Slashdot Mirror
Vacationing Security Researcher Exposes Austrian ATM Skimmer (carbonblack.com)
While vacationing with his family in Vienna, Ben Tedesco (from security company Carbon Black) discovered an ATM skimmer "in the wild", perfectly crafted to look like the original card reader. New submitter rmurph04 shares Ben's story: I went to grab some cash from an ATM. Being security paranoid, I repeated my typical habit of checking the card reader with my hand as I have hundreds of times. Today's the day when my security awareness paid off!
Ben's blog post includes a video demonstrating the ATM skimmer, as well as close-ups showing the device had its own control board, strip reader, and even its own battery.
Ben's blog post includes a video demonstrating the ATM skimmer, as well as close-ups showing the device had its own control board, strip reader, and even its own battery.
Now!
... the blatant camera/panel overlay above the PIN pad, which is almost certainly where the main logic and storage of the skimmer is.
These days, pretty much any ATM I use, I attempt to pull the receptacle off, just on the off chance that there's a skimmer attached.
I've never been skimmed myself, but my parents have.
Chas - The one, the only.
THANK GOD!!!
Note that his ATM has a grey ridge just above the screen, almost blocking to buttons at the top of the screen, while the ATM left from his does not have this extra ridge. This part should contain the camera to record the password number, needed to use the card (in Europe).
I'm still LOLing at the Europeans even today, most of whom are mourning the first of many nations to leave the EU. It's a matter of time before the rest of the EU fails, too. I'm so thankful for being a Canadian, because we are smarter and better than the Europeans and Americans. Unlike the United States and most of Europe, Canada is not a failed state. Look for Canada to become the dominant power as China sinks deeper into recession, the United States spirals downward in decay, and the EU breaks apart at the seams.
that forgets looking for the pin-pad overlay or cam XD
Unlike the US, European cards generally have a chip in them and use a nonce based protocol. So skimming the interaction with the ATM is not going to buy very much. Not the secret in the chip. Maybe the extra number written on the back if it has a camera.
So what was the point?
Upgrade your cards to chip and PIN, so that we can finally get rid of the damn mag stripe.
ATMs should have a camera (preferably 2, for stereo) looking at themselves. When there is no customer, take a picture and compare it to the base line one (when it was freshly installed/last inspected etc). If it has been tampered with, the bank can see the difference. A computer program can recognise the change. If they keep recordings, they can even see who did it.
Bert
...and even its own battery
Well ... duhhh!*?!
The UK will soon be free of this. Thanks to Boris we can chuck out all the Romanians.
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
I used a Euronet ATM in Berlin once and while I was able to get money out of it without hidden charges, my credit card got locked immediately, supposedly because the operator withdrew the money incorrectly according to my credit card company. Locals tended to agree that they're suspicious. You may want to avoid them.
Stronger glue should be used.
"Wait. Something's happening. It's opening up! My God, it's full of apricots!"
It is hardly surprising that he found this in a tourist location. Austria has long switched to chip cards for cash withdrawal so skimming the magnet stripe of an Austrian card wouldn't be much use. You could technically get the magnet stripe information from an Austrian card (which is there for legacy reasons and the occasional visit to the States) but if you tried to use it this would be immediately be caught by fraud detection.
the 8eaper BSD's them5elves to be a
I'd be more concerned about the people by the cathedral... Somebody owns that skimmer and they're probably connected to organized crime.
Why didn't this idiot contact the police? Or the back that owns the ATM?
So instead of phoning the police, he destroys possible evidence, such as fingerprints. Bravo.
Well, with the cards EMV chips become more prevalent, and they use challenge-and-response based authentication, capturing the card, or even the entire exchange between the ATM and the main bank computer would not be enough to commit fraud. For authorizing card-not-present transactions, two factor authentication based on cell phone to confirm the charges will come through. So eventually this threat will go away.
But as long as the loss to the banks due to skimming is less than the cost of upgrading the infrastructure, they will drag their feet about the cards with chips. Also the credit card companies have shifted the liability for the fraud from themselves to the merchants, in USA. So we should see more EMV chips coming on line in USA.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
The newer ones are designed to be "installed" in the cardslot so you can't even see them. Pulling on the green thing will no longer be sufficient.
i would like to invite you to this amazing website !!
http://www.ahaal.com
how can you trust him?
Ugh. I hate vertical videos.
Why not make the front of the ATM and especially the card reader section out of clear plastic?
It would stop of lot of this stuff dead in the water because you'd be able to see that something wasn't right (assuming you took 2 seconds to look, anyway).
Just cruising through this digital world at 33 1/3 rpm...
"Blatant" is rather an overstatement. Nobody is going to be alarmed by minor cosmetic changes such as the 1/8" gap between the blue sticker and the keyboard being eliminated. Do you think people go around with a precise image of these machines in their head?
Look at the video - the skimmer is in a green part that looks exactly identical to the original item as it's an overlay. No visual system would have caught it...
Now they WOULD have caught the pinhole camera mentioned my someone responding to the thread, but only if it was pretty high resolution and had such a degree of intolerance to difference that even dirt could set it off.
Not really a great way to go about protecting against skimmers, especially if like in Mexico you have the actual ATM repair guys install skimmers internally.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
On the other hand, the operations to INSTALL the skimmer head and PIN-watcher would have been considerably different to a normal transaction.
Have you seen video of people installing those things? The skimmer just takes a second, and looks identical to someone checking to see if there's a skimmer...
It would take some impressive software to distinguish skimmer installation from a normal transaction, and most of the work would be easy blocked by the installers body.
"There is more worth loving than we have strength to love." - Brian Jay Stanley