Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Would you have spotted the fraud?

krebsonsecurity.com

Post reply on HN
Print view View original

11–20 of 56 posts

Re: Would you have spotted the fraud?

#11

Post by tiffani »

aarongough wrote: post #5
tiffani wrote: post #2

I'm always terribly suspicious of ATMs--especially those off-brand ones that pop up in random establishments that don't take debit cards nowadays. I understand some businesses just don't want to pay the fees behind accepting debit cards, but I'm increasingly becoming of the ilk where if you don't accept debit/credit I'm not shopping with you. Sure, you have folks that will handle your card and still do nefarious thin…

The 'diagram' was a plastic plaque designed to contain/hide the electronics responsible for storing the skimmed data.

I know. But, anyone should be suspicious of why that's even needed.

Re: Would you have spotted the fraud?

#12

Post by ShabbyDoo »

Another thought... When someone steals account information using such methods, it is unlikely the ATM owner/operator who is responsible for losses. After all, it would be really hard to prove conclusively that it was the fault of a particular ATM's lack of security that led to future thefts. Perhaps strong correlation could be shown, but the legal costs associated with reimbursement likely outweigh the efforts, at least in the short term.

Do ATM owners have any incentive to prevent thefts? I suppose those who process mostly the transactions of their own customers (BoA in SF, etc.) have the greatest incentive as the problem is their own.

Re: Would you have spotted the fraud?

#13

Post by gecko »

rdj wrote: post #3

I'm curious about the video monitoring on the machines that have been tampered with. What do these security cameras normally see? Do the perps block the camera so it can't see them installing their hardware? If so, couldn't some program be written to determine that the image of a person is abnormal (measure the amount of "whitespace"" around a subject) and trigger some sort of real-time alarm?

Most recorders only record about 24 hours of video before they recycle. The really robust ones can keep about a week at once, but that's it. They're designed to help the banks out when you call and say that you just got held up--not a month later when police finally realize that a given ATM is ripping someone off. (In fact, early ATMs with cameras took a still photo, and only then while you withdrew cash--totally useless in this scenario.)

Re: Would you have spotted the fraud?

#14

Post by tptacek »

praptak wrote: post #6
ShabbyDoo wrote: post #4

Given how entrenched the ATM card standards are, it will be hard to make fundamental changes to improve security. If one could replace all ATMs in existence, one obvious solution is to issue RNG cards. Perhaps, to make them easy to use, the challenge/response could be electronic ala the "Java Ring" technologies (from TI) advocated by Sun a decade ago. What could be done given that the fundamental use of an ATM machin…

> What else could be done simply? A simple thing that is actually being done: ATMs pulling in the card with a randomly changing speed. This makes it very hard for the skimmer to get a reliable reading. The actual reading by the ATM is done during the second phase, inside the ATM.

That's something companies like JPMC and Citi are doing. But there are tens of thousands of crappy Tranax deli-style ATMs out there that aren't going to change.

Re: Would you have spotted the fraud?

#15

Post by Timothee »

praptak wrote: post #6
ShabbyDoo wrote: post #4

Given how entrenched the ATM card standards are, it will be hard to make fundamental changes to improve security. If one could replace all ATMs in existence, one obvious solution is to issue RNG cards. Perhaps, to make them easy to use, the challenge/response could be electronic ala the "Java Ring" technologies (from TI) advocated by Sun a decade ago. What could be done given that the fundamental use of an ATM machin…

> What else could be done simply? A simple thing that is actually being done: ATMs pulling in the card with a randomly changing speed. This makes it very hard for the skimmer to get a reliable reading. The actual reading by the ATM is done during the second phase, inside the ATM.

Oh is that what it is? I have been wondering why my local Wells Fargo ATM was taking the card in in such a jerky fashion.

Re: Would you have spotted the fraud?

#16

Post by Confusion »

I've started to pull and wiggle the card slot a bit before sticking the card in. From these photo's, I have the impression these skimming devices should be a little 'looser' than the regular thing. However, it may be completely useless.

My second countermeasure is screening the number pad with my hand while entering my PIN. They can probably make out the PIN from hand movements, but I'm hoping it'll be too much trouble for them and they will just move on to the next, easier, target.

Re: Would you have spotted the fraud?

#17

Post by TeHCrAzY »

pavel_lishin wrote: post #8
rdj wrote: post #3

I'm curious about the video monitoring on the machines that have been tampered with. What do these security cameras normally see? Do the perps block the camera so it can't see them installing their hardware? If so, couldn't some program be written to determine that the image of a person is abnormal (measure the amount of "whitespace"" around a subject) and trigger some sort of real-time alarm?

I don't think most of the video cameras on ATM machines are actually pointed at the machine; they're designed to capture the user's face. I would imagine that gluing a piece of plastic onto an ATM can look just like a regular transaction - person walks up, looks at the screen while their hands are doing something below.

It likely would be difficult to do a transaction and modify the ATM at the same time however.

Re: Would you have spotted the fraud?

#18

Post by TeHCrAzY »

tptacek wrote: post #14
praptak wrote: post #6

Earlier quoted context omitted.

> What else could be done simply? A simple thing that is actually being done: ATMs pulling in the card with a randomly changing speed. This makes it very hard for the skimmer to get a reliable reading. The actual reading by the ATM is done during the second phase, inside the ATM.

That's something companies like JPMC and Citi are doing. But there are tens of thousands of crappy Tranax deli-style ATMs out there that aren't going to change.

Interesting, I called my bank about this annoying "feature" and was told it is for security reasons, but never understood why (and they were unwilling or unable to inform me). Enlightening. This functionality is very common in Australia, at least in Sydney.

Re: Would you have spotted the fraud?

#19

Post by ciniglio »

tiffani wrote: post #11
aarongough wrote: post #5

Earlier quoted context omitted.

The 'diagram' was a plastic plaque designed to contain/hide the electronics responsible for storing the skimmed data.

I know. But, anyone should be suspicious of why that's even needed.

I think a slot for a credit/debit card isn't terribly intuitive, especially if the reader only accepts one orientation of the magnetic stripe, in which case a diagram is almost necessary.

There are readers that have asymmetric widths on the entry mechanism (strangely worded, but looks like [1]). This is an extremely subtle hint regarding the orientation (magnetic stripe goes with the wider part), that I would imagine the majority of people don't pick up on.

You might also look at this article [2] to see that legitimate ATMs do offer diagrams indicating the proper orientation of a magnetic stripe card.

[1] http://consumerist.com/images/31/2009/04/041909-008-shell-le... [2] http://consumerist.com/2009/04/heres-what-a-card-skimmer-loo...

Post reply on HN