Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ATM Skimmers

krebsonsecurity.com

Post reply on HN
Print view View original

11–20 of 76 posts

Re: ATM Skimmers

#11

Post by tterrace »

wschroed wrote: post #9
lucb1e wrote: post #3

And that's why we use chips instead of magnetic strips nowadays. For a longer list, see: https://krebsonsecurity.com/all-about-skimmers/ The one with the keylogger-featuring keypad is what has me most worried, someone could rob me of my card a bit later. Then again, they might as well rob my card and demand the code, having someone else try it while keeping me at gunpoint. Yeah guns are outlawed here, but that doesn'…

How do chips solve the problem? From my understanding, a man-in-the-middle scanner can gather enough information about query-responses to simulate the chip. This was one of the big problems identified with RFID chips embedded in passports because all a criminal would need to do is brush by other travelers with his skimmer.

To make matters worse, after C&P rolled out some banks would just flat out refuse to reimburse cardholders for fraudulent charges. They claimed the system was bulletproof and if fraud did happen, then it was the cardholder's fault: http://en.wikipedia.org/wiki/Chip_and_PIN#Banks.27_liability

Re: ATM Skimmers

#12

Post by kalleboo »

I always tug at the card reader on the ATM to make sure it doesn't come loose.

What I don't understand is why don't ATMs in Europe use chip and pin yet? All the stores do. That would solve this problem.

Re: ATM Skimmers

#13

Post by kalleboo »

EwanToo wrote: post #7
lucb1e wrote: post #3

And that's why we use chips instead of magnetic strips nowadays. For a longer list, see: https://krebsonsecurity.com/all-about-skimmers/ The one with the keylogger-featuring keypad is what has me most worried, someone could rob me of my card a bit later. Then again, they might as well rob my card and demand the code, having someone else try it while keeping me at gunpoint. Yeah guns are outlawed here, but that doesn'…

I've yet to see a card where all the required information to clone the card isn't available on the strip too, have you?

I just wish banks had the option to get a card without a magstripe. I could use the chip-only card for day to day stuff and only use the magstripe when I travel to the U.S.

Re: ATM Skimmers

#14

Post by rwhitman »

This is an epidemic at gas stations in Southern California. I've been nailed by skimmers in LA, and a lot of my friends have too. My girlfriend refuses to use the debit cart option at Arco gas stations for fear of her card info being stolen again, and its a legit concern.

They're impossible to spot unless you plan on trying to pry off the front of every payment kiosk, which as far as I know most banks and gas stations frown upon...

Re: ATM Skimmers

#15

Post by kalleboo »

wschroed wrote: post #9
lucb1e wrote: post #3

And that's why we use chips instead of magnetic strips nowadays. For a longer list, see: https://krebsonsecurity.com/all-about-skimmers/ The one with the keylogger-featuring keypad is what has me most worried, someone could rob me of my card a bit later. Then again, they might as well rob my card and demand the code, having someone else try it while keeping me at gunpoint. Yeah guns are outlawed here, but that doesn'…

How do chips solve the problem? From my understanding, a man-in-the-middle scanner can gather enough information about query-responses to simulate the chip. This was one of the big problems identified with RFID chips embedded in passports because all a criminal would need to do is brush by other travelers with his skimmer.

I've seen two different kinds of reports:

* Some banks cards were vulnerable due to faulty crypto. The banks phased those cards out.

* Attacks based on a malicious PIN pad logging the PIN code, then feigning a chip error and telling the user to fall back to the magstrip, thus turning to traditional skimming.

I haven't read anything that attacks the chip itself on current cards. Do you have any links?

edit; Just found http://en.wikipedia.org/wiki/EMV#Vulnerabilities

edit2: Wikipedia TL;DR: There are two currently-relevant attacks:

* One lets attackers trick a terminal into initiating a PINless transaction in order to use a stolen card. This information is sent to the issues as part of the authentication, so a bank could deny all PINless chip charges if they wished (I'm not sure what cases this legitimately used in?), plus there's a clear trail that the cardholder isn't liable.

* The latest attack tricks the card into downgrading to an older, plaintext method of transferring the PIN from the terminal to the card, allowing the PIN to be skimmed. I'm not sure how this is useful in recreating the card to steal money.

Re: ATM Skimmers

#16

Post by peterwwillis »

kalleboo wrote: post #12

I always tug at the card reader on the ATM to make sure it doesn't come loose. What I don't understand is why don't ATMs in Europe use chip and pin yet? All the stores do. That would solve this problem.

Sometimes the real card readers will pop off easily when tugged. You can also check for pinholes for cameras, and cover the holes up with gum.

Re: ATM Skimmers

#18

Post by lucb1e »

wschroed wrote: post #9
lucb1e wrote: post #3

And that's why we use chips instead of magnetic strips nowadays. For a longer list, see: https://krebsonsecurity.com/all-about-skimmers/ The one with the keylogger-featuring keypad is what has me most worried, someone could rob me of my card a bit later. Then again, they might as well rob my card and demand the code, having someone else try it while keeping me at gunpoint. Yeah guns are outlawed here, but that doesn'…

How do chips solve the problem? From my understanding, a man-in-the-middle scanner can gather enough information about query-responses to simulate the chip. This was one of the big problems identified with RFID chips embedded in passports because all a criminal would need to do is brush by other travelers with his skimmer.

The chips are sophisticated and powerful enough to setup an SSL/TLS session to the bank if needed. Just like with SSL/TLS, if it's designed correctly, intercepting the traffic between the card and POS/ATM is useless.

I haven't been able to find very much on this in a few evenings that I searched for info on it, but from what I've been able to find I'm quite sure that it's possible to do. The chips give a boolean response as to whether the PIN number is correct and lock themselves after 3 attempts. Combined with the knowledge that 6 pins (=6 parallel bits) are used for 4 digit PIN numbers (log(10^4)/log(2)=14bits), you can deduce that it must have at least persistent storage and computational capabilities. A complete Von Neumann machine. This makes it feasible to implement algorithms like RSA and AES (asymmetric and symmetric encryption) on the chips. The POS/ATM then provides power and a connection to the desired bank, and all should be fine.

I don't really think they are that good to connect to the bank directly, but the idea that the chip is capable of this kind of crypto makes me feel better than with magnetic strips.

Re: ATM Skimmers

#19

Post by msluyter »

A while ago I split my primary bank account into several different accounts with different purposes. One, that gets the bulk of my paycheck for bills/mortgage, gets autodrafted. I never do ATM withdrawals from this account. A certain amount is autodeposited into savings for which I have no ATM card whatsoever. A secondary checking account gets a much smaller slice of my paycheck and is used exclusively for ATM withdrawals for pocket cash. (I use Simple, btw, which is quite nice.)

An unintentional side effect of this system is that it also minimizes the risk posed by ATM skimmers, since I don't keep much in the ATM account.

Re: ATM Skimmers

#20

Post by jevinskie »

rwhitman wrote: post #14

This is an epidemic at gas stations in Southern California. I've been nailed by skimmers in LA, and a lot of my friends have too. My girlfriend refuses to use the debit cart option at Arco gas stations for fear of her card info being stolen again, and its a legit concern. They're impossible to spot unless you plan on trying to pry off the front of every payment kiosk, which as far as I know most banks and gas station…

I always jiggle the reader with a bit of gusto before I use an ATM. All of the ATMs that I have found have been sturdy enough that I don't worry about damaging them.
Post reply on HN