Slashdot Mirror
Vacationing Security Researcher Exposes Austrian ATM Skimmer (carbonblack.com)
While vacationing with his family in Vienna, Ben Tedesco (from security company Carbon Black) discovered an ATM skimmer "in the wild", perfectly crafted to look like the original card reader. New submitter rmurph04 shares Ben's story: I went to grab some cash from an ATM. Being security paranoid, I repeated my typical habit of checking the card reader with my hand as I have hundreds of times. Today's the day when my security awareness paid off!
Ben's blog post includes a video demonstrating the ATM skimmer, as well as close-ups showing the device had its own control board, strip reader, and even its own battery.
Ben's blog post includes a video demonstrating the ATM skimmer, as well as close-ups showing the device had its own control board, strip reader, and even its own battery.
... the blatant camera/panel overlay above the PIN pad, which is almost certainly where the main logic and storage of the skimmer is.
Note that his ATM has a grey ridge just above the screen, almost blocking to buttons at the top of the screen, while the ATM left from his does not have this extra ridge. This part should contain the camera to record the password number, needed to use the card (in Europe).
ATMs should have a camera (preferably 2, for stereo) looking at themselves. When there is no customer, take a picture and compare it to the base line one (when it was freshly installed/last inspected etc). If it has been tampered with, the bank can see the difference. A computer program can recognise the change. If they keep recordings, they can even see who did it.
Bert
Sometimes there's a distraction attack afterwards and they steal the card. With the number they can then go & withdraw loads of cash.
Saw one on TV where a bloke spotted the hidden camera and alerted the bank. Turns out there were a bunch of undercover cops outside waiting for the perp to come back & collect it.
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
I just take a close look at the receptacle and especially the keyboard. I keep one hand on the keyboard (touching multiple keys) and cover it with my other hand, then enter the PIN blind. Good against camera's, but not against a fake keyboard. Another measure that a lot of machines here have implemented is to ingest the card in a very jittery manner, making it (almost) impossible for a skimmer to properly read the mag strip. And people still get skimmed: some skimmers took to breaking into shops in order to tamper with or replace the payment terminals.
Most banks here now issue cards with chips that cannot be skimmed. So skimmers came up with a new trick: they install a camera or keyboard to get your PIN, then stick something in the card receptacle in order to trap your card in there. Once you get fed up and leave, they'll retrieve it and now have your chip & PIN.
If construction was anything like programming, an incorrectly fitted lock would bring down the entire building...
A nonce based protocol where the ATM can just ask the card wgat its PIN is, yes. The chip-and-pin protocols are completely broken and were designed by morons, unfortunately. See aa href="https://www.youtube.com/watch?v=szgwaYajKHA>"Chip and PIN is broken" from 27C3 or google for more recent attacks.
Yeah, I too prefer to be robbed after a punch in the face and a stick on the head from a purely brutal british below poverty bred bloody bad ass, instead of being softly skimmed by a romanian.
Our cards have chip + strip. My credit card and my wife's debit card have both been skimmed in the past few years.
Therein lies the problem. Here in Europe (and practically all of the rest of the world) we have switched to CHIP and PIN which allegedly makes skimming much more difficult. Unfortunately, this technology appears to be too complex for Americans to understand so we all have to have mag stripes on our cards as well just in case we ever go there. I never go to the USA, so the mag stripes on my cards are entirely useless other than for skimmers.
Does anyone know of any UK banks which offer a "I am never going to go to North America so please send me a card with a blank mag stripe" service or even a "I sometimes go to North America so please send me two cards, one with mag and one without" service?
Use a magnet to wipe the magstripe... It is a Hi-Co card so the magnet needs to be relatively strong to write data to it. A harddrive magnet would do.
So instead of phoning the police, he destroys possible evidence, such as fingerprints. Bravo.
Well, with the cards EMV chips become more prevalent, and they use challenge-and-response based authentication, capturing the card, or even the entire exchange between the ATM and the main bank computer would not be enough to commit fraud. For authorizing card-not-present transactions, two factor authentication based on cell phone to confirm the charges will come through. So eventually this threat will go away.
But as long as the loss to the banks due to skimming is less than the cost of upgrading the infrastructure, they will drag their feet about the cards with chips. Also the credit card companies have shifted the liability for the fraud from themselves to the merchants, in USA. So we should see more EMV chips coming on line in USA.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
The magnetic strip can easily be erased by a strong magnet (e.g. a neodymium one from a broken HDD). I erased the one on my credit card myself two years ago. However, I have since discovered that there are still payment terminals in Europe, which use solely the magnetic strip. For example, the highway toll gates in Italy and France.
-Yenya
--
While Linux is larger than Emacs, at least Linux has the excuse that it has to be. --Linus
The newer ones are designed to be "installed" in the cardslot so you can't even see them. Pulling on the green thing will no longer be sufficient.
You have been mislead by the banks. They want you to believe that chip transactions are safe. The problem is the mag strips still exists and the chip usually contains a full, unencrypted copy of the mag stripe data. You can test this yourself by buying a programmable or USB chip reader.
The chip does have the capacity to have a card without stripe and even fully encrypt its data and even do simple crypto on chip but to date, many merchant banks (even big ones like Walmart) do not work with an encrypted chip.
IF the chip even does anything useful, the only data that is safe is what is on the wires between the chip reader and the bank. Chips could have easily been replaced by requiring strong TLS encryption and a custom key in the mag stripe.
Additionally, by the time the chip was declared ready to be used (a decade ago) the (homegrown) crypto was already outdated and researchers published papers on how an attack could be executed because those little chips don't have the compute power for anything better, it reuses keys generated with a very poor PRNG. By now, it is feasible to clone encrypted chips and force it to do weak, crackable crypto (with a bit of time on a decent computer). Once banks get around to go chip-only (another decade or even 2), I think it will be feasible to put the entire hack into one of those skimmers.
Custom electronics and digital signage for your business: www.evcircuits.com
"Blatant" is rather an overstatement. Nobody is going to be alarmed by minor cosmetic changes such as the 1/8" gap between the blue sticker and the keyboard being eliminated. Do you think people go around with a precise image of these machines in their head?
That's why you always point out your hidden cameras when you come back to collect them. If they already know, you just saved your ass from getting busted. Worst case, they want to keep the camera or maybe turn it over to police; but, then, you should be using a wireless camera transmitting to a nearby (but not on the same property) storage device and ditching it after each op, anyway; if you can't afford that, get a job, running scams ain't for you.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
So, the big problem with Chip+PIN is that you have to keep the card in for the duration of the transaction? Seriously? Good grief people in the USA must be short of things to be inconvenienced by!
I have to say that I didn't quite understand all of your explanation, but fortunately as I never to the the USA I don't need to (Phew!). Do I however deduce that before long mag stripes will be disappearing from your cards and the rest of us can then give them up as well?
BTW, why doesn't the candy store put up a sign saying "No card transactions below $5". Plenty of shops in the UK do, but perhaps you have a law (or more likely hundreds of different laws) against it.
I can confirm that the switch to Chip and PIN caused very few problems here in the UK. At least not that I as a consumer noticed, it might have been a pain for the shop owners.