Would you have spotted the fraud?
krebsonsecurity.com
Would you have spotted the fraud?
1–10 of 56 posts
Re: Would you have spotted the fraud?
#2I'm always terribly suspicious of ATMs--especially those off-brand ones that pop up in random establishments that don't take debit cards nowadays. I understand some businesses just don't want to pay the fees behind accepting debit cards, but I'm increasingly becoming of the ilk where if you don't accept debit/credit I'm not shopping with you. Sure, you have folks that will handle your card and still do nefarious things with it, but at least you're not walking up to a machine prone to this kind of thing.
And for the first skimmer, I'd be suspicious of why they had to put a diagram to show you how to use what should be a universally understood sort of thing now. Slot? Card. The others, no, I wouldn't have caught those. :\
Re: Would you have spotted the fraud?
#3I'm curious about the video monitoring on the machines that have been tampered with. What do these security cameras normally see? Do the perps block the camera so it can't see them installing their hardware? If so, couldn't some program be written to determine that the image of a person is abnormal (measure the amount of "whitespace"" around a subject) and trigger some sort of real-time alarm?
Re: Would you have spotted the fraud?
#4Given how entrenched the ATM card standards are, it will be hard to make fundamental changes to improve security. If one could replace all ATMs in existence, one obvious solution is to issue RNG cards. Perhaps, to make them easy to use, the challenge/response could be electronic ala the "Java Ring" technologies (from TI) advocated by Sun a decade ago.
What could be done given that the fundamental use of an ATM machine (put in card, type in PIN) can't be changed overnight?
On machines capable of displaying pictures, users could be shown what the insertion slot ought to look like so they could compare.
A shroud could be placed over the keypad to reduce the viewing angles available to a pinhole camera.
Could smart phones be used to provide a "have something" security model? Let's say you paid $0.25 less per ATM transaction if you used your bank's iPhone app to generate a unique pin for every visit.
What else could be done simply?
Re: Would you have spotted the fraud?
#5I'm always terribly suspicious of ATMs--especially those off-brand ones that pop up in random establishments that don't take debit cards nowadays. I understand some businesses just don't want to pay the fees behind accepting debit cards, but I'm increasingly becoming of the ilk where if you don't accept debit/credit I'm not shopping with you. Sure, you have folks that will handle your card and still do nefarious thin…
The 'diagram' was a plastic plaque designed to contain/hide the electronics responsible for storing the skimmed data.
Re: Would you have spotted the fraud?
#6Given how entrenched the ATM card standards are, it will be hard to make fundamental changes to improve security. If one could replace all ATMs in existence, one obvious solution is to issue RNG cards. Perhaps, to make them easy to use, the challenge/response could be electronic ala the "Java Ring" technologies (from TI) advocated by Sun a decade ago. What could be done given that the fundamental use of an ATM machin…
> What else could be done simply?
A simple thing that is actually being done: ATMs pulling in the card with a randomly changing speed. This makes it very hard for the skimmer to get a reliable reading. The actual reading by the ATM is done during the second phase, inside the ATM.
Re: Would you have spotted the fraud?
#7I'm always terribly suspicious of ATMs--especially those off-brand ones that pop up in random establishments that don't take debit cards nowadays. I understand some businesses just don't want to pay the fees behind accepting debit cards, but I'm increasingly becoming of the ilk where if you don't accept debit/credit I'm not shopping with you. Sure, you have folks that will handle your card and still do nefarious thin…
You mean the same diagram used on virtually every gas station pump I've ever used?
Re: Would you have spotted the fraud?
#8I'm curious about the video monitoring on the machines that have been tampered with. What do these security cameras normally see? Do the perps block the camera so it can't see them installing their hardware? If so, couldn't some program be written to determine that the image of a person is abnormal (measure the amount of "whitespace"" around a subject) and trigger some sort of real-time alarm?
I don't think most of the video cameras on ATM machines are actually pointed at the machine; they're designed to capture the user's face.
I would imagine that gluing a piece of plastic onto an ATM can look just like a regular transaction - person walks up, looks at the screen while their hands are doing something below.
Re: Would you have spotted the fraud?
#9I'm curious about the video monitoring on the machines that have been tampered with. What do these security cameras normally see? Do the perps block the camera so it can't see them installing their hardware? If so, couldn't some program be written to determine that the image of a person is abnormal (measure the amount of "whitespace"" around a subject) and trigger some sort of real-time alarm?
I wonder if the cameras are proactively monitor-able or if they exist for after-the-fact, reactive evidence in the case of a mugging. Obviously, ATM owners could upgrade to better systems though. Perhaps images with suspicious light levels over time could be shown to a human for assessment.
Re: Would you have spotted the fraud?
#10I'm always terribly suspicious of ATMs--especially those off-brand ones that pop up in random establishments that don't take debit cards nowadays. I understand some businesses just don't want to pay the fees behind accepting debit cards, but I'm increasingly becoming of the ilk where if you don't accept debit/credit I'm not shopping with you. Sure, you have folks that will handle your card and still do nefarious thin…
> I'd be suspicious of why they had to put a diagram to show you how to use what should be a universally understood sort of thing now.
Clearly you've never seen someone in a self-checkout aisle trying oh so hard to scan their discount card through the magnetic reader when the video on the POS is telling you to swipe it. Or vice versa.
There will always be someone too dumb to use something.