Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Crazy Thin ‘Deep Insert’ ATM Skimmers

krebsonsecurity.com

Post reply on HN
Print view View original

291–300 of 484 posts

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#291

Post by cuteboy19 »

kube-system wrote: post #286
cuteboy19 wrote: post #247

Earlier quoted context omitted.

In most Asian countries ATM cards are a thing of the past. QR scanning is easier, more reliable and significantly safer

As far as technology is concerned, QR codes are far less advanced or secure than EMV. The only thing it compares favorably (and I’m being generous) to in terms of payment security is magstripes, which is a 1960s technology. QR codes have basically no inherent security. They are just barcodes in two dimensions. You can do physical MITM attacks on them very easily. For instance: https://www.techinasia.com/fake-qr-code-…

Why so? QR is just an arbitrary url in image form. If anything EMV is both overcomplicated AND insecure.

Eg the whole class of vulnerabilities from card theft and card skimming disappears with QRs

Edit: I mean you could have a computer screen display the QR. How are you going to MITM between the screen and your phone?

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#292

Post by chadlavi »

emkoemko wrote: post #213
jlawson wrote: post #66

Can I be safe against this if I just put electrical tape over the magnetic stripe on the credit card? Or any other kind of covering. If I ever actually need it (very rare) I can just pull the tape off.

where do you live that banks allows you to even use the strip? once we got chips like 10+ years ago banks have since disabled the strip, i mean why have a chip if your card is going to get fraud ? defeats the purpose of it

The US

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#293

Post by Nursie »

reaperducer wrote: post #16
bryan0 wrote: post #9

It's crazy how I never carry cash anymore. I can't even think of the last time I used an ATM. I often just leave the house with my phone and buy stuff with apple pay. Also how is magnetic strip still a thing? I thought this was replaced with chip and tap years ago...

I often just leave the house with my phone and buy stuff with apple pay. I admire your uncomplicated, predictable life. Sometimes I want to buy something from a guy with the ice cream cart at the park. Sometimes I need to tip a valet, a doorman, a hotel maid, or another service worker. Sometimes I want to buy Girl Scout cookies from the girl with the table on the corner. Sometimes I want to buy something from one of…

In Australia ...

> Sometimes I want to buy something from a guy with the ice cream cart at the park.

The ice cream van that comes past our house is contactless card-only.

> Sometimes I need to tip ...

Ugh, tip culture!

> Sometimes I want to buy Girl Scout cookies from the girl with the table on the corner

She's probably got Square.

> Many of the late-night restaurants and food carts in my city are cash only.

Where they exist, they're more often card-only here.

This is not to say one is superior to the other, but it is very geographically and culturally dependent. If I had to choose to leave the house with either my Apple/Android-pay enabled phone or a pile of cash, the phone would get me a lot further in this country.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#294

Post by kube-system »

cuteboy19 wrote: post #291
kube-system wrote: post #286

Earlier quoted context omitted.

As far as technology is concerned, QR codes are far less advanced or secure than EMV. The only thing it compares favorably (and I’m being generous) to in terms of payment security is magstripes, which is a 1960s technology. QR codes have basically no inherent security. They are just barcodes in two dimensions. You can do physical MITM attacks on them very easily. For instance: https://www.techinasia.com/fake-qr-code-…

Why so? QR is just an arbitrary url in image form. If anything EMV is both overcomplicated AND insecure. Eg the whole class of vulnerabilities from card theft and card skimming disappears with QRs Edit: I mean you could have a computer screen display the QR. How are you going to MITM between the screen and your phone?

Not all QR codes in Asia are on a phone. QR codes are inherently graphical, and anything printed can be simply covered up or replaced.

Smart cards at least can at least implement public/private keys.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#295

Post by kube-system »

thewebcount wrote: post #270
kube-system wrote: post #175

Earlier quoted context omitted.

That’s wild. Last time I saw one in the US was a family owned gas station around 2000.

There’s a pizza joint down the street from me that was still using one when the pandemic started. I would call them to order and they’d show up with the impression machine. I couldn’t use my Apple Card to pay with them.

Well, there’s quite a few generations of technology between card impressioning and Apple Pay.

Maybe 50% of places around me accept Apple Pay but I haven’t personally had a card impressed in ~22 years.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#296

Post by krzyk »

hammock wrote: post #59
TaylorAlexander wrote: post #46

This is why I really like the added security of the new Apple magnetic wallet I got. The wallet holds your cards and attaches to the back of the phone using magnets. While the inside of the wallet is magnetically shielded, I’ve found it’s nearly impossible when actually handling the magnetic wallet not to accidentally pass the card past the outside of the magnetic wallet. I have found that my card no longer works in…

With just about everything either chip or tap now, is there any danger in just scratching out the mag stripe of my cards?

Adding to that: do people use physical cards? (except older generation)

I don't remember when I last saw a person not taping with phone or watch.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#297

Post by krzyk »

noirbot wrote: post #90
hammock wrote: post #59

Earlier quoted context omitted.

With just about everything either chip or tap now, is there any danger in just scratching out the mag stripe of my cards?

If you go anywhere where they hold a tab open, such as a bar, you can't do that with tap/chip. Not that that's a blocker, since worst case you do a bunch of single transactions, but it's an annoyance.

Every time I'm in the US I'm amazed that I have give my card to the waiter who gets the card to some place and gets its back after few mins.

Don't people have wireless terminals in the US like the rest of the world?

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#298

Post by thenoblesunfish »

To highlight the action item from the end of the article: for this attack to work they need a video of your PIN from a nearby hidden camera, so cover the PIN pad with your other hand as you enter your PIN! (I always thought this was paranoia, but apparently not)

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#299

Post by JohnTHaller »

krzyk wrote: post #296
hammock wrote: post #59

Earlier quoted context omitted.

With just about everything either chip or tap now, is there any danger in just scratching out the mag stripe of my cards?

Adding to that: do people use physical cards? (except older generation) I don't remember when I last saw a person not taping with phone or watch.

Lots of smaller stores have readers where either the tap or the chip is broken. I just went to one today and took out my card to insert the chip instead of using Google Pay.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#300

Post by seanmcdirmid »

krzyk wrote: post #296
hammock wrote: post #59

Earlier quoted context omitted.

With just about everything either chip or tap now, is there any danger in just scratching out the mag stripe of my cards?

Adding to that: do people use physical cards? (except older generation) I don't remember when I last saw a person not taping with phone or watch.

Fred Myers (a grocery store) where I live doesn’t have NFC POSes in their self checkout kiosks, so I have to whip out my card to chip there. But otherwise I don’t usually use it (though I bring it just in case).
Post reply on HN