Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Crazy Thin ‘Deep Insert’ ATM Skimmers

krebsonsecurity.com

Post reply on HN
Print view View original

151–160 of 484 posts

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#151

Post by sbf501 »

btown wrote: post #57

I've always wondered about how modern contactless methods are more resistant to skimming. Couldn't someone compromise two machines and essentially MITM the NFC communcations, intercepting the card's response from the first machine, and replaying it against another remote machine, along with the PIN recorded from a camera? Though I suppose the ATM company could combat this by encoding the machine's ID or a nonce with…

The magnetic stripe is just data. NFC is a handshake: the chip is a tiny MCU. There is still a root of trust required to prevent MITM, but the device would need to be compromised. This is why keys and certificate chains are stored in secure memory that is resistent to side channel, and even physical attack (it breaks easily and the die can't be shaved down).

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#152

Post by Macha »

giantg2 wrote: post #81
hammock wrote: post #59

Earlier quoted context omitted.

With just about everything either chip or tap now, is there any danger in just scratching out the mag stripe of my cards?

The small number of places with older swipe only terminals. Or when the chip isn't working (Lowes has a stripe reader on the register if the main terminal isn't working; mainly used for gift cards though). And finally, an alert employee might not accept a damaged card.

I've seen a few people in the US mention "when the chip isn't working". I don't think I've encountered this... ever? Of course, when the merchant's only alternative is handling cash, maybe there's more incentive to keep the card machine in order

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#153

Post by RC_ITR »

wil421 wrote: post #53
TaylorAlexander wrote: post #46

This is why I really like the added security of the new Apple magnetic wallet I got. The wallet holds your cards and attaches to the back of the phone using magnets. While the inside of the wallet is magnetically shielded, I’ve found it’s nearly impossible when actually handling the magnetic wallet not to accidentally pass the card past the outside of the magnetic wallet. I have found that my card no longer works in…

I’ve had an Apple Wallet since they came out and never had any cards lose their magnetic strip. Same with my wife.

Yeah, OP clarified he was using another brands wallet lol. Weird to dunk on Apple implying they underengineer their products. Engineering and (probably) precision manufacturing some magnetic shield is exactly the kind of thing Apple would do.

From [0]:

According to Apple's site, "the leather wallet is shielded so it’s safe for credit cards." That shield protects both Low Coercivity (LoCo) and High Coercivity (HiCo) cards — which is a fancy way of saying how resistant something is from being demagnetized. So, LoCo cards are considered things like hotel keys and gift cards while credit cards fall under HiCo.

[0] https://mashable.com/article/apple-magsafe-iphone-wallet-dem...

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#154

Post by Mountain_Skies »

roguesherlock wrote: post #125

Do people not get any messages when they make any transactions? In my county you literally get messages for every transaction. And you also have to add in otp for every transaction online.

That's opt-in but I think every credit card company in the US offers to alert you by SMS or app notification when a transaction has been made. I have that setup for my cards but it is annoying each month when the internet bill hits my card because they do their processing at 3am.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#155

Post by sbf501 »

ruskyhacker wrote: post #130

Funny, sawthisbon discover and immediately wondered if this was on HN. Anyway, I have a few of these I use for pentests / audits https://electroniccats.com/store/huntercat/ I've caught and reported two pumps at fuel stations near where I live. One of them I watcheded when the police showed up and with the fuel station employee removed the ble module storing the data.

That's a really cool store. I'm surprised they went all in on SAM MCUs for lots of their stuff, as I don't think the Atmel SAM product line has much of a future since being purchased my Microchip (although that was 6 years ago).

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#156

Post by Macha »

grishka wrote: post #136
quickthrower2 wrote: post #109

Hopefully we can go contactless on ATMs. Seems antiquated to insert a card.

Wait, there are still places in the developed world where there are no contactless ATMs?

We dropped magstripes over a decade ago for chip and pin (though cards still ship with them for use overseas), and pretty much every payment terminal in stores have supported contactless for two years, but I haven't seen a contactless ATM here in Ireland - I assumed there was some liability reason they wanted chip and pin

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#157

Post by bri3d »

samatman wrote: post #143
noirbot wrote: post #90

Earlier quoted context omitted.

If you go anywhere where they hold a tab open, such as a bar, you can't do that with tap/chip. Not that that's a blocker, since worst case you do a bunch of single transactions, but it's an annoyance.

Do you not give them the card, then they swipe it once at the end and you get it back? How does a stripe affect that?

There are a large number of “smart” tab systems in use in US bars where the system retains your magnetic stripe data for the duration of your visit. You pass off your card, it is swiped and immediately returned. If you don’t settle your tab, it’s automatically settled with a pre-set tip using the stored track data. It’s convenient for bar owners and patrons as the bar doesn’t have leftover cards to deal with and the patron doesn’t have to retrace their steps to recover their forgotten card the next day.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#158

Post by FractalParadigm »

Macha wrote: post #150
noirbot wrote: post #90

Earlier quoted context omitted.

If you go anywhere where they hold a tab open, such as a bar, you can't do that with tap/chip. Not that that's a blocker, since worst case you do a bunch of single transactions, but it's an annoyance.

Tabs work just fine in europe where mag stripe payments have been phased out. You pay at the end in the pin terminal.

And in Canada. 99.9% of the time if the machine asks you to use the magstripe period there's something wrong and the payment isn't going to process regardless.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#159

Post by kloch »

pdntspa wrote: post #61
bryan0 wrote: post #9

It's crazy how I never carry cash anymore. I can't even think of the last time I used an ATM. I often just leave the house with my phone and buy stuff with apple pay. Also how is magnetic strip still a thing? I thought this was replaced with chip and tap years ago...

The chips on my card have a habit of not working, and my bank doesn't give NFC "tap" cards. Mag-stripe has saved my bacon a couple times after the chip wouldnt read. And the fancy Amex tap card barely works -- Apple Pay is more reliable.

I'm left handed and had a lot of trouble using tap until I realized my thumb was covering/shorting out the chip. If I hold cards in my right hand tap works great.
Post reply on HN