Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Would you have spotted the fraud?

krebsonsecurity.com

Post reply on HN
Print view View original

51–56 of 56 posts

Re: Would you have spotted the fraud?

#51

Post by cstross »

ShabbyDoo wrote: post #4

Given how entrenched the ATM card standards are, it will be hard to make fundamental changes to improve security. If one could replace all ATMs in existence, one obvious solution is to issue RNG cards. Perhaps, to make them easy to use, the challenge/response could be electronic ala the "Java Ring" technologies (from TI) advocated by Sun a decade ago. What could be done given that the fundamental use of an ATM machin…

Magstripe skimmers are a solved problem here in Europe; we moved on to chip and pin (EMV technology) nearly a decade ago specifically because of this kind of attack (and, in the case of the UK, because of this: http://www.theregister.co.uk/2005/10/21/phantoms_and_rogues/ ).

There are concerns over the cryptographic integrity of PIN codes in some chip and pin implementations, but it's a much harder target for ATM skimmers, which is why organized criminals have switched to tampering with retail EPOS terminals instead. And the threshold for that is a lot higher, too. (http://www.telegraph.co.uk/news/worldnews/asia/pakistan/3173...) Overall, the level of card crime in the UK seems to have diminished significantly since the switchover, although the general rule applies: if you build a better safe, you'll attract a better class of safe-cracker.

Re: Would you have spotted the fraud?

#52

Post by villiros »

ShabbyDoo wrote: post #4

Given how entrenched the ATM card standards are, it will be hard to make fundamental changes to improve security. If one could replace all ATMs in existence, one obvious solution is to issue RNG cards. Perhaps, to make them easy to use, the challenge/response could be electronic ala the "Java Ring" technologies (from TI) advocated by Sun a decade ago. What could be done given that the fundamental use of an ATM machin…

There is a very simple solution: pass a law that automatically absolves customers of any fraud, and places burden of proof on the banks. Transactions reported fraudulent should be automatically reversed, unless the bank can provide proof (satisfying the standards expected in civil courts) that the customer was at fault.

As an example, this was largely the case with transactions not involving PINs (signed-for purchases). Recent introduction of EMV (chip-and-pin cards) was really done to shift responsibility for such transactions back onto the customers and reduce banks' losses.

This is also the case with stolen cards (in the UK and Ireland, at least): losses related to such cases are covered by the bank, even for losses occurring before the card was reported stolen. This is the reason banks implement various pattern-matching techniques to try and detect such transactions as soon as possible.

Re: Would you have spotted the fraud?

#53

Post by Tichy »

pmjordan wrote: post #48
Tichy wrote: post #33

Earlier quoted context omitted.

Hm, should I glue a strip of tinfoil on the magnetic strip? Or what would be a good way to disable it?

A magnetic card writer should definitely do the trick...

True, but then I would lose the option to use it at the few places where they don't understand the chip yet. Might be the better choice, though.

Thinking a bit further, perhaps it would be possible to create some fake information on the magnet stripe that would identify anybody who uses it as a thief?

Re: Would you have spotted the fraud?

#54

Post by bruceba »

tedunangst wrote: post #39
bruceba wrote: post #24

Earlier quoted context omitted.

I was just a victim of ATM fraud (presumably by skimmer) and according to the detective who handled the police report, there is almost no cooperation from banks and card providers. It is not in their interest that you know how much fraud there is out there. I have heard figures of over 8-10% in the US. That's a lot of overhead to be passing onto the consumer.

8-10% of what?

Total transaction value of all ATM/credit card usage. Lots of money.

Re: Would you have spotted the fraud?

#55

Post by bruceba »

ShabbyDoo wrote: post #28
bruceba wrote: post #24

Earlier quoted context omitted.

I was just a victim of ATM fraud (presumably by skimmer) and according to the detective who handled the police report, there is almost no cooperation from banks and card providers. It is not in their interest that you know how much fraud there is out there. I have heard figures of over 8-10% in the US. That's a lot of overhead to be passing onto the consumer.

How hard was it to convince your bank that you hadn't withdrawn lots of cash?

Very simple, actually. They didn't even require a police report but I filed one anyway. The detective even sent me a picture of the suspect because they had the location and exact time of day. That's probably the end of it, though.

Re: Would you have spotted the fraud?

#56

Post by pmjordan »

Tichy wrote: post #53
pmjordan wrote: post #48

Earlier quoted context omitted.

A magnetic card writer should definitely do the trick...

True, but then I would lose the option to use it at the few places where they don't understand the chip yet. Might be the better choice, though. Thinking a bit further, perhaps it would be possible to create some fake information on the magnet stripe that would identify anybody who uses it as a thief?

Yeah, I'm not seriously recommending you reprogram your bank card... Maybe you could strap an alternative magnetic strip to the card, which you'd only take off if you really need the real strip.
Post reply on HN