Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Crazy Thin ‘Deep Insert’ ATM Skimmers

krebsonsecurity.com

Post reply on HN
Print view View original

61–70 of 484 posts

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#61

Post by pdntspa »

bryan0 wrote: post #9

It's crazy how I never carry cash anymore. I can't even think of the last time I used an ATM. I often just leave the house with my phone and buy stuff with apple pay. Also how is magnetic strip still a thing? I thought this was replaced with chip and tap years ago...

The chips on my card have a habit of not working, and my bank doesn't give NFC "tap" cards. Mag-stripe has saved my bacon a couple times after the chip wouldnt read.

And the fancy Amex tap card barely works -- Apple Pay is more reliable.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#62

Post by woodruffw »

btown wrote: post #57

I've always wondered about how modern contactless methods are more resistant to skimming. Couldn't someone compromise two machines and essentially MITM the NFC communcations, intercepting the card's response from the first machine, and replaying it against another remote machine, along with the PIN recorded from a camera? Though I suppose the ATM company could combat this by encoding the machine's ID or a nonce with…

> Though I suppose the ATM company could combat this by encoding the machine's ID or a nonce with the message that the card's smart chip responds to, so it only works when replayed on that first machine - is this what happens in practice?

Yes, more or less. The chip and contactless flows defined by EMV both require the card to generate a nonce for the transaction. The terminal also generates its own nonce[1].

[1]: https://www.cs.ru.nl/E.Poll/papers/EMVtechreport.pdf

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#63

Post by kube-system »

kQq9oHeAz6wLLS wrote: post #35
naet wrote: post #24

Earlier quoted context omitted.

I love using cash. Sometimes I don't when my local ATM is down (which seems to happen so often...), but when I can it feels much better to me. No digital records, no potential for this type of skimmer or other scam, don't have to give up my ATM pin, no worrying about my phone running out of charge, able to give it away freely to anyone in need without setting up a digital transfer, the old taco truck still only takes…

> Already there are a (small) number of modern restaurants that don't accept cash in my area. Is that even legal?

Broadly speaking, doing business on the internet doesn’t have a separate set of laws. Many online retailers don’t accept cash.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#65

Post by joshuamorton »

notch656a wrote: post #41
maherbeg wrote: post #32

Earlier quoted context omitted.

You'd be surprised how often you can ask "do you have a venmo?" and just tip service workers via the QR code.

As a double advantage, it ensures the workers tips are 1099-K'd when their venmo hits $600 aggregate and they can't weasel out of the social contract of paying up for muh roads.

This is, as far as I know, only true if you use the business "mode" in venmo. I certainly take in a lot more than $600 in aggregate per year via venmo (passthrough rent), and don't get a 1099-k.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#67

Post by pdntspa »

phinnaeus wrote: post #21
reaperducer wrote: post #16

Earlier quoted context omitted.

I often just leave the house with my phone and buy stuff with apple pay. I admire your uncomplicated, predictable life. Sometimes I want to buy something from a guy with the ice cream cart at the park. Sometimes I need to tip a valet, a doorman, a hotel maid, or another service worker. Sometimes I want to buy Girl Scout cookies from the girl with the table on the corner. Sometimes I want to buy something from one of…

I think it's clear the person you're replying to isn't from the US since they seem unaware of how prevalent even magnetic swiping is in the US (or was when I left before the pandemic, when I visited a few months ago it seems interest in contactless has finally started to catch on).

US person here, I can do this too, but in a limited fashion. In fact the donut shop in my circuit used to be cash-only but eventually relented because of the pandemic.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#68

Post by woodruffw »

kaladin-jasnah wrote: post #60
btown wrote: post #57

I've always wondered about how modern contactless methods are more resistant to skimming. Couldn't someone compromise two machines and essentially MITM the NFC communcations, intercepting the card's response from the first machine, and replaying it against another remote machine, along with the PIN recorded from a camera? Though I suppose the ATM company could combat this by encoding the machine's ID or a nonce with…

From my understanding you can't really skim these cards as the cards sign some piece of data using a private key stored only on the card that never gets exposed in the transaction. I might be _totally_ wrong though.

That's pretty close: the private key alone can't prevent replays, since any material generated from just the private key could be recorded and replayed. Instead, the card mixes its private key with a nonce to produce a session key.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#69

Post by Tijdreiziger »

willhackett wrote: post #34

I think the magnetic strip needs to go. We hardly use them in Australia to the point where one of our major banks actually has a touch reader on their machine. Some sort of one-time verification would be great. An SMS or a push notification would go a long way to making this type of scraping harder. Or eliminate the card altogether - Cardless Cash.

> I think the magnetic strip needs to go.

Absolutely. Here in the Netherlands, magstripe payments are disabled by default. Only if you’re travelling outside Europe do you need to enable them manually (through your bank’s app or website).

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#70

Post by jack_pp »

reaperducer wrote: post #18
mh- wrote: post #11

Earlier quoted context omitted.

Correct. I'm not familiar with the implementation details, but there's a handshake involved in the NFC tap that prevents it from being cloned using a "dumb" skimmer like this.

One of my banks lets you use a QR code from the app. I haven't tried it yet to see how well it works.

I've tried it with ING (Europe) but it has low withdrawal limits, like 200e iirc
Post reply on HN