Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ATM Skimmers

krebsonsecurity.com

Post reply on HN
Print view View original

41–50 of 76 posts

Re: ATM Skimmers

#41

Post by kaoD »

yeureka wrote: post #36
msluyter wrote: post #19

A while ago I split my primary bank account into several different accounts with different purposes. One, that gets the bulk of my paycheck for bills/mortgage, gets autodrafted. I never do ATM withdrawals from this account. A certain amount is autodeposited into savings for which I have no ATM card whatsoever. A secondary checking account gets a much smaller slice of my paycheck and is used exclusively for ATM withdr…

Yes, I started doing this as soon as I got a debit card after two of my friends were beat up to surrender their pin numbers. One of my friends was held for 7 hours in a tunnel by a thug while his pal was busy taking as much cash as possible and when the limit was reached he started buying expensive, easy to sell goods. He lost all of his money. I learned my lesson from his very traumatic experience.

Shit, that's scary.

I've never had any traumatic experiences like these, but I always picture myself seeking revenge.

How did your friend cope with the anger?

Re: ATM Skimmers

#42

Post by rwhitman »

rahim wrote: post #32
rwhitman wrote: post #14

This is an epidemic at gas stations in Southern California. I've been nailed by skimmers in LA, and a lot of my friends have too. My girlfriend refuses to use the debit cart option at Arco gas stations for fear of her card info being stolen again, and its a legit concern. They're impossible to spot unless you plan on trying to pry off the front of every payment kiosk, which as far as I know most banks and gas station…

I had no idea. Any particular cities/areas in particular? (I live in LA.)

Burbank, Orange County, El Segundo.. hard to tell tho because you don't find out till later

Re: ATM Skimmers

#43

Post by todd3834 »

rwhitman wrote: post #14

This is an epidemic at gas stations in Southern California. I've been nailed by skimmers in LA, and a lot of my friends have too. My girlfriend refuses to use the debit cart option at Arco gas stations for fear of her card info being stolen again, and its a legit concern. They're impossible to spot unless you plan on trying to pry off the front of every payment kiosk, which as far as I know most banks and gas station…

I can confirm this, I live in Southern California and I have had multiple cards stolen. I try not to use my card anymore but always remembering to get cash from the bank is really inconvenient.

Re: ATM Skimmers

#44

Post by rwhitman »

driverdan wrote: post #39
rwhitman wrote: post #14

This is an epidemic at gas stations in Southern California. I've been nailed by skimmers in LA, and a lot of my friends have too. My girlfriend refuses to use the debit cart option at Arco gas stations for fear of her card info being stolen again, and its a legit concern. They're impossible to spot unless you plan on trying to pry off the front of every payment kiosk, which as far as I know most banks and gas station…

The only time you should ever use your PIN number is when it's absolutely required to complete a transaction. That means at ATMs, getting cash back at a retail store, or purchasing certain items like money orders or prepaid credit cards. NEVER use your PIN outside of these transactions. It increases your risk significantly.

At Arco they only accept debit. I would never use a debit card if I could avoid it. There are much more protections and insurance on credit card transactions, but if money comes out of debit, its gone.

Re: ATM Skimmers

#45

Post by driverdan »

I'm surprised this is new to HN. The article is from 2010 and ATM skimmers have been around for 15+ years. They've become significantly more sophisticated over time. Back when I was involved with this stuff 9 years ago most people were making skimmers you had to hook up with a USB cable to get the data. Now people are using cell phone hardware to transmit the data automatically.

Re: ATM Skimmers

#46

Post by jeremyjh »

wschroed wrote: post #9
lucb1e wrote: post #3

And that's why we use chips instead of magnetic strips nowadays. For a longer list, see: https://krebsonsecurity.com/all-about-skimmers/ The one with the keylogger-featuring keypad is what has me most worried, someone could rob me of my card a bit later. Then again, they might as well rob my card and demand the code, having someone else try it while keeping me at gunpoint. Yeah guns are outlawed here, but that doesn'…

How do chips solve the problem? From my understanding, a man-in-the-middle scanner can gather enough information about query-responses to simulate the chip. This was one of the big problems identified with RFID chips embedded in passports because all a criminal would need to do is brush by other travelers with his skimmer.

The chip is authenticated with a public/private key challenge/response. The private key is never sent to the ATM; the chip actually runs a very small program/system that can generate the correct response to the challenge using its private key. The chip is powered by the contact with the ATM.

Re: ATM Skimmers

#47

Post by tlrobinson »

ck2 wrote: post #8

There also is the technique of completely replacing an ATM in say a mall. Read about that one a couple times. Some ATMs in convenience stores and even retail chains like Walgreens and CVS already look sketchy enough.

A couple years ago someone brought a fake ATM into Defcon.

Re: ATM Skimmers

#48

Post by PeterisP »

EwanToo wrote: post #7
lucb1e wrote: post #3

And that's why we use chips instead of magnetic strips nowadays. For a longer list, see: https://krebsonsecurity.com/all-about-skimmers/ The one with the keylogger-featuring keypad is what has me most worried, someone could rob me of my card a bit later. Then again, they might as well rob my card and demand the code, having someone else try it while keeping me at gunpoint. Yeah guns are outlawed here, but that doesn'…

I've yet to see a card where all the required information to clone the card isn't available on the strip too, have you?

You can clone a "magnetic card" from a chip card - it's magnetic stripe will be identical, but you won't have the private key of the chip.

And afterwards, if the bank knows that it is supposed to be a chip-capable card; and the location (country) is supposed to be chip-capable, then all mag-stripe transactions are rejected even if the "all required information" is correct.

Re: ATM Skimmers

#49

Post by PeterisP »

lucb1e wrote: post #18
wschroed wrote: post #9

Earlier quoted context omitted.

How do chips solve the problem? From my understanding, a man-in-the-middle scanner can gather enough information about query-responses to simulate the chip. This was one of the big problems identified with RFID chips embedded in passports because all a criminal would need to do is brush by other travelers with his skimmer.

The chips are sophisticated and powerful enough to setup an SSL/TLS session to the bank if needed. Just like with SSL/TLS, if it's designed correctly , intercepting the traffic between the card and POS/ATM is useless. I haven't been able to find very much on this in a few evenings that I searched for info on it, but from what I've been able to find I'm quite sure that it's possible to do. The chips give a boolean res…

They are "sort of" connecting to the bank - the idea is that the card issues an authorisation token w. the amount and other info, signs it with the private key, and then the merchant sends it to the bank which may approve or deny the transaction.

Re: ATM Skimmers

#50

Post by mturmon »

rahim wrote: post #32
rwhitman wrote: post #14

This is an epidemic at gas stations in Southern California. I've been nailed by skimmers in LA, and a lot of my friends have too. My girlfriend refuses to use the debit cart option at Arco gas stations for fear of her card info being stolen again, and its a legit concern. They're impossible to spot unless you plan on trying to pry off the front of every payment kiosk, which as far as I know most banks and gas station…

I had no idea. Any particular cities/areas in particular? (I live in LA.)

See

http://www.huffingtonpost.com/2013/02/03/credit-card-skimmin...

It's not easily avoidable.

Post reply on HN