Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Would you have spotted the fraud?

krebsonsecurity.com

Post reply on HN
Print view View original

41–50 of 56 posts

Re: Would you have spotted the fraud?

#41

Post by praptak »

PanMan wrote: post #38
praptak wrote: post #6

Earlier quoted context omitted.

> What else could be done simply? A simple thing that is actually being done: ATMs pulling in the card with a randomly changing speed. This makes it very hard for the skimmer to get a reliable reading. The actual reading by the ATM is done during the second phase, inside the ATM.

Why does that make it harder? It's a row of bits sliding by, right? Why does the speed matter? (I'm not saying your wrong, I'm just wondering why it would help?)

The bits don't have "start of bit" nor "end of bit" marks. The only way the reader can know which impulse constitutes a bit is by timing.

Re: Would you have spotted the fraud?

#42

Post by daveungerer »

praptak wrote: post #6
ShabbyDoo wrote: post #4

Given how entrenched the ATM card standards are, it will be hard to make fundamental changes to improve security. If one could replace all ATMs in existence, one obvious solution is to issue RNG cards. Perhaps, to make them easy to use, the challenge/response could be electronic ala the "Java Ring" technologies (from TI) advocated by Sun a decade ago. What could be done given that the fundamental use of an ATM machin…

> What else could be done simply? A simple thing that is actually being done: ATMs pulling in the card with a randomly changing speed. This makes it very hard for the skimmer to get a reliable reading. The actual reading by the ATM is done during the second phase, inside the ATM.

That's a good idea. But I guess it's only a matter of time (and feasibility) before they add an optical sensor to pick up the card speed. Or more low-tech: a rubber wheel.

Re: Would you have spotted the fraud?

#43

Post by prewett »

praptak wrote: post #41
PanMan wrote: post #38

Earlier quoted context omitted.

Why does that make it harder? It's a row of bits sliding by, right? Why does the speed matter? (I'm not saying your wrong, I'm just wondering why it would help?)

The bits don't have "start of bit" nor "end of bit" marks. The only way the reader can know which impulse constitutes a bit is by timing.

There are a lot of credit card machines where the purchases swipes the card themselves. Since the speed that people swipe is going to be variable, it can't be too hard to read a card without knowing the speed. (Like, say, putting 10101010 at the beginning, which you could use for calibration) So I'm not sure how a random speed helps things. Maybe ATM bits aren't encoded like credit cards?

Re: Would you have spotted the fraud?

#44

Post by enneff »

My bank (ANZ) has new ATMs with prominent, translucent green housings around the card slot that flash when the card is inserted or removed. It's a very distinctive design, and one that I feel must have been crafted specifically to mitigate these kinds of attacks.

Re: Would you have spotted the fraud?

#45

Post by visitor4rmindia »

There is actually a very simple solution that a bank could use to mitigate this issue - just send a SMS everytime there is an ATM withdrawal.

I believe the bank I've just moved to (http://www.kotak.com/) does do this. It sends me an SMS for every transaction done so far (I haven't used the ATM yet).

Re: Would you have spotted the fraud?

#46

Post by praptak »

prewett wrote: post #43
praptak wrote: post #41

Earlier quoted context omitted.

The bits don't have "start of bit" nor "end of bit" marks. The only way the reader can know which impulse constitutes a bit is by timing.

There are a lot of credit card machines where the purchases swipes the card themselves. Since the speed that people swipe is going to be variable, it can't be too hard to read a card without knowing the speed. (Like, say, putting 10101010 at the beginning, which you could use for calibration) So I'm not sure how a random speed helps things. Maybe ATM bits aren't encoded like credit cards?

"Since the speed that people swipe is going to be variable, it can't be too hard to read a card without knowing the speed."

The speed just has to be fairly constant within a single swipe - then you can adjust for it. It usually is when humans do that - human hand has quite an inertia.

The security feature on ATMs makes it vary wildly within a single swipe.

Re: Would you have spotted the fraud?

#47

Post by pmjordan »

ShabbyDoo wrote: post #30
pmjordan wrote: post #21

Earlier quoted context omitted.

In Europe, they could do away with the magnetic strip on cash cards. All terminals from recent years support the smartcard interface to the chip on the card. Presumably they keep the strip around for when you visit a country that doesn't use the smart card interface, so they can charge you an arm and a leg for exchanging currencies. And that recent case in Germany where the chips didn't support the year 2010, so you…

Doesn't the ATM offer a unique challenge each time? Would it matter if the skimmer knew what challenge had been made and what the answer was?

I don't know exactly how it's implemented (tptacek and cperciva would probably have a field day with it) but I think the idea is to prevent exactly such replay attacks by generating the challenge on the bank's central servers.

Re: Would you have spotted the fraud?

#48

Post by pmjordan »

Tichy wrote: post #33
pmjordan wrote: post #21

Earlier quoted context omitted.

In Europe, they could do away with the magnetic strip on cash cards. All terminals from recent years support the smartcard interface to the chip on the card. Presumably they keep the strip around for when you visit a country that doesn't use the smart card interface, so they can charge you an arm and a leg for exchanging currencies. And that recent case in Germany where the chips didn't support the year 2010, so you…

Hm, should I glue a strip of tinfoil on the magnetic strip? Or what would be a good way to disable it?

A magnetic card writer should definitely do the trick...

Re: Would you have spotted the fraud?

#50

Post by villiros »

enneff wrote: post #44

My bank (ANZ) has new ATMs with prominent, translucent green housings around the card slot that flash when the card is inserted or removed. It's a very distinctive design, and one that I feel must have been crafted specifically to mitigate these kinds of attacks.

I've noticed some newer ATMs around these parts started doing that as well. However, is is of absolutely no use without associated customer education. The machines don't even say "here is what the slot should look like, please check it before entering your PIN." There were even reports of people calling the police thinking this security feature was a skimming device, since it looks so out of place and different from what's usually on the machines.
Post reply on HN