Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Crazy Thin ‘Deep Insert’ ATM Skimmers

krebsonsecurity.com

Post reply on HN
Print view View original

331–340 of 484 posts

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#331

Post by koliber »

qazxcvbnmlp wrote: post #313
mepiethree wrote: post #310

Earlier quoted context omitted.

> Who are these businesses? Gas stations, parking meters, and ticket dispensers at most train/bus stations. They should replace them but I figure the problem is that they are built in to giant kiosks

> Who are these businesses? Airline ticket counters… Replacing is not as simple as sending a new terminal. Then you’d have to integrate it with the legacy software workflow and modify the existing furniture at the airport to support a pin pad. Also, we have your ID and you are going to be cleaning security, so we’re pretty certain you say who you are. Regardless of the physical security of the credit card.

My fruit stand at the farmers market figured out how to accommodate a credit card reader. They did not have to replace any furniture. They literally have no counter space, and managed to make it work. A portable card reader with a pin pad is a solution that can work in all the hard cases.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#332

Post by Reason077 »

mindcrime wrote: post #230
Macha wrote: post #152

Earlier quoted context omitted.

I've seen a few people in the US mention "when the chip isn't working". I don't think I've encountered this... ever? Of course, when the merchant's only alternative is handling cash, maybe there's more incentive to keep the card machine in order

At best I've found chip reading to work about 60% of the time across a range of local merchants here. And now the debit card I have, which is less than a year old, has a chip which has completely quit working. Making it totally useless for the (thankfully small) number of merchants whose POS systems won't let you fall back to mag-stripe when the chip fails. As far as I'm concerned, chip cards can get stuffed. They're…

> "At best I've found chip reading to work about 60% of the time ... Making it totally useless for the (thankfully small) number of merchants whose POS systems won't let you fall back to mag-stripe"

Here in the UK, many (most?) new payment terminals don't have mag-stripe readers at all. And I expect banks will start issuing new cards without a magnetic strip in the near future, if they haven't done so already.

I agree that chip & pin isn't ideal, not just because of reliability issues but also because of the security risk of PIN disclosure. But thankfully contactless (incl. Apple Pay/Android Pay) has already replaced it for 99% of daily transactions.

But if your card's chip is broken, can't you just get your bank to send out a new one?

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#333

Post by namibj »

kube-system wrote: post #175
tialaramex wrote: post #96

Earlier quoted context omitted.

A hotel I stayed at actually made an impression from my card in... I'm going to say maybe 2015 (I'm pretty sure this is before Trump, but it's after Marvel started re-publishing Miracleman). Hotel somewhere in the middle of Nottingham. Room nice enough, but no actual card machine.

That’s wild. Last time I saw one in the US was a family owned gas station around 2000.

2019, Germany, on an ICE (long-distance train).

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#334

Post by Nursie »

jjav wrote: post #319
bryan0 wrote: post #9

It's crazy how I never carry cash anymore. I can't even think of the last time I used an ATM. I often just leave the house with my phone and buy stuff with apple pay. Also how is magnetic strip still a thing? I thought this was replaced with chip and tap years ago...

If your phone breaks or you lost it, if there is no connectivity, if apple decides to cancel your digital existence, then what? And it means everything you buy is associated with you and recorded forever to be sold to endless advertisers (and worse) and the transaction may be blocked by third parties. If you pay cash it works without a depending on anything external (no internet, no electricity), it is not traced, it…

> if there is no connectivity

FYI, you don't need internet connectivity to pay using apple/android pay.

And waving my phone at a payment device is massively more convenient than having to go to an ATM to withdraw cash, and then pay with said cash.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#335

Post by raverbashing »

mepiethree wrote: post #310
gtirloni wrote: post #227

> However, there are a great many smaller businesses in the United States that still rely on being able to swipe the customer’s card. Who are these businesses? Seriously, stop issuing cards without chips and send new card readers to theses businesses. End of story. Is it because US businesses use deeply embedded card readers in custom POS machines that aren't modular? Everywhere I go in South America and Europe, busi…

> Who are these businesses? Gas stations, parking meters, and ticket dispensers at most train/bus stations. They should replace them but I figure the problem is that they are built in to giant kiosks

They had literally more than 10 years to prepare for it.

Anyone who didn't think of providing a forward-compatible reader at any point in the last 10 yrs was driving into obsolence

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#336

Post by Nursie »

jjav wrote: post #327
yardstick wrote: post #324

Earlier quoted context omitted.

Cash is only optimal for privacy, not convenience or availability or speed or security. If my credit card is stolen, I get my money back (so long as I reported it in time, and didn’t surrender to them my pin). Not so with cash. Cards take a second or two to process payments on average. Not so wish cash. My bank account / credit card limits always have enough to cover my purchases, whereas my physical wallet might be…

> Cash is only optimal for privacy, not convenience or availability or speed or security. Security == privacy. And cash certainly wins availability by a long shot, it can't be blocked by any kind of outage. Convenience is arguable I suppose. I'd rather hand over cash than deal with anything electronic that can fail. > If my credit card is stolen, I get my money back (so long as I reported it in time, and didn’t surre…

> Credit cards don't have a PIN

They do in most countries.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#337

Post by gcanyon »

devman0 wrote: post #228
gcanyon wrote: post #226

The article suggests using the contactless sensor, but how is that not another potential "skimmer" device?

Contactless uses a cryptographic operation to secure the transaction, both reader and chip are active participants. Compare with magstripes which are passively read and thus trivially subject to replay attacks.

Thanks, I figured this was likely the case, but I didn't know the details.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#338

Post by cezart »

bmitc wrote: post #115
naet wrote: post #24

Earlier quoted context omitted.

I love using cash. Sometimes I don't when my local ATM is down (which seems to happen so often...), but when I can it feels much better to me. No digital records, no potential for this type of skimmer or other scam, don't have to give up my ATM pin, no worrying about my phone running out of charge, able to give it away freely to anyone in need without setting up a digital transfer, the old taco truck still only takes…

> No digital records, no potential for this type of skimmer or other scam I don't understand. How are you not exposed to this type of skimmer when it only attacks those who use cash ATMs, like what you do?

In my country (Eastern Europe), you can get a code from the bank's smartphone app, to get cash from the ATM, without using a card or pin. Helps with potential skimmer attacks.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#339

Post by gcanyon »

josh2600 wrote: post #231
gcanyon wrote: post #226

The article suggests using the contactless sensor, but how is that not another potential "skimmer" device?

Contactless checkout has a different security scope for card issuers. Magstripe + Pin is reusable, contactless auth has protections that bind the key exchange to that specific merchant and multiple pay auth attempts from a merchant get throttled. I haven't looked into it, but I would guess that there's a key exchange with the reader that binds the contactless payment to that reader in such a way that the card produce…

I figured there was likely a cryptographic aspect, but I don't know the details.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#340

Post by Dalewyn »

Nursie wrote: post #336
jjav wrote: post #327

Earlier quoted context omitted.

> Cash is only optimal for privacy, not convenience or availability or speed or security. Security == privacy. And cash certainly wins availability by a long shot, it can't be blocked by any kind of outage. Convenience is arguable I suppose. I'd rather hand over cash than deal with anything electronic that can fail. > If my credit card is stolen, I get my money back (so long as I reported it in time, and didn’t surre…

> Credit cards don't have a PIN They do in most countries.

In the US, most credit cards don't have PINs and if one does nobody/nothing ever asks for it.

Debit cards, however, are downright nazis about PINs.

Post reply on HN