Welcome to the first issue of this...paper 'zine...article...flyer...I don't even know what it is. Anyway, after getting back from DefCon, I've gotten all psyched up on the teaching aspects of hacking, so I am going to try my best to make these little flyers every month and distribute them at the L.A. 2600 meeting and on my web site. Who knows? Maybe they will become really popular, or maybe they will go the way of most e-zines: I'll get tired of them in a few months and quit.

DefCon IV Caravan Recap

http://www.netninja.com/caravan/recap.html

With this report, I am not trying to uncover new, unexplored territory on the hacking frontier. I am just trying to relay some important information from reliable sources that might be of use to information and security specialists. The usual disclaimers apply...this information is presented for informational purposes only, to better your understanding of the way the world works. It is not intended for illegal activities; and if it is used for illegal activities (and you get caught) I take absolutely no responsibiliyt

This month: the format of credit cards. I have heard from so many people that a million different things are stored on the magnetic strip on your credit cards and ATM cards. Everything from your account number, to your name, to your current balance. This paper is intended to dispell some of these myths. The following information is publically available...

First off, I really have to apologize for the look of these two pages. I scanned them in from a not-too-clear source, so they looked rather blurry. Then, I used Photoshop to re-write some of the text to make it more readable. I left the underlying text to make the document seem less "doctored," but the combination of the underlying (blurry) text and the compuer-added text makes things a little nasty. Anyway, check below for the HTML transcriptions
Page 1 in HTML format	Page 2 in HTML format

The magnetic stripe layout for the Financial Transaction Card (FTC) is shown in the second page. Track 2 is the primary recording for FTC use. The PAN, or Primary Account Number, is the definitive identifying number for both the card issuer and the card holder. The PAN for interchange of cards consists of the following:

1 digit	Industry code for the issuer
5digits	Issuer identification
12 digits	Customer identification number
1 digit	Check digit for the customer account number
19 digits

The Track 2 content and purpose are as follows:

Primary Account Number

(19 digits mximum): Identifies the isser industry, the issuer, and the user identification number, with the latter having a one-digit check value.

Expiration date

(4 digits in year/month format): The date after which the card will not be accepted unless approved by an authorization transaction

Offset or PIN parameter

(Optional 5 digits maximum): This data allows a local PIN value check without issuer database access when the PIN value is checkable against other information such as the customer primary account number. [Enigma's note: It's important that you understand this...it is NOT the plain-text or even encrypted PIN number of the account. At one time, in the past, your PIN number was based on a mathematical extrapolation of your account number. You couldn't change it. Today, you get to pick your own number, making this field obsolete for its original purpose. The PIN is not available from the mag strip. I was not able to find the specifics on such short notice, but from what I recall, the 4-digit PIN number that you enter at a keypad is mathematically hashed with either the data in this field, or with a value supplied in real-time from the bank. The result is then sent to the bank for authorization. Sorry. You can't "read" a PIN number from the card.]

Back to the main page.