Slashdot Mirror
Graphics Programs Uncover Secret PINs
Errtu76 writes "The BBC is running a story stating that, among other programs, The Gimp and Photoshop have been identified as possible tools for uncovering PINs via the mail." From the article: "The researchers collected lots of so-called Pin mailers and then tested how secure they were. Many were defeated using bright lights shone at an angle on to the paper. Other Pins could be read by scanning the letter and then adjusting some of the image qualities in popular programs such as GIMP, Adobe Photoshop and Paintshop Pro."
OMFG the Gimp icon just looked at me
Now, if only they'd make a program that let's me remotely break into people's mailboxes and steal their mail. Then I'd be all set.
No one knew until now that scanning a document in black and white and adjusting the black/white threshold value can make it easier to read marginal text? Wow. Sounds like a patent application to me. Whatever.
The NSA: The only part of the US government that actually listens.
Hopefully though, this discovery will further bring to light all the lax security that companies that control our personal information have. It would be nice to see data brokers and banks start to care about security a little more.
And the fact that if your info gets out and someone exploits it, it is such a hassle to clear your good name/credit.
That being said- locks only keep honest men out... In the military locks are known as "delaying devices"
If someone wants your info, and are willing to break out the scanner and start graphics manipulation to get it, well, they are likely to get it. But wouldn't it just be easier to hit strangers about the head with a sock of nickels and take their cash?
And All I Ask is a Tall Ship And a Star to Steer Her By
And hence the reason for sending the pin seperately from the card becomes clear.
Nothing to see here... yet again.
If someone owned a convience store, wouldn't it be possible to scan the un-scratched tickets looking for the "big winner" without having to pay for them all?
Me, whenever I get one of these things I either shred the bejesus out of it or store it in a secure place. I NEVER trust the trash for things like this, or even receipts from places I use my credit card. Lots of them still print the whole number on the paper. :/
"I'm a leaf on the wind. Watch how I soar."
-Hoban Washburn
The existing patterned ink method was adopted because of cost, but really, tacking some mylar onto the form would be cheaper than tacking those thick plastic fake credit cards into those credit offers they flood you with. Yeah, I know: marketing budget can afford fake credit cards but the operations budget can't afford mylar for security.
[
To carry your ATM card in tin-foil faraday cage because it can be read by a device hidden in your office elevator ?.
PIN codes are just there to protect a person's card from random pickpocketing. Also this "exploit" needs access to the mail containing the PIN , before the user reads it and changes it. It is very unlikely that somebody will be able to do this easily - the obvious suspects being your kid brother who signed for your credit card when it came at your home and your shopping crazy sister. It needs very clear physical access on day-to-day basis.
This belongs in the same category as mothers steaming opening letters - maybe you should read Saki's shock tactics about how to handle that scenario.
Quidquid latine dictum sit, altum videtur
The key point of this article (before the industry response) is not about some great new way to use photo editing software to steal someone's PIN number. The majority of it discusses the dangers of using new methods of mailing PIN and passwords that can be read by the HUMAN EYE, sometimes with no more technology than the ability to tilt the paper and shine a bright light.
The problem is not with the gimp or photoshop, but poor printing techniques that could put your 'secure' password information at risk with the simplest of methods. It still deserves a mention in YRO because I've even had a few letters mailed to me with PIN information like this. The letter had already been partially broken on one side due to handling, and I could see the PIN in the sunlight through the thin sheet even though that thin sheet is meant to let you know if someone has tampered with your information.
Perfecting Discordia
www.stevenvansickle.com
I don't understand the practical applications of this attack outside the realm of academia.
So they can steal your mail? If they've stolen it, why not just open it and read the pin?
If someone is targetting you to steal your money, they would have to steal the pin number and then check back every day to see if the card came. Doesn't seem very practical to me.
I can see them taking the same attitude towards PINs. Any abuse must be the customer's fault, since no one else could have known the PIN.
Mea navis aericumbens anguillis abundat
They were able to see through the enveloppe obfuscation using a slide projector as a bright light (and undoubtely a fair number of aspirins).
An even better way of reading the PIN is to open up the envelope and look inside. One doesn't even need a computer for that.
Yes, that's right... Big, powerful headline... Why not just say something like:
"All your pin are belong to GIMP!"
This has nothing to do with the graphics programs and everything to do with bad-quality printing methods.
"The amount of intelligence on this planet is a constant. The population is growing." -Cole's Axiom
Wrap the PIN mailings inside bank notes. All these programs should have banknote scanning prevention as Uncle Sam mandates, so covering the mailings inside of bank notes should solve the PIN theft problem. If this causes the currency theft problem to rise, we can simple wrap the currency inside gold leaf.
Haha, probably. But then the mods were also redundant by modding it as redundant twice :p
Send email from the afterlife! Write your e-will at Dead Man's Switch.
When did a criminal get this sudden hit of "oh my- what am I doing- I can't _OPEN_ this letter! I'll just scan it and see what i can find". This is someone who already intercepted mail and is about to commit fraud. Just open the envelope and call it a day.
FYI: From the Canada Post Corporation Act
when you see the word 'Linux', drink!
I just discovered that duster cans (those little cans that blow dust out of your keyboard) when turned upsidedown will blow coolant.
Aim this coolant at a sealed envelope and it makes the paper transparent.
meh
In the immortal words of Dr. Nick's Diet:
// On my way to the ATM machine.
"If you're unsure about something, rub it against a piece of paper. If the paper turns clear, its your window to weight gain!"
Have fun eating greasy chicken and stealing PIN numbers
/ Thats right, I said PIN Number.
Or how about "Built on NT Technology" right in the win2k startup screen.
Kiteboarding Gear Mention slashdot and get 10% off!
How else will we access our accounts in the ATM machines, other than by putting in our PIN numbers and reading the LCD display?
Quidquid latine dictum sit, altum sonatur.
With all the fuss over identity theft and so forth, I propose SPIT ( Spit on PDA Id Tracking )which boils down to a Pocket PC's which you SPIT on. After your spit has been authenticated, you can use your snot key to decrypt all documents which were previously paper based!
Please feel free to contribute your own spit to this new project.
You edit curves and drag the centre of the curve down a bit I believe. Also useful for reading notes on the page underneath the one they were written on.
In the book "Spy Catcher" (late 80s) an ex-MI5 guy writes the various ways they used to read the contents of letters without opening the envelope. One clever was was to use a long, thin strip of bamboo to "twirl" the letter around inside the envelope and read it as it was 'scrolling' by.
Other, easier ways include spraying the envelope with automotive-freon. The envelope becomes transparent while wet, and within seconds the freon completely evaporates.
Other inventive ideas: Use a strand of high quality fiber optics to have a peek inside.
Point being, wouldnt it be far more sensible to NOT include the PIN ?!?! Duh.
The only PT Boat Journal on the web: http://www.PT171.org
is for GIMP and Photoshop to be found illegal under the Patriot Act...
Well, I'm going to opt to mod myself down a bit on that one. Always a good idea to RTFA before posting, heh. Apparently these pins are for ATMs, and thus, pretty much makes (most of) my above post irrelevant.
I was thinking of the security pin located on the back of most credit cards.
In this case, then, I'm in full agreement with the parent of my original post, though this is something that should be fixed... possibly through online pin activation:
Mail someone a temporary pin they have to enter online to get a one time view of the real pin. After the first view, no other views allowed. Thus, you really wouldn't even need that much initial security in the mailing, as no two people could view the pin, and if a second view was attempted, the issuer could be alerted to potential fraud.
I8-D
Why don't they just use non photographic blue ink? It won't show up on xerox's and near impossible to make it show up properly on a scanner, especially if it was obfuscated by the envelope. If no one here knows, you can get non photographic blue pencils, comic artists frequently use them so the inker doesn't have to do as much clean up before they start doing the color layers.
I knew this article would eventually make it to slashdot after i saw the rare mention of the GIMP in mainstream media...
Man... I really hate those TLA acronyms...
Ubuntu is an African word meaning 'I can't configure Debian'
Prime numbers are exactly what Alan Greenspan says they are -S. Minsky
The report (PDF 767kB) deals with the type of PIN mailers where the PIN is printed on the top layer of the paper, but there is a "scramble pattern" underneath it which prevents you from reading the PIN. The scramble pattern is either peeled away or scratched off. If you can pick out the difference between the toner and the scramble pattern you can read the PIN.
I guess what you are talking about is where the data is printed then covered with a scratch off layer. This technology is common for lottery cards but I have never heard of it being used for PINs. Here you need to see through this layer to get at the data underneath, so the tricks mentioned in the report won't work.
(I am one of the authors of the report)
Steven Murdoch.
web: http://www.cl.cam.ac.uk/users/sjm217/