Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Crazy Thin ‘Deep Insert’ ATM Skimmers

krebsonsecurity.com

Post reply on HN
Print view View original

321–330 of 484 posts

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#321

Post by ki85squared »

kibibyte wrote: post #318
mepiethree wrote: post #310

Earlier quoted context omitted.

> Who are these businesses? Gas stations, parking meters, and ticket dispensers at most train/bus stations. They should replace them but I figure the problem is that they are built in to giant kiosks

With gas stations, there is so much more to it than just replacing a card reader in the kiosk, or even just replacing the kiosk itself. You may have to even tear out all of the old networking equipment. https://news.ycombinator.com/item?id=28207062

Thank you for this. How much of an impact is this having 1+ years on? I'm sure it's still substantial but wanted to ask if you had any current data.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#322

Post by jjav »

TillE wrote: post #218
zepppotemkin wrote: post #149

Earlier quoted context omitted.

personally I hate the idea of always needing a phone with me -- i leave mine at home most of the time just using my wallet and nfc transit card to get around

Difficult to overstate how much you're in an extreme, extreme minority position if you own a smartphone and don't carry it around pretty much everywhere.

My phone lives in my backpack, if I don't have my backpack on me (which is most of the time) I'm not going to have a phone.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#323

Post by Reason077 »

Tomdarkness wrote: post #205
stavros wrote: post #194

Earlier quoted context omitted.

I've always wondered: What happens if I use a paused/canceled card on a plane? Do I just get the item for free?

Yep, like this person who used that method to steal £25,000 worth of goods from airlines: https://www.manchestereveningnews.co.uk/news/greater-manches...

Transport for London works similarly for contactless payment card acceptance on the tube, buses, etc. Cards are authorised in offline mode, with transactions processed overnight at the end of each day.

But they also maintain an internal blacklist of declined cards, so the most you'll get away with is one day's travel around London. Per card.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#324

Post by yardstick »

jjav wrote: post #319
bryan0 wrote: post #9

It's crazy how I never carry cash anymore. I can't even think of the last time I used an ATM. I often just leave the house with my phone and buy stuff with apple pay. Also how is magnetic strip still a thing? I thought this was replaced with chip and tap years ago...

If your phone breaks or you lost it, if there is no connectivity, if apple decides to cancel your digital existence, then what? And it means everything you buy is associated with you and recorded forever to be sold to endless advertisers (and worse) and the transaction may be blocked by third parties. If you pay cash it works without a depending on anything external (no internet, no electricity), it is not traced, it…

Cash is only optimal for privacy, not convenience or availability or speed or security.

If my credit card is stolen, I get my money back (so long as I reported it in time, and didn’t surrender to them my pin). Not so with cash.

Cards take a second or two to process payments on average. Not so wish cash.

My bank account / credit card limits always have enough to cover my purchases, whereas my physical wallet might be low/empty and require a trip to the ATM / bank for a withdrawal.

Re internet/electricity outages, this is so rare enough to not be a concern. POS can also do offline transactions just fine if you have power but no internet. And a lot of retail and critical infrastructure places have both wired and cellular Internet links for high availability.

There is definitely still a place for cash, but it’s not a big thing for a lot of people anymore.

The last time I used cash it was because my kid threw up in a taxi and I needed to quickly make it up to the driver. Yes I could have paid card as well, but seeing the physical cash was likely more meaningful to de-escalating the situation.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#325

Post by leoedin »

qazxcvbnmlp wrote: post #313
mepiethree wrote: post #310

Earlier quoted context omitted.

> Who are these businesses? Gas stations, parking meters, and ticket dispensers at most train/bus stations. They should replace them but I figure the problem is that they are built in to giant kiosks

> Who are these businesses? Airline ticket counters… Replacing is not as simple as sending a new terminal. Then you’d have to integrate it with the legacy software workflow and modify the existing furniture at the airport to support a pin pad. Also, we have your ID and you are going to be cleaning security, so we’re pretty certain you say who you are. Regardless of the physical security of the credit card.

Why is the US a special case though? Every other country replaced these old card machines more than a decade ago. Every other country has airline ticket counters too.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#327

Post by jjav »

yardstick wrote: post #324
jjav wrote: post #319

Earlier quoted context omitted.

If your phone breaks or you lost it, if there is no connectivity, if apple decides to cancel your digital existence, then what? And it means everything you buy is associated with you and recorded forever to be sold to endless advertisers (and worse) and the transaction may be blocked by third parties. If you pay cash it works without a depending on anything external (no internet, no electricity), it is not traced, it…

Cash is only optimal for privacy, not convenience or availability or speed or security. If my credit card is stolen, I get my money back (so long as I reported it in time, and didn’t surrender to them my pin). Not so with cash. Cards take a second or two to process payments on average. Not so wish cash. My bank account / credit card limits always have enough to cover my purchases, whereas my physical wallet might be…

> Cash is only optimal for privacy, not convenience or availability or speed or security.

Security == privacy. And cash certainly wins availability by a long shot, it can't be blocked by any kind of outage. Convenience is arguable I suppose. I'd rather hand over cash than deal with anything electronic that can fail.

> If my credit card is stolen, I get my money back (so long as I reported it in time, and didn’t surrender to them my pin)

Credit cards don't have a PIN, that's a debit card. But yes, you get the money back from fraud with a credit card, that's true.

> Re internet/electricity outages, this is so rare enough to not be a concern.

Depends where you live I suppose. In many areas electricity outages are a daily occurrence.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#328

Post by fastball »

toomuchtodo wrote: post #275
arjvik wrote: post #264

Earlier quoted context omitted.

Modern iPhones actually support being used for NFC payments even when they're dead (using a tiny bit of reserve power)

Wouldn’t it be cool if payment terminals were also Qi enabled so even if the phone was dead it could provide enough power wirelessly to enable payments to be made?

That's actually already how NFC works. The chip being read doesn't need its own source of power – the EM field in the terminal induces a current in the target NFC chip and then uses that same EM field to read the contents. That's why your contactless debit card doesn't need a battery.

Powered devices like a phone have read/write NFC chips that the device will write data to on demand, usually waiting for some form of user auth to make it secure, e.g. an iPhone keeps the NFC chip empty until you specifically request to pay for something, at which point it authenticates you (e.g. with FaceID) and then writes the data to the chip which can then be read by the terminal to authorize payment. Once payment has been made it wipes the NFC chip again.

But a device can have some payment info written to the NFC chip at all times, which is what iPhones do when you have the "Express Transit Card" option enabled – with certain authorized vendors, that payment data stays on your phones NFC chip indefinitely, so you don't need to auth with FaceID and even when the phone is out of battery it can still be read by those authorized terminals.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#329

Post by HWR_14 »

theshrike79 wrote: post #305
gtirloni wrote: post #227

> However, there are a great many smaller businesses in the United States that still rely on being able to swipe the customer’s card. Who are these businesses? Seriously, stop issuing cards without chips and send new card readers to theses businesses. End of story. Is it because US businesses use deeply embedded card readers in custom POS machines that aren't modular? Everywhere I go in South America and Europe, busi…

> However, there are a great many smaller businesses in the United States that still rely on being able to swipe the customer’s card. Over here they just moved the burden of fraudulent transactions to the merchant if they still swiped instead of using the chip. Shops upgraded their equipment real f'n fast.

That's what they did in the US as well. Although maybe that's what you meant.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#330

Post by stouset »

mepiethree wrote: post #310
gtirloni wrote: post #227

> However, there are a great many smaller businesses in the United States that still rely on being able to swipe the customer’s card. Who are these businesses? Seriously, stop issuing cards without chips and send new card readers to theses businesses. End of story. Is it because US businesses use deeply embedded card readers in custom POS machines that aren't modular? Everywhere I go in South America and Europe, busi…

> Who are these businesses? Gas stations, parking meters, and ticket dispensers at most train/bus stations. They should replace them but I figure the problem is that they are built in to giant kiosks

I just do not goddamn care any more. The writing has been on the wall for years, and if your business is based around accepting credit cards and you continue to dig your head in the sand, that's on you.
Post reply on HN