Slashdot Mirror
Crooks Hack Music Players For ATM Skimmers
tsu doh nimh sends in a report that criminals increasingly are cannibalizing parts from handheld audio players and cheap spy cams to make extremely stealthy and effective ATM skimmers. These are devices designed to be attached to cash machines to siphon card +PIN data. "The European ATM Security Team (EAST) found that a new type of analogue skimming device — using audio technology — has been reported by five countries, two of them 'major ATM deployers' (defined as having more than 40,000 ATMs)... The basic method for conducting these attacks was mentioned in a 1992 edition of the hacker e-zine Phrack (the edition that explains audio-based skimmers is Phrack 37)."
But we really need to do something about this whole security thing.
Personally I’m all for a one time password key token type device. You have a little key fob dealie generating numbers via a stream cipher at an interval (and with a key) synced with your bank. Once a pin is used, it is invalidated, so an attacker would have to skim the code, than use it before you punched it in. You could even combine it with some kind of traditional pin or even biometrics if you want to be all new age, giving you the very trendy “3 factor authentication”.
Heck you could even automate the first bit with some kind of challenge/response system.
This isn’t a radical or new idea.. people have been talking about this forever, and a few systems like this have actually been implemented.. but I don’t get why this isn’t wide spread yet? Are there vulnerabilities, user issues, or is it just a case of “cheaper to fix the problems reactively than prevent them”?
As has been said, security is a trade off of convenience. But I think money is one area people might be willing to put up with a slightly more cumbersome process.
Just carry a ballpeen hammer around with you. Before inserting your card, take a couple of good hard swipes with the hammer. Skimmers aren't mounted solidly, and the rest of the machine is pretty much unbreakable.
- None can love freedom heartily, but good men; the rest love not freedom, but license. -- John Milton
http://en.wikipedia.org/wiki/Zero-knowledge_protocol
It's possible to make an authentication scheme which is completely immune to skimming attacks.
i replied to a starwars post as the 3d poster -- then the starwars post disappeared
"I don't pitch OpenSUSE Linux to my friends, i let Microsoft do it for me
Home taping is killing ATMs.
Not crooks: Geniuses! :-)
Phrack, nice. Only been a decade since I've seen a Phrack reference. Probably got some Phrack printouts with some 2600 mags in a storage bin somewhere. I wonder what the modern underground magazine of record is nowadays
Wasn't this exact method(COTS audio recorder + playback attack) used in Wargames? Circa 1983?
If anything, the only surprise here is that criminals were ever not taking advantage of cheap MP3 player/recorder hardware. The economies of scale with your basic anonymous fleabay-special "designers MP5 player" are stupendous, and most of the (comparatively) difficult stuff is in software, which is an easier trail to hide...
Insightful? Uh, it was supposed to be a joke. Please don't actually do this. As someone else mentioned, just tug on the thing.
- None can love freedom heartily, but good men; the rest love not freedom, but license. -- John Milton
Here in Canada the ATMs they do the same frequency and length of "beep" for all keys, it's a simple audio feedback to let the user know the key has been pressed and registered properly.
Do ATMs in other countries do different tones for different keys? If they do, that's just insane.
I have one with my bank (Bank of America). It is a credit card, or so it appears at first glance. Looking closer you notice it has a smart chip in it and that the 6 digit number in one corner looks a lot like a segmented LCD readout. It is actually eInk, so it doesn't draw power except to change. Squeeze the button, it generates a new code. My online account is set up so that is required to get in, as well as a password. However the ATMs for the same bank take no note of it. That just uses regular debit card and pin.
Maybe the ATMs just aren't compatible or something, I dunno. Seems silly that the bank would push this new security feature but not use it for ATMs.
I read the linked Phrack file (brought me back to my BBS days), interesting read. Here's the relevant passage. Note the bolded text:
Not all magstripe cards operate on a digital encoding method. SOME cards .5 the freq of
encode AUDIO TONES, as opposed to digital data. These cards are usually
used with old, outdated, industrial-strength equipment where security is not an
issue and not a great deal of data need be encoded on the card. Some subway
passes are like this. They require only expiration data on the magstripe, and
a short series of varying frequencies and durations are enough. Frequencies
will vary with the speed of swiping, but RELATIVE frequencies will remain the
same (for instance, tone 1 is twice the freq. of tone 2, and
tone 3, regardless of the original frequencies!). Grab an oscilloscope to
visualize the tones, and listen to them on your stereo. I haven't experimented
with these types of cards at all.
Only being used with outdated equipment where security isn't an issue? This was written in 1992! Assuming the format hasn't changed much on these new systems, why the hell are ATMs now(still?) using this format?
Lots of comments here about "OMG they're recording the sound of the keypad" or audio tone encoding on the cards, which is silly. It uses a magnetic head to read the stripe, and just records the flux as audio instead of digitally. It's not a bad idea really, though not terribly new - just a different method of recording the same data, which is ultimately just a bunch of 1's and 0's relatively timed to how fast you slide the card through.
Nothing is recording audio of your keypresses (which usually are just monotone anyway) or decoding tones from the card, and they still need video to record your PIN at least for now. I had a thought though, if you could somehow cheaply scan the heat from the keypad after the user has left it could be useful. Covering the pad would eliminate video, but you have to jam on those keys so hard most of the time that there is going to be latent heat from your fingers; just rate the heat of each key and you have the order and position. More expensive, but nearly impossible to defeat.
see, if you carry the ballpeen hammer, you don't need the credit card...
good luck getting on the plane with that, though...
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
I have seen designs of ATM that make attaching card skimmers harder yet too many ATMs (even brand new ATMs) are of designs where attaching skimmers without it being obvious is simple to do.
Its not rocket science to design an ATM that makes it harder to attach a card skimmer or more obvious that one has been attached.
You can also add covers of various to the pin pad so its almost impossible to see the numbers being keyed in if you are shoulder surfing or have attached a hidden camera to the ATM. (and I have seen ATMs that have such covers).
These are not the articles you are looking for.
-- I have a private email server in my basement.
Might it help to make card readers transparent - so there's nothing but clear plastic and a very small read head with some wires leading off into the ATM?
Then if you ever see other electronic cruft surrounding the read head, or see a non-transparent reader, you'd know to be suspicious...