tap on phone get full 16 card nber cvv exp other cards request my pin to access it. It's hit and miss

[@deleteduser3749]

Can someone post the link the the HOW I DO video where the guy puts magnetic dust on the credit card. Thanks

[@Sumsubcom]

Speak to this guy to join the dark side ^

[@I_Unintentionally_Morph]

Please can u use cookies be used go get your information ?? Eg credit card details

[@sixunity1171]

5:11 in Latvija we dont really give tips, our servers and bartenders get paid more then enough to live comfortably.

[@Sumsubcom]

Sounds perfect

[@piercedjeebus]

I can talk about this now, but a friend of mine figured out how the credit card companies create card numbers and the security numbers using an algorithm. She got paid but sadly was caught and passed away in Chesapeake city jail.

[@cinemaipswich4636]

If the government/business/police/etc: to go digital contactless via the use of a mobile/cell 'phone, then they must give me one for free. If I am forced to have I.D. then they have to give me that for free. If I must use digital to buy or sell anything, then they must give it to me for free. I will never use "contactless" readers. I live in Australia, and I will not let a cab driver force me to "Wave My Money Away". I never use the magnetic strip. I only use a system that requires me to enter my PIN code.

[@things-and-stuff]

Setting up Apple Pay is free for a lot of banks, and you can set it up even with a non-nfc card :) You just need an iPhone that supports NFC. (My 2016 iPhone 7 does)

[@VondaInWonderland]

I like banknotes and coins, they are filled with history and mistakes that can sell for more. Just think, you may soon have some with King Charles, making the one's you have now, with "The never to be equaled Queen Elizabeth" left to grab up in a frenzy ♥

[@lana.abdullllah]

Hey, thanks for existing, bye.

[@DaKrawnik]

Contactless doesn't transmit your actual card number. It uses alternates linked to your account for each purchase.

[@supernenechi]

People being scared of new things is normal, like you say. It's dumb when you don't try to understand it then. Thanks for the great video

[@jpierce2l33t]

As long as there are clever individuals inclined to break such security measures, they'll always eventually become vulnerable somehow. It's just the way things are 😁

[@Sumsubcom]

That's just the way it is 🎵

[@jpierce2l33t]

@@Sumsubcom whoa I'm all giddy I got a reply 🤣🤣. Love all your stuff, as a security guy myself, I completely realize the value in bringing this info to the people! It's needed now more than ever, keep up the good work!

[@shreeshaaithal-]

Can you make a video on how Machine learning is used in cyberspace or cybersecurity please😁😁

[@Sumsubcom]

Sounds like a good idea!

[@shreeshaaithal-]

@@Sumsubcom give a heart for the comment dude😂

[@imark7777777]

Bank Notes might be immune from power outages ( Best feature ever ) but tellers don't know how to make change.

[@filmaker256]

CAsh is best

[@Natty183]

Lmao

[@gerardus03]

I love your video, but beginning to talk about the title of the video at the minute 19 of 24 might seem misleading, doesn't it?

[@koolerpure]

had this happen to me once on the bus. dunno why the person that got the info bought cow skin rugs but atleast the bank took my side without a fight

[@WoetotheVanquished]

man, I could've told you that scanning an NFC credit card shows everything except the CVC (or pin, obviously). this isn't new.

[@nuclearnyanboi]

I just disabled contactless on my phone, and card

[@George-ps5]

Nice man 💯

[@hb3393]

It's all about the cameras isn't it. I always cover up my card number with my thumb when I'm making a contactless

[@annoythedonkey]

I’m kinda annoyed that the companies that make “secure wallets” deceive customers the way they do.

[@Sumsubcom]

Indeed

[@SunnyBeetle1922]

Guess what, if you use the Lloyds banking app, there is a section on there that shows your pin just in case you forget it. I’ve had to use it a couple of times. So the pin is stored. It’s accessible on your online banking app….

[@rapiddu6482]

This is exactly the situation where you will tire yourself explaining how nuclear energy is the most environment friendly and safest energy generation you have but they won't understand because of all the unnecessary paranoia they have.

[@gwine9087]

NFC, via your phone, today, does not send any credit card information, only a token that is useless, to a hacker.

[@omalaydrinks1847]

I Love this

[@FirstLast-fl7mo]

Not for payment but i've long been considering making NFC cufflinks (Okay, maybe more so RFID but the idea is the same.) but im too busy making soldering balls instead lol.

[@skiney]

Thank you

[@sarimbinwaseem]

0:13 the same key chain I have...

[@kodwanikennethmsosa]

Thank you Bradley

[@bvg129]

Like for perfectly correct pronunciation of Konstantin's name!

[@christopherellis2663]

The law in Romania 🇷🇴 insists on a receipt. 😊

[@neiltansey3041]

I personaly learnt nothing from this video. What works for me is, I only use contactless / phone payments in reputable establishments and, only debit from an account with the bare minimum in it and, have TWO low cash accounts from different banks. PLUS, as the young gentleman said, carry some 'emergency' cash.

[@user-dao]

love it hehe

[@sbcinema]

in germany, fingerprints are now stored in ID cards using NFC technology

[@IDontModWTFz]

Hold up. You can actually pull cc details with a bog standard android that has NFC built in but ok mate

[@GabrielHellborne]

And who DOESN'T stack several cards one behind the other?

[@avinashbhutra2229]

You should study about the UPI and OTP payment system of India. It is a brilliant technology handling billions of transactions everyday.

[@imark7777777]

Nope no contactless over here plus I'm planning on microwaving it when I do. I mean come on the ability to wirelessly transmit information seems like mag stripe scamming was so much more of a hassle. For you you might have to spend many years decoding a proprietary system with hidden flaws but let's say there is a $100,000 reward if you break it........

[@Xi_Jinping_is_Pooh]

There are already phone apps around that can read card number and name using nfc. I worked for a card reader company before. I'm sure a malicious programmer who have worked in similar company/technology can make apps that can steal more info, but this will be specific to a bank or merchant only.

[@csakdee]

Keep the jacket buttoned up or sit down... choose one

[@brano2yt]

Now you dont need the card, no need to copy it. You pay by phone or watch. So the scammer calls the elderly and pairs his phones with nfc and pays with them. Easy and nothing technically complicated. Only good talk to an less educated victim over phone "im from bank and need to confirm..."

[@Mihir_Lakdawala]

All World afraid of Hacking NFC Indians: Hold My Bear... Use UPI😂😂😂

[@sanderbakker]

1 million subs by the end of the year?

[@Sumsubcom]

We'll see, it's not looking likely!