Slashdot Mirror
Criminals Use 3D-Printed Skimming Devices On Sydney ATMs
AlbanX writes "A gang of suspected Romanian criminals is using 3D printers and computer-aided design (CAD) to manufacture 'sophisticated' ATM skimming devices to fleece Sydney residents. One Romanian national has been charged by NSW Police. The state police found one gang that had allegedly targeted 15 ATMs across metropolitan Sydney, affecting tens of thousands of people and nabbing around $100,000."
It's about time that US banks caught up with the rest of the world and put chips on all their cards, then we can finally get rid of the magstripes.
While chip&pin has it's security flaws it's way better than the 20 year old magnetic stripe system, in Australia and most of Europe the only reason they still put the stripes on cards is because the cards have to work when people travel to the US.
It's been at least a year since I've seen a reader without chip support in Australia and the only time the magstrip is used is when the chip or contactless read fails.
Many criminals are hard working too.
---- Booth was a patriot ----
I read stories like this that try to diss the use of "3D Printers" as if somehow banning the use of those devices is somehow going to stop criminals from engaging in acts like this. What utter nonsense.
How many other stories about ATM skimmers emphasized any of the tools used to make the devices used to make their devices? Why such a strong emphasis on the 3D printing technology? It sounds like a cool buzz word, but means absolutely nothing other than an attempt to make something new sound frightening because the reporters and police officers involved don't have a clue about how the technology works.... therefore it must be some kind of dark magic that must be brought before the Inquisition and those involved banished to Hell (or some equivalent).
While I don't mind seeing stories like this on Slashdot as it does talk about emerging technologies and their impact upon society as a whole, it still turns my stomach to see such awful reporting overemphasizing the manufacturing technology (it was the lead paragraph) instead of describing what people were doing first. Had the technology being used been mentioned much further into the article, I think it would have been much more appropriate.
People should not lose any money when their cards get skimmed... However, when you find out, and contact your bank, they will immediately block your card, meaning that your access to cash is a little more difficult. Also, it may take several days until you get your money back. It's not the end of the world, but it surely is inconvenient. And therefore, people are affected too.
That they used 3D printing device, is hardly interesting news. That’s just more 3D printing hype. What I find fascinating with this story, is that card skimming at ATM still works, today, in 2013.
It’s clearly a failure to implement the most basic security and authentication features, which are widely available today. How can it be that, today, one can still do any kind of transaction with only a card number and a pin – if a pin is needed at all (eg. For online transactions).
They (the banks and/or credit card companies) try a lot of fancy things like nice holograms on ATM machines or abstruse authentication methods that fail to understand that a simple password is about as safe as the card number itself. This PIN skimming thing is the proof of that.
It’s slowly getting better, with unique number generators for validation or unique numbers sent through SMS. But I hardly believe these solutions are optimal for the users. Perhaps this explains why their implementation is so amazing slow – although I believe it still better to have those as none at all.
As you have pointed out, European 'Chip-and-PIN' Cash-Card Security have already been cracked by criminals.
And fair enough, generally cards with chips are still more secure than their magnetic counterparts.
What I am more disturbed about is, from the point of the consumer, it appears that in Europe at least the supposed security of the chip and pin system have been (ab)used by banks to deny refunds to their defrauded clients.
From the POV of the consumer, I would not favor the use of this newer, more secure system if it shifts the burden of fraud on me with the excuse that "it's unhackable, you must have given them your PIN".
Nonexistent when compared to Wall Street extortion and foreclosure fraud.
$100,000 PFFT!
“He’s not deformed, he’s just drunk!”
In other words, they didn't build those skimming devices?
That would be somewhat more likely if this were a story about petty crime like pickpocketing or car theft (but even there, some amount of ethnic Romanian immigrants are perfectly capable of engaging in petty crime). But when it comes to crime involving computer exploits, they are considerably more likely to be ethnic Romanian and not Roma. For example, this Wired article about online theft involves a number of young people who are not Roma .
Living in Romania myself and seeing it treated like a pariah abroad in spite of the fact that some parts of it are among the best educated and cultured parts of Europe, I am used to the tendency of many to blame the country's ills on the Roma, but good and evil is inside of everyone ethnicity.
This "Romanians = gypsies = criminals" connection is also dangerous one, as it can really mislead people about moving populations in Europe. I spend a lot of time in Finland, and I watched as one community lamented a large Roma tribe that flooded their town each summer, begging, pickpocketing and recycling. They called them "the Romanians" and that formed everyone's opinion about the country. When I tried to start a conversation with one of them in a queue at a supermarket's bottle-return machine, it turned out all of them were from a small town in central Bulgaria. But for some reason, Bulgaria never gets rubbished half as much as Romania.
There's a lot of much simpler security measures that work a lot more effectively. Every time you hear someone come up with elaborate digital security, you have to go back to thinking of basics. Security is simple, and overthinking it is the best way to make it even worse.
Put ATM's in secure places. In the UK, they are almost always just out on the street where anyone can shoulder-surf your PIN. Like in Europe/US put them inside a room that is controlled and monitored.
Make ATM's show you what they should look like. All the time, the ATM should just show you a picture of what it SHOULD look like. This picture should move / flip every now and then so you can see if someone has tampered with the screen. A quick glance and you can tell if that random bit of green plastic on the card slot is SUPPOSED to be there or not (this pisses me off even with genuine ATM's and I don't use them if they have those green slots).
(Incidentally, why do credit card terminals, which have to talk to the bank, not send the card number - or some identifier from the card - to the bank, which sends back a PHOTOGRAPH of the CARD HOLDER which the genuine merchant can use to verify, at least in part, whether it's their card or misuse. Unfakeable, as the photo is from the bank, not from the card, so genuine merchants would be able to spot even wives using their husband's cards - which is still technically not allowed, but is currently ignored. Fuck Chip-and-PIN, give my photo to every merchant I use my credit card with so they know who is me and who isn't and can query if they are uncertain).
Put a shutter on the card slot. When the card is needed, open the shutter. When it's not, shut the shutter. Make it so that ANY device on the card slot would stop the shutter shutting, and this in itself would cause the ATM to disable itself and alarm. No worse a chance of losing the card for the customer than those ATM's who haven't been serviced in a while and the motors barely have the strength to push it back out.
Make fucking cards that can't be "skimmed" and that - without the PIN - are useless. This isn't difficult, and what Chip-and-PIN was always supposed to solve. Then you can skim my card to your heart's content because without my PIN being entered correctly NOTHING happens or provides useful data (we've already sacrificed mag-stripes, so this is no great burden as the cards should ALREADY be useless without the PIN).
SEND SMS MESSAGES to users on every use of their card. Almost every European bank already does this (except for the UK). My Italian girlfriend gets a text within seconds of touching her card anywhere, even in the UK, with details of the transaction. Her dad, too, when he was over here and bought £10 of stuff in a hardware store, and we were able to tell the SHOP STAFF that they'd duplicated the transaction by mistake because he got a text before he even got his card back.
Simple things. Put the cardholders back in control of their cards. The only reason NOT to is that you make money somehow out of not doing this. I can't believe billions of pounds worth of fraud isn't incentive enough to do things like send texts to cardholders, or put little motorised shutters (like some ATMs used to have anyway) on the card slot.
It would also be more likely if the person arrested wasn't described as a "Romanian national" by both the summary and the article.
Not to mention technically accomplished. They should apply for grants instead.
Romainians are NOT Gypsies. The Roma people are the peoples called Gypsies who originated from India.
Wait, the point I was trying to make is that not all Romanians are Gypsies otherwise known as Roma people, a subgroup of the Romani people. I never claimed anything. I merely pointed out Gypsies are Roma peoples. Maybe I needed to spell that out better.
In many parts of the world it is often mistaken that Roma = Romanians, meaning all Romanians are mistaken for Gypsies.