Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Crazy Thin ‘Deep Insert’ ATM Skimmers

krebsonsecurity.com

Post reply on HN
Print view View original

451–460 of 484 posts

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#451

Post by dredmorbius »

xtiansimon wrote: post #381
NavinF wrote: post #348

Earlier quoted context omitted.

The vast majority of terminals in the US use chip, but I doubt the US will ever require pin numbers for credit card purchases. It's just too inconvenient. Banks are willing to eat the tiny reversed transactions in exchange for making the payment flow more efficient.

“Banks are willing to eat the tiny reversed transactions…” Banks? A chargeback goes to the business.

This.

And the public eat the inconvenience of having fraud transacted on their behalf.

Why merchants don't insist on C&P isn't clear, though I suspect that distributed liability, ignorance, disaggregated political voice (see Mancur Olson's "Logic of Collective Action" https://www.thoughtco.com/the-logic-of-collective-action-114...>), as well as asymmetric cost/benefit incentives between specific retail points-of-presence (store managers and franchise owners) vs. corporate purchasing and policy (see the McDonalds ice cream machine fraud https://www.wired.com/story/they-hacked-mcdonalds-ice-cream-...>. Multiple HN discussions: https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...>.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#452

Post by kibibyte »

mcv wrote: post #351
kibibyte wrote: post #320

Earlier quoted context omitted.

Old payment card RFID contactless was really insecure; it basically spat out the data on the magnetic stripe. New contactless is directly tied to the EMV chips and requires the whole cryptographic round trip and such. You can put a protective sleeve around your cards if you want, but it doesn't really add much in real security anymore.

If payment can be authorized through the chip by mere proximity, without any explicit authorization by the owner, then it's still insecure. Of course the thief would need to have an official payment terminal, but those are everywhere. I use my app, not my card, for this reason.

Technically yes you are correct, but the threat model here is similar to someone grabbing a card from you and dipping it into a terminal chip reader without your permission. This is what the PIN part of chip-and-PIN protects against; the chip part (also applicable to EMV contactless) protects against card duplication and transaction replay.

There is a huge difference between this kind of attack and what an attacker can do with the old scheme of magnetic swipe data over RFID. With the former, the only thing an attacker can do is perform a real transaction in that moment; this transaction leaves behind an audit trail tied to a real merchant (the operator of the terminal) and their bank account. An attacker cannot, however, initiate additional payments without accessing the payment card again, and without access to the cryptographic secrets held by the payment service provider, they cannot extract the card number to use for online transactions.

With the latter, it's equivalent to skimming a the magnetic stripe: an attacker can clone the card and reuse it for transactions as often as they'd like for whatever amounts they can authorize. In addition, they will have access to the plaintext card number, which would allow them to use it for online transactions. And absolutely none of this leaves behind an audit trail of how the attacker got your card.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#453

Post by kibibyte »

pinebox wrote: post #403
kibibyte wrote: post #318

Earlier quoted context omitted.

With gas stations, there is so much more to it than just replacing a card reader in the kiosk, or even just replacing the kiosk itself. You may have to even tear out all of the old networking equipment. https://news.ycombinator.com/item?id=28207062

Thanks, but the post you linked is making me irrationally angry. Why does a gas pump card reader need full internet connectivity?! It's outrageous! Just use the two wires to talk to a head unit in the building! Then it brings up the gas pump advertising screens which are already a sore point for me (two conveniently located stations have these, so I can't go there anymore because I find the accompanying audio intoler…

EMV is a very very chatty protocol, basically.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#454

Post by ThePowerOfFuet »

adventured wrote: post #181
Macha wrote: post #152

Earlier quoted context omitted.

I've seen a few people in the US mention "when the chip isn't working". I don't think I've encountered this... ever? Of course, when the merchant's only alternative is handling cash, maybe there's more incentive to keep the card machine in order

When it comes to dipping the chip, it can wear down after a lot of use and stop functioning. I've never run into a problem with tapping however. Here's an example image from a NY Times story about chips wearing down: https://i.imgur.com/XlKEBsc.jpg The last card I replaced due to chip wear, the chip looked even worse than that.

That is a totally acceptable amount of wear.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#455

Post by ThePowerOfFuet »

seanmcdirmid wrote: post #301
giantg2 wrote: post #81

Earlier quoted context omitted.

The small number of places with older swipe only terminals. Or when the chip isn't working (Lowes has a stripe reader on the register if the main terminal isn't working; mainly used for gift cards though). And finally, an alert employee might not accept a damaged card.

Also, when you use self check in terminals at the airport, if you use your credit card for ID, it only works via swipe.

Credit card for ID?

This explains a lot.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#456

Post by ThePowerOfFuet »

mbreese wrote: post #105
noirbot wrote: post #90

Earlier quoted context omitted.

If you go anywhere where they hold a tab open, such as a bar, you can't do that with tap/chip. Not that that's a blocker, since worst case you do a bunch of single transactions, but it's an annoyance.

Originally I was thinking they could handle an open tab like a gas station — place a hold on the card for $X for an open tab. But then, the more I thought about it, I’m not sure I want to be the bartender that has to explain why there was a hold of $100 on a college kid’s debit card. Sorry you can’t buy lunch, but the hold will get released in a few days, so it’s ok! There’s got to be a better way…

If the merchant is closing out the preauth correctly, the remainder of the hold is released on the spot.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#457

Post by ThePowerOfFuet »

samatman wrote: post #366
Semaphor wrote: post #257

Earlier quoted context omitted.

The whole "giving your card away" thing is so foreign to me (German). Fuck no, I’m not giving you my card. In restaurants and bars they either come by with their handheld terminal, or you go to the machine at the register and simply pay like in any other place.

America having invented the dining (later credit) card, we have some customs remaining from when they worked analog. I understand why Germany, a poorer country which was late to electronic payments, wouldn't do this; I don't understand the hostility to it. But then, I'm American, we've been doing this longer than you've been alive.

> I understand why Germany, a poorer country which was late to electronic payments, wouldn't do this; I don't understand the hostility to it. But then, I'm American, we've been doing this longer than you've been alive.

You mean payments between banks that take two to three days within the country instead of a regulated maximum of 15 seconds across borders?

It's a shame you're so salty that the rest of the world has far overtaken the US. You may have been doing it "longer", but you've absolutely failed to iterate and are still stuck with obsolete technology that's rife with fraud, for which a more appropriate feeling than saltiness is shame.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#458

Post by ThePowerOfFuet »

bri3d wrote: post #157
samatman wrote: post #143

Earlier quoted context omitted.

Do you not give them the card, then they swipe it once at the end and you get it back? How does a stripe affect that?

There are a large number of “smart” tab systems in use in US bars where the system retains your magnetic stripe data for the duration of your visit. You pass off your card, it is swiped and immediately returned. If you don’t settle your tab, it’s automatically settled with a pre-set tip using the stored track data. It’s convenient for bar owners and patrons as the bar doesn’t have leftover cards to deal with and the…

> There are a large number of “smart” tab systems in use in US bars where the system retains your magnetic stripe data for the duration of your visit.

What a security nightmare.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#459

Post by fennecfoxy »

aembleton wrote: post #360
trasz wrote: post #359

Earlier quoted context omitted.

NFC is kind of old too. In some countries, like China, it's already been replaced by phone payments.

NFC means I can pay with my watch. I think in China they rely upon phone cameras and QR codes. Great if you've got your phone with you, but I can go out for a run with just my watch and pay using NFC.

Yeah this is what I do, taking my watch out for a run and being able to track my run, etc. Then being able to stop at a shop on the way back for a cold drink or to pick up some groceries and just pay with the watch is so convenient.

Sucks that everything else about smart watches sucks tho. Thanks to Apple making the "pretty" Apple watch, other brands have forgone things like eink/mip displays that get better battery life. :/

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#460

Post by blep-arsh »

mcv wrote: post #351
kibibyte wrote: post #320

Earlier quoted context omitted.

Old payment card RFID contactless was really insecure; it basically spat out the data on the magnetic stripe. New contactless is directly tied to the EMV chips and requires the whole cryptographic round trip and such. You can put a protective sleeve around your cards if you want, but it doesn't really add much in real security anymore.

If payment can be authorized through the chip by mere proximity, without any explicit authorization by the owner, then it's still insecure. Of course the thief would need to have an official payment terminal, but those are everywhere. I use my app, not my card, for this reason.

They would also need a bank account. I'm not sure whether it's possible to receive card payments anonymously.
Post reply on HN