Unlike skimmers, a shimmer — named for its slim profile — fits inside a card reader... So shouldn't it be called a sLimmer?
I believe the idea is it is shimmied into the slot?
'Shimmers' are the newest tool for stealing credit card info
21–30 of 88 posts
Re: 'Shimmers' are the newest tool for stealing credit card info
#22I'm having a surprising amount of trouble finding this information online: does the "chip" include some functionality (maybe called iCVV or dCVV) that allows it to individually "sign" transactions using internal secret keys, or does it not? This was my understanding of why the new system was supposed to be safer. If the answer is yes, secret keys that never leave the chip are used to sign each transaction and the sig…
The answer is yes, most chip cards can do public key cryptography to sign a transaction without compromising the secret key burned in.
Also, more frequently than I would wish banks or payment processors ask payment terminal operators for a "simpler", meaning less secure, transaction protocol. Most often it's for compatibility with some legacy system from the 80's somewhere in their payment validation backend.
From my experience in the industry, this happened very rarely in Europe but considerably more often in the Americas and Middle East.
Re: 'Shimmers' are the newest tool for stealing credit card info
#23Earlier quoted context omitted.
This sounds like the attack presented at DEFCON 19 (in 2011!): https://www.defcon.org/images/defcon-19/dc-19-presentations/... . Basically, the chip used to contain all the information present on the magstripe, which made it easy to create a copy of the magstripe via the chip interface.
With that information i make the conclusion that it should not be a problem in countries that have moved 100% to "chip & pin". Only for countries like USA which have not completed the move from magnetic readers.
In France it always has been 100% chip & pin, but if you have a hardware like this device between your card and the card reader, it can apparently intercept any signal, including the pin code.
I don't know how exactly the protocol and how they get the pin, but they get it according to this article. (would it be possible to implement a SSL-like protocol to avoid this type of MitM attack?)
An old school version of this would be installing a camera in top of your ATM and recording your card data with the stripe, which as you say would be the stripe's fault, but here they get the information and the pin simply from the shimmer, which looking at the picture shows only a chip connector.
Then a fraudster can duplicate the card exactly, and use the duplicate with the same pin at a random ATM across the world. I think this is why banks can block your card if you didn't warn them about going abroad, as they're unable to tell if this is your card or a replica of your card used by a fraudster.
Re: 'Shimmers' are the newest tool for stealing credit card info
#24steal credit crd info, get bank transfers, cheques and all other hacking related jobs. direct all to 19193076946
Re: 'Shimmers' are the newest tool for stealing credit card info
#25I haven't actually physically inserted my card into a machine for at least 2 years now. It's contactless everywhere. If the transaction is more than ~$50 it just asks for my pin and that's it. Maybe we should just introduce this everywhere and then see how criminals can possibly break it?
Re: 'Shimmers' are the newest tool for stealing credit card info
#26So at some level there is an issue with the "inside" aspect of card readers. If you had four guide posts and you just pressed your card against the pogo pins would it make it harder to interpose?
Re: 'Shimmers' are the newest tool for stealing credit card info
#27Earlier quoted context omitted.
Not all terminals in the States support chip functionality, so for the time being chip & pin cards here still have normal mag strips and can be run as older, regular cards - the mag strips can still be read/stolen & used.
And it's unlikely that this will change anytime soon due to the lack on incentives on all sides. Funny as it may be my debit card for some reason has a $500 (unmodifiable) limit on chip&pin purchases, but it has no such limit for swipe purchases. When I asked them how is that more secure, I got a verbal shoulder shrug. Banks are in the business of underwriting. I believe at least on the corporate level they probably…
Banks are also in a business of storing your money, transferring your money, and borrowing you money. Note that "storing" here is actually "letting the bank invest the money". I don't think any of these activities are undermined by completely verifiable purchase transactions.
Re: 'Shimmers' are the newest tool for stealing credit card info
#28I'm having a surprising amount of trouble finding this information online: does the "chip" include some functionality (maybe called iCVV or dCVV) that allows it to individually "sign" transactions using internal secret keys, or does it not? This was my understanding of why the new system was supposed to be safer. If the answer is yes, secret keys that never leave the chip are used to sign each transaction and the sig…
This sounds like the attack presented at DEFCON 19 (in 2011!): https://www.defcon.org/images/defcon-19/dc-19-presentations/... . Basically, the chip used to contain all the information present on the magstripe, which made it easy to create a copy of the magstripe via the chip interface.
This is interesting. I would totally believe that with the information you can intercept passing between the chip and the reader, you could in some cases construct magnetic stripe data that would be recognized as valid.
It kinda seems like the magnetic stripe system should be completely separate from the chip system. Make it so that the card ID (or whatever) reported by the chip can never be used for swipe transactions, and vice-versa. Combining them just seems to cross-product-ify the attack surface, which is dumb.
Re: 'Shimmers' are the newest tool for stealing credit card info
#29Earlier quoted context omitted.
With that information i make the conclusion that it should not be a problem in countries that have moved 100% to "chip & pin". Only for countries like USA which have not completed the move from magnetic readers.
In France it always has been 100% chip & pin, but if you have a hardware like this device between your card and the card reader, it can apparently intercept any signal, including the pin code. I don't know how exactly the protocol and how they get the pin, but they get it according to this article. (would it be possible to implement a SSL-like protocol to avoid this type of MitM attack?) An old school version of this…
In a proper EMV solution, hardware like this can not intercept the PIN code even if it can interpret any signal, as the unencrypted PIN is not sent anywhere beyond the keypad - even if you do MITM on the wires between the keypad and POS terminal, you would get only an encrypted version that then gets sent to the bank for online verification or to the chip for offline verification. You can get the PIN code by cameras or extra keypad on top of the real keypad, as sometimes is done for ATM skimming.
Furthermore, they can't get the card private keys in this manner, so they can't duplicate the card chip, only its magstripe; and they are definitely able to tell if a replica of your card is suddenly used in a magstripe-only mode. This means that it's a problem, as the parent post said, "only for countries like USA which have not completed the move from magnetic readers" because otherwise you can simply reject any transactions that might use a cloned magstripe.
Re: 'Shimmers' are the newest tool for stealing credit card info
#30I haven't actually physically inserted my card into a machine for at least 2 years now. It's contactless everywhere. If the transaction is more than ~$50 it just asks for my pin and that's it. Maybe we should just introduce this everywhere and then see how criminals can possibly break it?
Keep on waiting. Every single transaction method has been broken. If not the method itself, the environment in which it has been used.
Your personal experience is not a valid scientific reasoning. If it was: "I have not used more than maestro cards and my 4-digit pin in 4 years. I did not have a single fraudulent transcation for 4 years now. [...] Maybe we should just use this everywhere!"