Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Crazy Thin ‘Deep Insert’ ATM Skimmers

krebsonsecurity.com

Post reply on HN
Print view View original

371–380 of 484 posts

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#371

Post by Semaphor »

samatman wrote: post #366
Semaphor wrote: post #257

Earlier quoted context omitted.

The whole "giving your card away" thing is so foreign to me (German). Fuck no, I’m not giving you my card. In restaurants and bars they either come by with their handheld terminal, or you go to the machine at the register and simply pay like in any other place.

America having invented the dining (later credit) card, we have some customs remaining from when they worked analog. I understand why Germany, a poorer country which was late to electronic payments, wouldn't do this; I don't understand the hostility to it. But then, I'm American, we've been doing this longer than you've been alive.

Hey, if you are proud of your security issues, good for you :)

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#372

Post by omnimus »

NavinF wrote: post #357
neilalexander wrote: post #354

Earlier quoted context omitted.

What about it is inconvenient? We've had Chip+PIN in the UK since 2006 and contactless payments since 2007 and it isn't inconvenient at all. Supporting card machines are everywhere and in addition portable card machines are extremely commonplace. Even in restaurants they just bring the card reader to the table and you either tap-to-pay or you put your card in and enter your PIN.

It takes a few more seconds. Never gonna happen.

I am nit sure how it works elsewhere but with NFC i can set limit when PIN is required . And with NFC on phone this gets preapproved by using biometrics.

So most people dont write PIN.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#373

Post by verisimi »

I see this as part of the 'war on cash'. Cash itself cannot be skimmed etc - but when you use your card, it can be. The problem appears to be the use of ATMs to get cash out - the message is that its risky. Of course, if there were banks, and you were able to get cash out in ye olde fashioned way, this wouldn't be a problem.

The point I'm trying to make is that technology introduces risks that cannot really be quantified - you won't even know that someone has stolen from you for a while by cloning your card (a few hours/days) - with cash if it is stolen it is obvious immediately. This lack of access and ability to get an accurate picture of your finances is not going to get better with crypto.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#374

Post by iam-TJ »

Nursie wrote: post #334
jjav wrote: post #319

Earlier quoted context omitted.

If your phone breaks or you lost it, if there is no connectivity, if apple decides to cancel your digital existence, then what? And it means everything you buy is associated with you and recorded forever to be sold to endless advertisers (and worse) and the transaction may be blocked by third parties. If you pay cash it works without a depending on anything external (no internet, no electricity), it is not traced, it…

> if there is no connectivity FYI, you don't need internet connectivity to pay using apple/android pay. And waving my phone at a payment device is massively more convenient than having to go to an ATM to withdraw cash, and then pay with said cash.

No connectivity for the retailer's device, not for the customer device.

There are also quite a few payment terminals that still do dial-on-demand to get authorisation from the merchant service provider (Chip&PIN/NFC Contactless).

I still see those in the UK especially at independent fuel stations. The additional delay waiting for the terminal to dial and connect sometimes makes me think it has failed - had a few occasions where the line was busy and the terminal redialled several times before it finally made it!

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#375

Post by acdha »

NavinF wrote: post #357
neilalexander wrote: post #354

Earlier quoted context omitted.

What about it is inconvenient? We've had Chip+PIN in the UK since 2006 and contactless payments since 2007 and it isn't inconvenient at all. Supporting card machines are everywhere and in addition portable card machines are extremely commonplace. Even in restaurants they just bring the card reader to the table and you either tap-to-pay or you put your card in and enter your PIN.

It takes a few more seconds. Never gonna happen.

The time is moot in almost all situations as long as it doesn’t take you longer to enter the PIN than it does for a cashier to finish tallying items. The concern I’ve heard businesses raise is that people won’t remember it but that’s also a chicken and egg problem since people will remember what they use regularly.

Of course, since it’s the 2020s and not the 1990s we don’t need either since NFC is widely supported and an Apple/Google device transaction secured by biometrics on the client is far better and already widely supported.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#376

Post by mindcrime »

Semaphor wrote: post #254
mindcrime wrote: post #230

Earlier quoted context omitted.

At best I've found chip reading to work about 60% of the time across a range of local merchants here. And now the debit card I have, which is less than a year old, has a chip which has completely quit working. Making it totally useless for the (thankfully small) number of merchants whose POS systems won't let you fall back to mag-stripe when the chip fails. As far as I'm concerned, chip cards can get stuffed. They're…

That sounds like you are somehow mistreating them, or your local merchants use "special" terminals (or maybe your bank is just using crappy materials). I can’t even remember how long ago it was that swiping worked, but chips have never broken until I cut them for the replacement card, this is over 3 different banks.

That sounds like you are somehow mistreating them,

I don't think I am. All I do is take it out of my wallet, put in the reader, take it out, put it back in my wallet, lather, rinse, repeat.

or your local merchants use "special" terminals

That would make sense if we were talking about one merchant, or even just two. But I can go to Barnes & Noble, Lowes, Food Lion, the local corner gas station, Ace Hardware, it doesn't matter, I routinely find the chip readers less reliable than the magstripe reader. I can't explain it, but chips are tainted in my worldview at this point.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#377

Post by emptyfile »

iam-TJ wrote: post #374
Nursie wrote: post #334

Earlier quoted context omitted.

> if there is no connectivity FYI, you don't need internet connectivity to pay using apple/android pay. And waving my phone at a payment device is massively more convenient than having to go to an ATM to withdraw cash, and then pay with said cash.

No connectivity for the retailer's device, not for the customer device. There are also quite a few payment terminals that still do dial-on-demand to get authorisation from the merchant service provider (Chip&PIN/NFC Contactless). I still see those in the UK especially at independent fuel stations. The additional delay waiting for the terminal to dial and connect sometimes makes me think it has failed - had a few occa…

Selling an item without contacting the tax authority's internet server and processing the transaction is illegal in my country, and others in Europe.

https://en.wikipedia.org/wiki/Fiscalization

If you want to sell anything to anyone, and you're in the VAT system, you have to be online at all times.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#378

Post by mindcrime »

Reason077 wrote: post #332
mindcrime wrote: post #230

Earlier quoted context omitted.

At best I've found chip reading to work about 60% of the time across a range of local merchants here. And now the debit card I have, which is less than a year old, has a chip which has completely quit working. Making it totally useless for the (thankfully small) number of merchants whose POS systems won't let you fall back to mag-stripe when the chip fails. As far as I'm concerned, chip cards can get stuffed. They're…

> "At best I've found chip reading to work about 60% of the time ... Making it totally useless for the (thankfully small) number of merchants whose POS systems won't let you fall back to mag-stripe" Here in the UK, many (most?) new payment terminals don't have mag-stripe readers at all. And I expect banks will start issuing new cards without a magnetic strip in the near future, if they haven't done so already. I agre…

But if your card's chip is broken, can't you just get your bank to send out a new one?

Of course I can. But that means I have to stop and take time out of my day to call my bank and dick around with them. And then if the new card comes with a new number (I don't know if it will or not), and/or expiration date (that almost certainly will change), then I have to login to EVERY SINGLE ONE of the places online where I use that card for some kind of automatic payment and change the payment details. I'm extremely loathe to do that, because it's incredibly tedious and painful, and I always miss one anyway and wind up getting scary emails about how my account is about to be closed.

Sure, my hand will probably be forced on this sooner or later. But as it stands, I just haven't cared enough to deal with all of that.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#379

Post by roguesherlock »

CSMastermind wrote: post #131
roguesherlock wrote: post #125

Do people not get any messages when they make any transactions? In my county you literally get messages for every transaction. And you also have to add in otp for every transaction online.

No - I only get asked for approval on particularly suspicious transactions, normally based on amount, merchant reputation, and geography. I believe this difference is because in the US merchants are on the hook for fraudulent transactions and in the rest of the world the customer is on the hook. So if someone steals my card and makes a bad transaction, I just go into the app, flag it as fraud/not me and no money come…

That’s very interesting. At the same, it is just better to have notifications for all parties involved ?

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#380

Post by m4jor »

ruskyhacker wrote: post #130

Funny, sawthisbon discover and immediately wondered if this was on HN. Anyway, I have a few of these I use for pentests / audits https://electroniccats.com/store/huntercat/ I've caught and reported two pumps at fuel stations near where I live. One of them I watcheded when the police showed up and with the fuel station employee removed the ble module storing the data.

So how many stripe heads is a normal reader supposed to have VS one that has a skimmer overlay on it?
Post reply on HN