Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ATM Skimmers

krebsonsecurity.com

Post reply on HN
Print view View original

21–30 of 76 posts

Re: ATM Skimmers

#21

Post by UnoriginalGuy »

wschroed wrote: post #9
lucb1e wrote: post #3

And that's why we use chips instead of magnetic strips nowadays. For a longer list, see: https://krebsonsecurity.com/all-about-skimmers/ The one with the keylogger-featuring keypad is what has me most worried, someone could rob me of my card a bit later. Then again, they might as well rob my card and demand the code, having someone else try it while keeping me at gunpoint. Yeah guns are outlawed here, but that doesn'…

How do chips solve the problem? From my understanding, a man-in-the-middle scanner can gather enough information about query-responses to simulate the chip. This was one of the big problems identified with RFID chips embedded in passports because all a criminal would need to do is brush by other travelers with his skimmer.

Physically how would you perform a man-in-the-middle? I think you're confusing the chip-and-pin chip (EMV) with an RFID chip.

EMV is a contact system that requires physical metal pins to touch multiple contacts on the top of the chip itself.

Re: ATM Skimmers

#22

Post by lucb1e »

EwanToo wrote: post #7
lucb1e wrote: post #3

And that's why we use chips instead of magnetic strips nowadays. For a longer list, see: https://krebsonsecurity.com/all-about-skimmers/ The one with the keylogger-featuring keypad is what has me most worried, someone could rob me of my card a bit later. Then again, they might as well rob my card and demand the code, having someone else try it while keeping me at gunpoint. Yeah guns are outlawed here, but that doesn'…

I've yet to see a card where all the required information to clone the card isn't available on the strip too, have you?

Good point, I hadn't thought of that. I suppose I should call my bank and ask them. But how do I know what they're saying is true? Usually when you call support (never tried calling a bank) you get some blonde that tells you nothing except that "everything is secure!"...

On the other hand, the card doesn't slide all the way in anymore. Just far enough so that it sticks and it can read the contacts, so at least they can't grab all the information on it.

Re: ATM Skimmers

#23

Post by lucb1e »

tterrace wrote: post #11
wschroed wrote: post #9

Earlier quoted context omitted.

How do chips solve the problem? From my understanding, a man-in-the-middle scanner can gather enough information about query-responses to simulate the chip. This was one of the big problems identified with RFID chips embedded in passports because all a criminal would need to do is brush by other travelers with his skimmer.

To make matters worse, after C&P rolled out some banks would just flat out refuse to reimburse cardholders for fraudulent charges. They claimed the system was bulletproof and if fraud did happen, then it was the cardholder's fault: http://en.wikipedia.org/wiki/Chip_and_PIN#Banks.27_liability

Unfortunately it's regular practice to say that things are bulletproof and airtight :/

Re: ATM Skimmers

#24

Post by didsomeonesay »

kalleboo wrote: post #12

I always tug at the card reader on the ATM to make sure it doesn't come loose. What I don't understand is why don't ATMs in Europe use chip and pin yet? All the stores do. That would solve this problem.

If you suspect a skimmer, be aware that the person operating the skimmer might be close-by and not too pleased to see you take it apart.

Re: ATM Skimmers

#25

Post by objclxt »

kalleboo wrote: post #12

I always tug at the card reader on the ATM to make sure it doesn't come loose. What I don't understand is why don't ATMs in Europe use chip and pin yet? All the stores do. That would solve this problem.

> Why don't ATMs in Europe use chip and pin yet?

Many of them do - one security feature is to have the ATM pull the card very, very slowly into the slot whilst oscillating them to prevent skimmers reading the mag strip, as it's no longer required (unlike the US, nearly all ATMs here in the UK feed the card in automatically, rather than manually dipping it). If you're not used to this you might think the machine was on the way out.

Even with ATMs that support EMV (chip and PIN) you still run into the problem that a) ATM design inherently involves pushing the card into something, which could allow the mag stripe to be raed, and b) as long as there are ATMs and places that don't use EMV then there's always going to be a way to get money out / buy product with cloned cards.

Re: ATM Skimmers

#26

Post by lucaspiller »

kalleboo wrote: post #13
EwanToo wrote: post #7

Earlier quoted context omitted.

I've yet to see a card where all the required information to clone the card isn't available on the strip too, have you?

I just wish banks had the option to get a card without a magstripe. I could use the chip-only card for day to day stuff and only use the magstripe when I travel to the U.S.

You can easily demagnetise it, with even a kitchen magnet [0].

[0] http://lifehacker.com/5780617/how-to-prevent-yourself-from-o...

Re: ATM Skimmers

#27

Post by nutate »

msluyter wrote: post #19

A while ago I split my primary bank account into several different accounts with different purposes. One, that gets the bulk of my paycheck for bills/mortgage, gets autodrafted. I never do ATM withdrawals from this account. A certain amount is autodeposited into savings for which I have no ATM card whatsoever. A secondary checking account gets a much smaller slice of my paycheck and is used exclusively for ATM withdr…

I do the same thing. It helped when I did get skimmed. Looking back the card slot was slightly wobbly. Now I always check. My credit union contacted me the same day, hours after the skimmage and everything was taken care of practically instantly.

Re: ATM Skimmers

#28

Post by nutate »

objclxt wrote: post #25
kalleboo wrote: post #12

I always tug at the card reader on the ATM to make sure it doesn't come loose. What I don't understand is why don't ATMs in Europe use chip and pin yet? All the stores do. That would solve this problem.

> Why don't ATMs in Europe use chip and pin yet? Many of them do - one security feature is to have the ATM pull the card very, very slowly into the slot whilst oscillating them to prevent skimmers reading the mag strip, as it's no longer required (unlike the US, nearly all ATMs here in the UK feed the card in automatically, rather than manually dipping it). If you're not used to this you might think the machine was o…

I had an ATM card eaten in London on vacation because I couldn't recall the PIN.

That was a weird moment.

Re: ATM Skimmers

#29

Post by cadab »

objclxt wrote: post #25
kalleboo wrote: post #12

I always tug at the card reader on the ATM to make sure it doesn't come loose. What I don't understand is why don't ATMs in Europe use chip and pin yet? All the stores do. That would solve this problem.

> Why don't ATMs in Europe use chip and pin yet? Many of them do - one security feature is to have the ATM pull the card very, very slowly into the slot whilst oscillating them to prevent skimmers reading the mag strip, as it's no longer required (unlike the US, nearly all ATMs here in the UK feed the card in automatically, rather than manually dipping it). If you're not used to this you might think the machine was o…

Heh, I didnt know about the automatic feeding, I always get annoyed that these ATM's are slow and old.

Re: ATM Skimmers

#30

Post by pault »

msluyter wrote: post #19

A while ago I split my primary bank account into several different accounts with different purposes. One, that gets the bulk of my paycheck for bills/mortgage, gets autodrafted. I never do ATM withdrawals from this account. A certain amount is autodeposited into savings for which I have no ATM card whatsoever. A secondary checking account gets a much smaller slice of my paycheck and is used exclusively for ATM withdr…

I do this as well, mostly because I do a lot of third world traveling and it's easy to get your card cloned. I only keep $500 in the checking account linked to my debit card, and the rest in a savings account that I can transfer money from instantly. I did have my card cloned once and this technique saved many thousands of dollars from being spent. I would have recovered it all eventually but it takes weeks and it would be a disaster while on the road.
Post reply on HN