Slashdot Mirror
To Secure ATM Transactions: Ditch the Card (securityledger.com)
chicksdaddy writes: Security Ledger has a piece that looks at the efforts of a string of startups to secure ATM transactions from skimmers and malware-based attacks. Step 1: get rid of the ATM card. The article profiles a couple different companies. One, Trusona, has technology that can uniquely identify standard issue ATM cards by analyzing the unique distribution of Barium Ferrite particles on their magnetic strips and using it to connect the card to the customer. The company combines that with card swipe biometrics to thwart malware-based replay attacks. The article also mentions upgrades that will allow banking customers in the U.S. to use a mobile application to withdraw cash from ATMs without a card or PIN, and a prototype from Diebold that combines proximity based sensing (via NFC) with iris scans to authenticate customers and authorize transactions. Cool as it sounds, its worth remembering that most ATM attacks are decidedly "low tech." A survey by the ATM Industry Association in 2015 listed "physical attacks" and those using "explosives" as the second and third most common type of ATM attack after card skimming.
You just have to choose. You can have any 2 of these 3:
Secure
Convenient
Cheap
You just have to make up your mind.
You can't skim a chip. Well, not with something that you can disguise on an ATM.
plenty of countries/companies provide ways of getting cash from an ATM without a card already.
Why not use a chip card instead ?
The same guys who did the awesome voting machines? I'd trust my cash in their hands no questions asked! Or really not.
You guys at that side of the pond still use magnetic strips?
Just use standard PKI. It's secure, it's easy and it's standard.
Create a key pair for each customer. The private key is protected by a pass phrase (also known as a PIN code). Distribute the key pairs along with the bank's public key on a chip which does the encryption/signing.
Now go the the ATM or POS. Enter the card with the chip. Unlock the private key with the PIN. Let the card encrypt a message to the bank using the bank's public key and signed by the customers private key.
It's not rocket science. And to the end user it works exactly the same as before. It's cheap too.
This is your sig. There are thousands more, but this one is yours.
There is no way in hell I'm having biometric identification for anything. I'm not about to have my fingers cut off or eyeball pulled out so some some crook can make off with my stuff.
http://www.theregister.co.uk/2...
Damn fool idea and probably being pushed more for the use of such data to build a huge database by ye olde 3 letter agencies than for any "security" reasons..
Sky subscribers are morons. They pay to be advertised at !
ummmm, I seem to remember something about this company's decidedly insecure attempt to make voting machines.
redneck geek
The majority of the big banks in Australia have been offering these facilities or similar for 2+ years
Given the popularity of the Magstripe in the US, even after all these years, any advancement seems revolutionary I guess. One would think a possible reduction in fraud would drive even modest initiatives, like Chip+PIN adoption.
Area51 - We are watching...
It'll be a cold day in hell before I willingly give my biometrics to my bank, my government, or a private agency. For one thing, I can't change them if they get stolen.
Secure payments is a very solve-able problem. The only reason it hasn't been solved yet is the reliance on old technology and infrastructure. The two primary problems are a lack of instance validation, and static card information.
Here's one answer:
Bank issues card with a chip. The chip has the bank's public key and a unique private key that the bank installs on the card, then keeps the associated public key. Encrypt the chip key with a 4 digit pin, or a real password. Now the payment process is a public / private key asymmetric encryption process. The card chip encrypts the transaction details, and a nonce that the bank sends (encrypted). If you need to support offline card use, then every time the card is plugged in to an online system, have the bank send down 50 or so nonces that are encrypted and have the card chip store them encrypted locally. That way, if the terminal doesn't have direct network access, the card just uses and burns the next stored nonce. If the terminal needs to store information, it can wrap the card's encrypted information in it's own public/private key encryption that it passes to the banks.
The biggest remaining issue is key exchange, but in the case of the end user, that only needs to happen when they request a new card. For the the merchants, this can happen in the same process that handles reconciliation with the banks. They can exchange a list of merchant public-private keys as an extension of those protocols.
You give money to ATM.
While chips have been standard in Europe for some time, I'm starting to see more and more US businesses starting to use the chip in cards over the past 6 months, especially drug stores.
It is interesting though that many people do not have a PIN associated with these chip cards in the US, so it is still "authenticated" with a signature.
Get rid of the card
What if I don't have and don't want a smartphone?
Also, hasn't it occurred to anyone that this will actually make a 'cyber'-based attack easier?
Here's a better idea: How about you train banking personnel to be proficient at inspecting automatic teller machines for card skimmers and other physical exploits, and have them do it every time they service or reload the machine? In other words: How about better security? Also, how about multi-factor authentication at ATM machines?
Come on, people; every other day I read about some new exploit or security vulnerability on any type of smartphone you care to name, and now they want us to entrust access to the cash in our bank accounts to them? Really? Seriously?
Are YOU using the TOOL, or is the TOOL using YOU? Think about it!
The only reason people could possibly disagree with Electronic voting machines is because "Luddite", and not because there has been a long history of corruption made-easy by these devices.
Since this is the 2nd article in as many days on the same subject, basic math shows that there is no benefit in safety using a Phone vs. an ATM card. Both are a single point of failure, protected by a simple PIN (and last I checked Phones don't require PIN numbers). TFA hints at it: The majority of theft from ATM is by physical attack. It is not easy to install skimmers in reputable places, but it's pretty easy to stick a gun in someone's back and tell them to make a cash withdrawal. You won't hear much about the robbery stuff, small does not generate ratings or help the narrative along.
You increase security by distributing the attack surface and minimizing exposure. Using a phone to generate/receive a timed PIN for your ATM card would be more secure.
I would rather not tie bio metric data to the verification, and, it can not be checked effectively (consider how your body changes every time you eat something different, or use a different soap, etc..etc..). Too many things can go wrong with that, and again you are only changing the surface not extending the surface. "I have, I know" simply becomes "I have, I am".
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
I trust my debit card far more than I trust a mobile software application to interface with my financial accounts.
Under no circumstances will I use a mobile platform ( regardless of vendor, MS / Google, Apple ) to access my bank accounts.
Financial transaction alerts are pushed to the phone based on triggers I have setup, but I would never use a smartphone platform to log into nor perform a financial transaction.
Great idea, but not with that company.
Just another day in Paradise
The reason for chip/signature is that it is believed customers will not remember their PIN and won't be able to use
a chip/pin card.
That is silly. People use PINs all the time with debit cards. An interim solution would be to allow individuals to enable/disable PINs on their account. I would certainly enable it, for the extra security. My PIN is my wife's birthday, so I have plenty of incentive to not forget it.
That is silly. People use PINs all the time with debit cards.... My PIN is my wife's birthday, so I have plenty of incentive to not forget it.
It certainly is silly; so silly that I wonder if you are not allowed in the US to change the PIN to something easier to remember. The date idea, being four digits, is a good one. I might use dates of battles; a pickpocket, or even someone who knows me, is hardly likely to derive it because (1) He won't know that I use dates of battles and (2) Even if he did he won't know which battle.
So my HSBC card might be the Battle of Blenheim, and my Lloyds card the Battle of Borodino. Actually, they are not.
A card sized microprocessor that does two factor authentication is a relatively reasonable cost. Interfacing them to existing machines could be done through the mag reader as an interface, or through a new interface. The problem with a new interface is replacing all the terminals to support the new interface, this is the problem that the chip based credit cards are facing.
Today the cards themselves are replaced so infrequently that I can't imagine cost being the driving force.
What we already know is that the chip based cards are really slow to authorize. There are other ways to design the architecture so that it can be secure without requiring a constant connection to a central database. For example if banks were to sign my credentials and public key that is present on my card, and the microprocessor internally holds my private key used to challenge and authenticate transactions, then the system would only need to refresh a database of all of the public keys for all of the banks it needs. Realistically that's less than 10,000 banks, and would easily fit in the storage available in a modern card reader.
(sorry for the armchair architect post - I originally intended to only show that there are many ways to solve a problem)
“Common sense is not so common.” — Voltaire
What I would like to see is a banking app that would run on a phone or on a durable card sized device.
I'm really not comfortable tying everything to my phone, which is easily hacked or frequently runs out of power on extended trips.
NOTE: some contactless payment technologies today can be skimmed without contact, using a radio antenna designed for the purpose. (ex: EMV)
“Common sense is not so common.” — Voltaire
But, but... using smart phones is cool! You can pay your bill and update your Instagram at the same time! I can hardly believe how uncool old people are.
Card skimming is much too piecemeal an approach.
The preferred technique (well over 100 uses in 2015) in Germany is to hook the ATM to a cylinder of ethylene, add a spark, collect the cash and scram.
This takes about 2 minutes and produces about 10,000E per application, with about 100,000E collateral damage.
Best of all, it is not vulnerable to changes in the card technology
It is silly, but it's also the line that many of the US card issuers are saying publicly - that it's a bonus because it's not yet another PIN to remember.
that it's a bonus because it's not yet another PIN to remember.
I just use the same PIN for all my cards. This might be trivially less secure, but I don't have to write anything down.