Slashdot Mirror
To Secure ATM Transactions: Ditch the Card (securityledger.com)
chicksdaddy writes: Security Ledger has a piece that looks at the efforts of a string of startups to secure ATM transactions from skimmers and malware-based attacks. Step 1: get rid of the ATM card. The article profiles a couple different companies. One, Trusona, has technology that can uniquely identify standard issue ATM cards by analyzing the unique distribution of Barium Ferrite particles on their magnetic strips and using it to connect the card to the customer. The company combines that with card swipe biometrics to thwart malware-based replay attacks. The article also mentions upgrades that will allow banking customers in the U.S. to use a mobile application to withdraw cash from ATMs without a card or PIN, and a prototype from Diebold that combines proximity based sensing (via NFC) with iris scans to authenticate customers and authorize transactions. Cool as it sounds, its worth remembering that most ATM attacks are decidedly "low tech." A survey by the ATM Industry Association in 2015 listed "physical attacks" and those using "explosives" as the second and third most common type of ATM attack after card skimming.
You just have to choose. You can have any 2 of these 3:
Secure
Convenient
Cheap
You just have to make up your mind.
You can't skim a chip. Well, not with something that you can disguise on an ATM.
plenty of countries/companies provide ways of getting cash from an ATM without a card already.
Why not use a chip card instead ?
Seriously......
No chip and pin
No Paywave
No cardless ATM
It really surprises me..... I mean..you'd think they'd be on the ball..
They STILL write cheques for fucks sake !
Financially they're stuck in the early 90's.
Seriously, it's really surprising.........
The same guys who did the awesome voting machines? I'd trust my cash in their hands no questions asked! Or really not.
Chip and pin already solves this, it has been around for over a decade in Europe. No need to ditch the card.
I don't want my bank to have my "biometric data" or install spyware on my phone in order to be able to simply use my money as I see fit.
It doesn't sound cool. It sounds creepy. They should abandon their fascist dreams of controlling every aspect of life of their customers and get back to what we're paying them to do, keeping our cash securely and giving it to us when we request it.
Let's face it, ATM attacks are rare and most people are not affected by them. While obviously biometric data and whatever can be gathered from a mobile phone with a bank program would be sold to third parties because they see you as a resource to be exploited without bounds. Globalists should fuck right off and go die in a fire.
that's right, use your potentially malware-infested and backdoor-laden phone for controlling access to your money.
You guys at that side of the pond still use magnetic strips?
Just use standard PKI. It's secure, it's easy and it's standard.
Create a key pair for each customer. The private key is protected by a pass phrase (also known as a PIN code). Distribute the key pairs along with the bank's public key on a chip which does the encryption/signing.
Now go the the ATM or POS. Enter the card with the chip. Unlock the private key with the PIN. Let the card encrypt a message to the bank using the bank's public key and signed by the customers private key.
It's not rocket science. And to the end user it works exactly the same as before. It's cheap too.
This is your sig. There are thousands more, but this one is yours.
There is no way in hell I'm having biometric identification for anything. I'm not about to have my fingers cut off or eyeball pulled out so some some crook can make off with my stuff.
http://www.theregister.co.uk/2...
Damn fool idea and probably being pushed more for the use of such data to build a huge database by ye olde 3 letter agencies than for any "security" reasons..
Sky subscribers are morons. They pay to be advertised at !
ummmm, I seem to remember something about this company's decidedly insecure attempt to make voting machines.
redneck geek
The majority of the big banks in Australia have been offering these facilities or similar for 2+ years
Given the popularity of the Magstripe in the US, even after all these years, any advancement seems revolutionary I guess. One would think a possible reduction in fraud would drive even modest initiatives, like Chip+PIN adoption.
Area51 - We are watching...
With the increased deprecation of strips, attacks on the chip and pin cards will become much more economically viable. This will culminate in a breach at any number of firms and the leaking of assorted keying material that will put entire SWATHS of customers at risk all at once even if they never used their card in public.
See also; SSL/TLS, HD-DVD, Divx, Sat/Cable TV, Hardware OEMs, etc
The risk managers for one of the largest banks have decided that for this to work, your banking mobile app needs to track your location to know where you are and where you will go to prevent any ATM outside your immediate vicinity from using the code to withdraw money. Sure, it means no one on the other side of the country can make a withdrawal from your hacked account. But the USA PATRIOT Act also requires banks to spy on customers for the government (aka "Know Your Customer" provisions), so in addition to datamining your transactions for the government, do you really want them datamining your geolocation data too?
I'm working on the project, and I would never use this app.
You seriously think this is about preventing fraud? What are you, stupid? Look around you, our controllers are pissing their pants at the moment; desperate for more leverage before the shit hits the fan. I'll stuff their fucking gadgets down their throats and water board them until they swallow, any day now....
Step 1: get rid of the ATM. There, fixed that for you.
Ditch the card and use a buggy app on a phone susceptible to phishing, rooting, and wireless interception? How bout NO, you crazy Dutch bastard.
I know I'm old and a luddite and all the other pejorative labels of inexperienced youthful ignorance. But, I'm not ever going to bank by smartphone, or email. I'm also not going to pay by mobile. Its a pointless security risk that I'll never expose myself to because of laziness or susceptibility to the marketing of those that want to skim a percent or two form every transaction.
I have a discrete card, connected to a single account, with a password(pin) for certain transactions and it comes with legal liability limits against fraudulent use. Beyond the temporary inconvenience of losing my wallet, something that has yet to happen in 40 years and a risk that is shared by the smartphone solutions, my risk is compartmentalized to that card/account and not my everything.
As others already said: Diebold? WTF?
I don't know what to distrust more wrt security: Diebold or smartphones.
Actually yes: Diebold. But by a small margin.
It'll be a cold day in hell before I willingly give my biometrics to my bank, my government, or a private agency. For one thing, I can't change them if they get stolen.
Secure payments is a very solve-able problem. The only reason it hasn't been solved yet is the reliance on old technology and infrastructure. The two primary problems are a lack of instance validation, and static card information.
Here's one answer:
Bank issues card with a chip. The chip has the bank's public key and a unique private key that the bank installs on the card, then keeps the associated public key. Encrypt the chip key with a 4 digit pin, or a real password. Now the payment process is a public / private key asymmetric encryption process. The card chip encrypts the transaction details, and a nonce that the bank sends (encrypted). If you need to support offline card use, then every time the card is plugged in to an online system, have the bank send down 50 or so nonces that are encrypted and have the card chip store them encrypted locally. That way, if the terminal doesn't have direct network access, the card just uses and burns the next stored nonce. If the terminal needs to store information, it can wrap the card's encrypted information in it's own public/private key encryption that it passes to the banks.
The biggest remaining issue is key exchange, but in the case of the end user, that only needs to happen when they request a new card. For the the merchants, this can happen in the same process that handles reconciliation with the banks. They can exchange a list of merchant public-private keys as an extension of those protocols.
You give money to ATM.
While chips have been standard in Europe for some time, I'm starting to see more and more US businesses starting to use the chip in cards over the past 6 months, especially drug stores.
It is interesting though that many people do not have a PIN associated with these chip cards in the US, so it is still "authenticated" with a signature.
Sorry but I'd rather have my card stolen than some asshole gouge out my eyes just so he can civil-assets-forfeiture my bloody fifty bucks.
Get rid of the card
What if I don't have and don't want a smartphone?
Also, hasn't it occurred to anyone that this will actually make a 'cyber'-based attack easier?
Here's a better idea: How about you train banking personnel to be proficient at inspecting automatic teller machines for card skimmers and other physical exploits, and have them do it every time they service or reload the machine? In other words: How about better security? Also, how about multi-factor authentication at ATM machines?
Come on, people; every other day I read about some new exploit or security vulnerability on any type of smartphone you care to name, and now they want us to entrust access to the cash in our bank accounts to them? Really? Seriously?
Are YOU using the TOOL, or is the TOOL using YOU? Think about it!
The only reason people could possibly disagree with Electronic voting machines is because "Luddite", and not because there has been a long history of corruption made-easy by these devices.
Since this is the 2nd article in as many days on the same subject, basic math shows that there is no benefit in safety using a Phone vs. an ATM card. Both are a single point of failure, protected by a simple PIN (and last I checked Phones don't require PIN numbers). TFA hints at it: The majority of theft from ATM is by physical attack. It is not easy to install skimmers in reputable places, but it's pretty easy to stick a gun in someone's back and tell them to make a cash withdrawal. You won't hear much about the robbery stuff, small does not generate ratings or help the narrative along.
You increase security by distributing the attack surface and minimizing exposure. Using a phone to generate/receive a timed PIN for your ATM card would be more secure.
I would rather not tie bio metric data to the verification, and, it can not be checked effectively (consider how your body changes every time you eat something different, or use a different soap, etc..etc..). Too many things can go wrong with that, and again you are only changing the surface not extending the surface. "I have, I know" simply becomes "I have, I am".
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
I trust my debit card far more than I trust a mobile software application to interface with my financial accounts.
Under no circumstances will I use a mobile platform ( regardless of vendor, MS / Google, Apple ) to access my bank accounts.
Financial transaction alerts are pushed to the phone based on triggers I have setup, but I would never use a smartphone platform to log into nor perform a financial transaction.
In Mexico my bank already uses a mobile app to withdraw money from the ATM without the card, in the app you set the amount to withdraw and it generates a pin that is valid for 24Hrs.
Bad thing is that criminals spy on you and when you finish withdrawing your money they follow you and stole your money, no need for low/high tech only the good old fire arm.
In the US people are not used to PINs for credit cards. They have been present for years (tend to get used for cash advances
sometimes) but the situation is customers forget the PINs.
The reason for chip/signature is that it is believed customers will not remember their PIN and won't be able to use
a chip/pin card.
Remember too that EMV has all the complexity it has in the chip protocol due to a phone system that could not be used
to let the issuer verify a transaction. EMV dealt with that by allowing the card and POS system verify locally. That is
not needed in North America (at least in US/Canada). As for making cards hard to clone, the RFIDs used for nearfield
cards (e.g. Chase "Blink") are difficult to clone.
Neither is useful for e-commerce (yes there are major kludges that can in principle be used with an EMV card, but
with much inconvenience in use.)
So e-commerce is served not at all, and the EMV card is mostly useless where good phone or net service is universal.
The microdomain structure of a magstripe is indeed unique, but that does not make it impossible to clone, or even hard.
Remember, to read a magstripe, there needs to be a read head with a gap that reads the field. That is not infinitely
small...far from it.
If I want to read and duplicate microstructure, all I need is a read head that is narrow, and a medium that can record such
more-narrow patterns.
What prevents me from using a narrow read head derived from a video recorder (remember the old 8mm ones, for
example?) and maybe using videotape (again, how about the 8mm media?) to record the high frequency patterns?
This will not give exactly what the magstripe might have had, but will get it right for the part of the
signal that a reader can read. The video tape has smaller domains so it can replay the signal
pretty accurately.
If videotape technology did not exist, maybe a fine detail reader head could discern individual cards, but since
it does, it looks to me like cloning cards to forge details of magnetic domains would be fairly trivial technically.
So go ahead and invest many millions in that system, and watch it be massively forged anyway in
maybe 6 months.
Took me only a few minutes to see this. Why are these things again being proposed (I saw the proposal
maybe 10 years back)? Are they planning some radically different signal reading techniques?
Great idea, but not with that company.
Just another day in Paradise
In Poland we have system where you can use your banking app to withdraw money from ATM.
You launch the app, generate code and enter it into ATM. If entered code is correct your banking app will display name and amount of transaction and ask for confirmation. After confirming you can withdraw your cash.
Banking apps are protected by PIN or password and most people locks their phones. Code is single use and transaction has to be confirmed, so it's pretty safe.
Usually it's possible to configure banking app so it doesn't have to be unlocked for small amounts if you like.
This method can be also used to make payments in shops but it's more convenient to use paypass/paywave (contactless payment).
There are also some ATMs accepting contactless payments, so card cannot be skimmed.
A card sized microprocessor that does two factor authentication is a relatively reasonable cost. Interfacing them to existing machines could be done through the mag reader as an interface, or through a new interface. The problem with a new interface is replacing all the terminals to support the new interface, this is the problem that the chip based credit cards are facing.
Today the cards themselves are replaced so infrequently that I can't imagine cost being the driving force.
What we already know is that the chip based cards are really slow to authorize. There are other ways to design the architecture so that it can be secure without requiring a constant connection to a central database. For example if banks were to sign my credentials and public key that is present on my card, and the microprocessor internally holds my private key used to challenge and authenticate transactions, then the system would only need to refresh a database of all of the public keys for all of the banks it needs. Realistically that's less than 10,000 banks, and would easily fit in the storage available in a modern card reader.
(sorry for the armchair architect post - I originally intended to only show that there are many ways to solve a problem)
“Common sense is not so common.” — Voltaire
The solution seems obvious, why use ATMs at all? Go all digital or credit card.
Privacy is an illusion anyway in today's society.
Card skimming is much too piecemeal an approach.
The preferred technique (well over 100 uses in 2015) in Germany is to hook the ATM to a cylinder of ethylene, add a spark, collect the cash and scram.
This takes about 2 minutes and produces about 10,000E per application, with about 100,000E collateral damage.
Best of all, it is not vulnerable to changes in the card technology