Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Crazy Thin ‘Deep Insert’ ATM Skimmers

krebsonsecurity.com

Post reply on HN
Print view View original

431–440 of 484 posts

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#431

Post by Ancapistani »

tialaramex wrote: post #112
woodruffw wrote: post #62

Earlier quoted context omitted.

> Though I suppose the ATM company could combat this by encoding the machine's ID or a nonce with the message that the card's smart chip responds to, so it only works when replayed on that first machine - is this what happens in practice? Yes, more or less. The chip and contactless flows defined by EMV both require the card to generate a nonce for the transaction. The terminal also generates its own nonce[1]. [1]: ht…

Unfortunately "random" is a headache for a certain type of bureaucrat. They can't really do "random" or "unpredictable" and it needs somebody who actually understands what is going on to sit down and walk through how they can check whether to tick this box. For the Web PKI we had this problem extensively. No, if you set the top bit of this 128-bit integer, that's not 128 random bits. That's 127 random bits, the top o…

> as there's a tiny chance a random number fails the test

There’s ~4e23 _grains of sand_ on Earth. There are more possible values in 128 bits than grains of sand on Earth.

Take it further. There are 10^11 stars in our galaxy. If every star in the Milky Way had a planet identical to Earth orbiting it, there would be ~4e35 grains of sand on all the Earths orbiting all the stars of the Milky Way.[1]

If you assigned each of those grains to its own value, we’d only need 0.11% of the possible values of 2^128.[2]

I think it’s safe to say those bureaucrats are wrong :)

1: https://www.wolframalpha.com/input?i=%28number+of+stars+in+t...

2: https://www.wolframalpha.com/input?i=2%5E128+-+4e35

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#432

Post by mrguyorama »

ghaff wrote: post #405
SllX wrote: post #267

Earlier quoted context omitted.

Also from the US. The last business I encountered that insisted on swiping cards was this past Spring, a toy vendor in a local mall. Contactless is normal, and my issue is I will sometimes want to pay someone a tip that only takes Venmo which I just don’t have nor want to have. Cash-only is far more prevalent than card swiping, and even that is incredibly rare.

I reluctantly set up Venmo but I really don’t like services directly connected to my bank account.

I pay other people with venmo but refuse to accept payment (I'd literally rather just forgive the debt) for exactly that reason. I don't trust paypal, so they do not get access to my account.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#433

Post by mrguyorama »

MBCook wrote: post #221
_carbyau_ wrote: post #118

Earlier quoted context omitted.

> - Those tap targets on CC readers sometimes aren't where the antenna is, and you have to rub your card all over the reader to get it to work? I have no issues with the icon for tap. Although they do seem to rub off and I wonder if they are meant to have an accessible braille pattern. My dislike is tapping the screen, because then you block the visual feedback mechanism that lets you know whether it worked.

That’s what the tone is for. I have OP’s problem too. When there’s an icon it’s easy, but some terminals (older ones?) don’t have the icon anywhere but support the functionality so you just have to sort of try to figure out where it is. It can also be a problem on small terminals. The bigger ones have plenty of room, but sometimes the small ones put it awkwardly on the back where you would never look for it.

The really annoying part is that some terminals beep when the card read is done, while others beep at the start of the read, meaning if you are primed for the first type, you will prematurely take your card away and cause an error, requiring a second attempt.

This gets me every time

I actually find the "Square" based nfc readers to be the best. There's no real feedback because it's just a tiny, watch sized brick that you pass your card anywhere in the vicinity of and it reads it so fast you basically can't screw it up.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#434

Post by mrguyorama »

girvo wrote: post #185
giantg2 wrote: post #166

Earlier quoted context omitted.

I have chip malfunctions at least once per month. I assume there is dirt or debris in the terminal or on the chip.

That's wild. We've had chips on our cards in Australia for gosh-knows how long at this point, and I honestly cannot remember the last time it failed. Not that they're even used that often these days either: everything is just tap-and-go NFC payment now. And I do mean everything!

Remember that the US is huge, diverse, and opinionated, and really struggles to realize "My experience isn't everyone's experience"

I've had the chip struggle like once in my life. That was on a card very near it's expiration date. Most people I see in the store have no problems with their payment method, and when I was a cashier in 2012, people seemed to have significantly more problems getting their magstripes to scan.

All of this is SUPER dependent on which flavor/brand of POS is popular around you, the effort your bank put into making a good implementation, and whether your local merchants actually put effort into running their business and keeping equipment maintained. Pretty much nothing in this discussion is generalizeable to all of the US other than "We were late to the party of chip cards"

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#435

Post by mrguyorama »

noirbot wrote: post #90
hammock wrote: post #59

Earlier quoted context omitted.

With just about everything either chip or tap now, is there any danger in just scratching out the mag stripe of my cards?

If you go anywhere where they hold a tab open, such as a bar, you can't do that with tap/chip. Not that that's a blocker, since worst case you do a bunch of single transactions, but it's an annoyance.

This is incorrect. All the bars here in maine have no trouble opening a tab, no matter what payment method you have, including cash.

Some establishments take your card as collateral, some actually swipe it into their system to keep track, but that's not that common.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#436

Post by mrguyorama »

astura wrote: post #167
noirbot wrote: post #90

Earlier quoted context omitted.

If you go anywhere where they hold a tab open, such as a bar, you can't do that with tap/chip. Not that that's a blocker, since worst case you do a bunch of single transactions, but it's an annoyance.

>If you go anywhere where they hold a tab open, such as a bar, you can't do that with tap/chip ??? Yes you can. At least the bars around me have no problem with holding a tab with chip and/or tap. Maybe they just use newer terminals.

So many people here extrapolating a one time issue they once experienced to cover the whole 50 states of the union and all 330 million of us.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#437

Post by gtirloni »

ThePowerOfFuet wrote: post #427
Merad wrote: post #386

Earlier quoted context omitted.

This spring I left a job working with payments in a SaaS for the self storage industry. I don't remember exact numbers but the overwhelming majority of the card present payments we processed were either keyed by hand or swiped with a magtek reader. A great many self storage companies are mom and pop operations that only have one or two locations, often run by retirees to supplement their retirement income. Needless t…

> This spring I left a job working with payments in a SaaS for the self storage industry. I don't remember exact numbers but the overwhelming majority of the card present payments we processed were either keyed by hand or swiped with a magtek reader. A great many self storage companies are mom and pop operations that only have one or two locations, often run by retirees to supplement their retirement income. Needless…

> great many self storage companies are mom and pop operations that only have one or two locations

Exactly the type of company that should be getting one of those portable card readers that can be easily replaced.

It can't be harder to enter an amount in the device and ask the customer to insert card and type pin than typing numbers or swiping many times, getting signatures, etc.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#438

Post by mindcrime »

Reason077 wrote: post #421
mindcrime wrote: post #378

Earlier quoted context omitted.

But if your card's chip is broken, can't you just get your bank to send out a new one? Of course I can. But that means I have to stop and take time out of my day to call my bank and dick around with them. And then if the new card comes with a new number (I don't know if it will or not), and/or expiration date (that almost certainly will change), then I have to login to EVERY SINGLE ONE of the places online where I us…

It might depend on your bank, but if you request it, it should be possible for them to issue a new card on the same account without cancelling the old card. Your new card will have a new number and expiry date, but the old one will remain valid. In any case, these days my web browser remembers card numbers and fills them in automatically, so it’s really not such a big deal to update card numbers online.

It might depend on your bank, but if you request it, it should be possible for them to issue a new card on the same account without cancelling the old card.

That's a good point. I guess I should call them and see if that's an option. If so, that sounds like the best of both worlds.

I could also buy a phone that has NFC / tap to pay support, and link my card to Google Wallet and use that. An awful lot of the place I shop support that these days...

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#439

Post by ruskyhacker »

MerelyMortal wrote: post #285
ruskyhacker wrote: post #130

Funny, sawthisbon discover and immediately wondered if this was on HN. Anyway, I have a few of these I use for pentests / audits https://electroniccats.com/store/huntercat/ I've caught and reported two pumps at fuel stations near where I live. One of them I watcheded when the police showed up and with the fuel station employee removed the ble module storing the data.

That's cool! I think though for gas pump skimmers, there are devices that plug into the pins of the OEM card reader and just copy the data straight from the OEM card reader. (The thieves just get a universal gas pump key to open up the cover and install their device inside the pump, which is why you see those tamper stickers.)

Yeah, I've seen a few different implementations of this. The pump one I was able to watch them remove had a clone skimmer attached where your card goes which sent it's data to a bluetooth module hidden inside the service door.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#440

Post by qazxcvbnmlp »

ThePowerOfFuet wrote: post #426
qazxcvbnmlp wrote: post #313

Earlier quoted context omitted.

> Who are these businesses? Airline ticket counters… Replacing is not as simple as sending a new terminal. Then you’d have to integrate it with the legacy software workflow and modify the existing furniture at the airport to support a pin pad. Also, we have your ID and you are going to be cleaning security, so we’re pretty certain you say who you are. Regardless of the physical security of the credit card.

> > Who are these businesses? > Airline ticket counters… > Replacing is not as simple as sending a new terminal. Then you’d have to integrate it with the legacy software workflow and modify the existing furniture at the airport to support a pin pad. The rest of the world figured this out long ago; this is already a solved problem.

Oh 100%. The problem is solved. The hard part is not solving it, it’s just work to do it.
Post reply on HN