How To Steal ATM PINs With a Thermal Camera

An anonymous reader writes "Researchers from UCSD have demonstrated how thermal imagery cameras can be used to steal customers' PINs (PDF) when you withdraw cash from ATMs. Their paper, entitled 'Heat of the Moment: Characterizing the Efficacy of Thermal Camera-Based Attacks', (PDF) discovered that plastic PIN pads were the best for retaining heat signatures showing which numbers (and in which order) were used by bank customers. Fortunately the methodology does not appear to have been used by criminals yet, but a third of people surveyed admit that they do not check ATMs for tampering before withdrawing cash."

Comments

Touch typing defense

[rwa2]

Hmm, I knew there was a reason that I rested all of my fingers uniformly across the keypad, gently caressing their every ridge and facet as I discreetly pumped out my digits into their PIN pad. Well, another reason, at least.

Also I try to think about a completely different song than the one that corresponds to the letters that correspond to the numbers of my PIN, just to thwart any brainwave phreaking attacks as well.

But still hoping we score some decent security measures out of this, like maybe a bank-issued gold card or something.

Re:Touch typing defense

[Herkum01]

I rested all of my fingers uniformly across the keypad, gently caressing their every ridge and facet as I discreetly pumped out my digits

Have you considered a career writing Harlequin novels?

Re:Touch typing defense

[nedlohs]

Just set the keypad on fire.

Re:Touch typing defense

[Not_Wiggins]

It looks likely you were mostly joking (so, that makes me feel equally bad about admitting this).
But, when putting in my PIN, I typically rest several fingers on different numbers, move my hand around, and punch my PIN in that way, obscuring what I'm doing (not the typical one finger, one press approach).

For me, it was about making it tough for someone with a video camera set up to watch the ATM to figure out what my PIN is based on finger movement alone.

I suppose to that end, would getting the heat signature really be that superior to having a video camera set up with a telephoto lens?
And if we were ever worried about heat signature, wouldn't simply wearing gloves defeat this "potential attack?"

Seems someone has figured out a complex way of collecting PINs.

Why not set up a loop of wire and, based on the different lengths of connection between electricity that flows from pressed keys to the processor, infer which key is pressed?

Right... it would cost more in time, money, and effort than one could make simply waiting for someone to walk up and rob with a gun.

Now get back in line.

[suso]

but a third of people surveyed admit that they do not check ATMs for tampering before withdrawing cash.

A person checking an ATM for tampering may look like they are tampering with an ATM. Now get back in line.

Re:Now get back in line.

[The Moof]

Not to mention that the average person likely has no idea what a card skimmer looks like when compared to the card reader on an ATM.

Re:Now get back in line.

[Joce640k]

but a third of people surveyed admit that they do not check ATMs for tampering before withdrawing cash.

Two thirds of them do? I find that very hard to believe.

Re:Now get back in line.

[kevinNCSU]

After looking at the pictures of scanners in this ( Consumerist Security Briefing from Gawker) I don't think I could tell even if someone put 4 ATM machines in front of me and told me one of them had a skimmer, pick it out. These things fit so perfectly over the card reader it seems near impossible to tell without pulling out a knife and seeing if you can get anything to pop off, and I don't think that'd make most places happy.

Wallet corner defense

[Anonymous Coward]

I use the corner of my wallet to to press the keys, let's see them work with that.

Re:Oh Sure, Academia Accepts THAT Paper

[Anonymous Coward]

And don't ever use Gamma Rays, you don't want the Hulk chasing you after you've pilfered his bank account.

Easy to Avoid

[tucara]

Just make sure you add a bunch of heat on all the number keys before you leave to mess up their analysis. I recommend urinating on the keypad to get a good even distribution.

Re:Easy to Avoid

[S.O.B.]

Urine is likely cleaner than what you normally find on ATMs. So you're doing a public service by "rinsing off" the keypad.

Thermal imaging? That stuff is fun and expensive..

[Lonewolf666]

Even as a usually law-abiding citizen, I might be tempted to steal that camera thingy if i find it. The fact that it was put there by criminals would greatly reduce my pangs of conscience ;-)

The Efficient Method

[syntap]

Isn't it cheaper to simply mug the ATM user after they are done and take cash while out of sight of the ATM machine's own camera? You'd have to do that anyway to get the card from them. Why get all technical?