Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Would you have spotted the fraud?

krebsonsecurity.com

Post reply on HN
Print view View original

21–30 of 56 posts

Re: Would you have spotted the fraud?

#21

Post by pmjordan »

ShabbyDoo wrote: post #4

Given how entrenched the ATM card standards are, it will be hard to make fundamental changes to improve security. If one could replace all ATMs in existence, one obvious solution is to issue RNG cards. Perhaps, to make them easy to use, the challenge/response could be electronic ala the "Java Ring" technologies (from TI) advocated by Sun a decade ago. What could be done given that the fundamental use of an ATM machin…

In Europe, they could do away with the magnetic strip on cash cards. All terminals from recent years support the smartcard interface to the chip on the card. Presumably they keep the strip around for when you visit a country that doesn't use the smart card interface, so they can charge you an arm and a leg for exchanging currencies. And that recent case in Germany where the chips didn't support the year 2010, so you could only withdraw cash when you masked the interface with tape.

The smartcard mechanism hopefully uses some challenge-response setup that makes it impossible to read out by scammers. (aside from the difficulty of interfacing with the chip during the split second it's in the right position)

Re: Would you have spotted the fraud?

#22

Post by JacobAldridge »

Confusion wrote: post #16

I've started to pull and wiggle the card slot a bit before sticking the card in. From these photo's, I have the impression these skimming devices should be a little 'looser' than the regular thing. However, it may be completely useless. My second countermeasure is screening the number pad with my hand while entering my PIN. They can probably make out the PIN from hand movements, but I'm hoping it'll be too much troub…

I've mastered the ability to type my PIN with three fingers all hitting different buttons each time (but only one, and it differs for each number, actually hitting it hard enough to register). With the right recording and enough time I doubt it would stop a truly committed thief, but it makes me feel safer.

If they crack that, the $20 I keep in my ATM account to prevent over-drawn fees are all theirs.

Re: Would you have spotted the fraud?

#24

Post by bruceba »

ShabbyDoo wrote: post #12

Another thought... When someone steals account information using such methods, it is unlikely the ATM owner/operator who is responsible for losses. After all, it would be really hard to prove conclusively that it was the fault of a particular ATM's lack of security that led to future thefts. Perhaps strong correlation could be shown, but the legal costs associated with reimbursement likely outweigh the efforts, at le…

I was just a victim of ATM fraud (presumably by skimmer) and according to the detective who handled the police report, there is almost no cooperation from banks and card providers. It is not in their interest that you know how much fraud there is out there. I have heard figures of over 8-10% in the US. That's a lot of overhead to be passing onto the consumer.

Re: Would you have spotted the fraud?

#25

Post by noodle »

Confusion wrote: post #16

I've started to pull and wiggle the card slot a bit before sticking the card in. From these photo's, I have the impression these skimming devices should be a little 'looser' than the regular thing. However, it may be completely useless. My second countermeasure is screening the number pad with my hand while entering my PIN. They can probably make out the PIN from hand movements, but I'm hoping it'll be too much troub…

i also wiggle the slot and tend to use my entire body to cover the key pad when i type in my pin number. i do so because i have friends who were skimmed and it has made me paranoid.

Re: Would you have spotted the fraud?

#27

Post by litewulf »

sid- wrote: post #23

Well windows laptops have fingerprint scanners to log you in these days. So a fingerprint scan and pin ought to be enough ?

Revocation would suck though. And I understand you leave your fingerprints everywhere you go, so it would probably be "easy" to steal.

Re: Would you have spotted the fraud?

#28

Post by ShabbyDoo »

bruceba wrote: post #24
ShabbyDoo wrote: post #12

Another thought... When someone steals account information using such methods, it is unlikely the ATM owner/operator who is responsible for losses. After all, it would be really hard to prove conclusively that it was the fault of a particular ATM's lack of security that led to future thefts. Perhaps strong correlation could be shown, but the legal costs associated with reimbursement likely outweigh the efforts, at le…

I was just a victim of ATM fraud (presumably by skimmer) and according to the detective who handled the police report, there is almost no cooperation from banks and card providers. It is not in their interest that you know how much fraud there is out there. I have heard figures of over 8-10% in the US. That's a lot of overhead to be passing onto the consumer.

How hard was it to convince your bank that you hadn't withdrawn lots of cash?

Re: Would you have spotted the fraud?

#29

Post by ShabbyDoo »

tptacek wrote: post #14
praptak wrote: post #6

Earlier quoted context omitted.

> What else could be done simply? A simple thing that is actually being done: ATMs pulling in the card with a randomly changing speed. This makes it very hard for the skimmer to get a reliable reading. The actual reading by the ATM is done during the second phase, inside the ATM.

That's something companies like JPMC and Citi are doing. But there are tens of thousands of crappy Tranax deli-style ATMs out there that aren't going to change.

Perhaps the in-store machines are safer because it would be harder install and later retrieve the skimmer? Or, maybe an insider allows the skimmer to be installed? Aren't many small, retail ATMs owner-serviced, so no one with an incentive to audit would ever check it out?

Re: Would you have spotted the fraud?

#30

Post by ShabbyDoo »

pmjordan wrote: post #21
ShabbyDoo wrote: post #4

Given how entrenched the ATM card standards are, it will be hard to make fundamental changes to improve security. If one could replace all ATMs in existence, one obvious solution is to issue RNG cards. Perhaps, to make them easy to use, the challenge/response could be electronic ala the "Java Ring" technologies (from TI) advocated by Sun a decade ago. What could be done given that the fundamental use of an ATM machin…

In Europe, they could do away with the magnetic strip on cash cards. All terminals from recent years support the smartcard interface to the chip on the card. Presumably they keep the strip around for when you visit a country that doesn't use the smart card interface, so they can charge you an arm and a leg for exchanging currencies. And that recent case in Germany where the chips didn't support the year 2010, so you…

Doesn't the ATM offer a unique challenge each time? Would it matter if the skimmer knew what challenge had been made and what the answer was?
Post reply on HN