Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ATM Skimmers

krebsonsecurity.com

Post reply on HN
Print view View original

61–70 of 76 posts

Re: ATM Skimmers

#61

Post by hnriot »

yeureka wrote: post #36
msluyter wrote: post #19

A while ago I split my primary bank account into several different accounts with different purposes. One, that gets the bulk of my paycheck for bills/mortgage, gets autodrafted. I never do ATM withdrawals from this account. A certain amount is autodeposited into savings for which I have no ATM card whatsoever. A secondary checking account gets a much smaller slice of my paycheck and is used exclusively for ATM withdr…

Yes, I started doing this as soon as I got a debit card after two of my friends were beat up to surrender their pin numbers. One of my friends was held for 7 hours in a tunnel by a thug while his pal was busy taking as much cash as possible and when the limit was reached he started buying expensive, easy to sell goods. He lost all of his money. I learned my lesson from his very traumatic experience.

It took 7 hours for the thugs to reach the daily ATM maximum limit? How do you buy expensive goods with an ATM card? That sounds completely bogus to me.

Re: ATM Skimmers

#62

Post by yeureka »

kaoD wrote: post #41
yeureka wrote: post #36

Earlier quoted context omitted.

Yes, I started doing this as soon as I got a debit card after two of my friends were beat up to surrender their pin numbers. One of my friends was held for 7 hours in a tunnel by a thug while his pal was busy taking as much cash as possible and when the limit was reached he started buying expensive, easy to sell goods. He lost all of his money. I learned my lesson from his very traumatic experience.

Shit, that's scary. I've never had any traumatic experiences like these, but I always picture myself seeking revenge. How did your friend cope with the anger?

This was back in the middle 90's. Here's the full story:

My friend was working out of town in a suburb of Lisbon and had to take a train everyday in the reverse flow ( commuters were coming in to the center, he was going out ) so the train was pretty empty one day and he was alone in the carriage.

Two guys walk in, sit next to him and one of them produces a dirty syringe, says he has HIV and that the my friend better cooperate or else.

They escort him out on the next station and go into the tunnel where the syringe guy held him for all that time.

For the next few days he was completely paranoid and he had a friend in the police who tried to find the robbers but unfortunately they couldn't.

"All is money" at the time ( he was 19 ) was around $3000 in today's money, and the bank didn't help ( it wasn't a credit card ). He had no form of insurance either.

He was always a very shy and inward person and that episode made him much more so.

But the years have passed and now he is quite normal and has become a really good 3D artist.

I haven't met him since I left Portugal but I guess he doesn't like to talk about this episode.

Another friend of mine was beaten up when he refused to give his pin and two other friends just gave it without resistance.

This is why I always have just enough money for daily expenses on the card bank account. It means I have to constantly top up that account which could be another security problem but at least if I am confronted with a violent situation I'll just give my stuff away and minimize my risk of physical damage.

[EDIT] Actually I was just on his website looking at his recent work and maybe he was more affected than what I imagined.

Re: ATM Skimmers

#63

Post by yeureka »

hnriot wrote: post #61
yeureka wrote: post #36

Earlier quoted context omitted.

Yes, I started doing this as soon as I got a debit card after two of my friends were beat up to surrender their pin numbers. One of my friends was held for 7 hours in a tunnel by a thug while his pal was busy taking as much cash as possible and when the limit was reached he started buying expensive, easy to sell goods. He lost all of his money. I learned my lesson from his very traumatic experience.

It took 7 hours for the thugs to reach the daily ATM maximum limit? How do you buy expensive goods with an ATM card? That sounds completely bogus to me.

Mobile phones where not so common at the time ( circa 1995, Portugal), so the guy holding him couldn't tell how much money was in the bank account and how long his "partner" would take to empty it.

Large transactions are more difficult to pull than smaller ones and I guess the guy was sampling the limits of the card with reasonable sized chunks.

But to rationalize the actions of a heroin junkie is hard and I won't try.

Re: ATM Skimmers

#64

Post by joelhaasnoot »

Just today I was in the test lab for the ticketing machines at the transport company I work for. Our machines being unattended and often in public spaces, skimming is a real concern (and it has happened to me personally).

The solution? Adding a plate with random bumps to each machine, and also adding a contraption infront of the card slot into which you place your card and then slide it in (see http://blog.webwereld.nl/wp-content/uploads/2009/08/nspas.jp... ). This last solution seems to be patented BTW.

Re: ATM Skimmers

#65

Post by blhack »

match wrote: post #59
tlrobinson wrote: post #47

Earlier quoted context omitted.

A couple years ago someone brought a fake ATM into Defcon.

I'd also like to point out that it was placed there by local criminals, not the conference attendees. It was however discovered by the attendees and the hotel was notified and the offending ATM was turned over to police.

Were these the most idiotic criminals of all time?

"Hey, Bob! Let's place our ATM skimmer right in the middle of a bunch of FBI goons and security experts!"

Re: ATM Skimmers

#67

Post by rwhitman »

Shivetya wrote: post #54
rwhitman wrote: post #14

This is an epidemic at gas stations in Southern California. I've been nailed by skimmers in LA, and a lot of my friends have too. My girlfriend refuses to use the debit cart option at Arco gas stations for fear of her card info being stolen again, and its a legit concern. They're impossible to spot unless you plan on trying to pry off the front of every payment kiosk, which as far as I know most banks and gas station…

there certainly has to be a method that could be devised to prevent this type of fraud. Visually a lot could be done that should foil someone looking to attach a skimmer. From continuous images, seamless faces to make it obvious something is added on, to screen based keyboards. I am sure a lot of thought is put into it. I would hazard that the losses are not sufficient to fix it.

I agree completely. For a bank ATM I'm sure that they have a lot to lose from skimmers, as it affects their customers' accounts. But for a gas station, a generic ATM do they really stand to lose much from the skimmer? They still get your money. And in many cases I'm suspicious that its shifty gas station employees, store clerks that are installing these things in the first place. Who else has the time to go and study the layout of the card reader, maintain it and retrieve the data etc without getting caught? The only way there is going to be a real change is with legislation in my opinion

Re: ATM Skimmers

#68

Post by squozzer »

I want to thank HN for possibly saving my arse. During my lunch break, I put some gas in my car. During the fill-up, I noticed the anti-tamper stickers on the pump were all broken. I paid it no mind, finished the fueling, bought some lotto tix with cash, then left.

Came back to my desk, fired up HN, and read the article upon which we are commenting. Simmered in paranoia for a little while, then called up my bank and told them my card might have been compromised. New card with new number on the way.

Now just have to remind myself to check my transactions until the new card arrives.

Re: ATM Skimmers

#69

Post by raverbashing »

wschroed wrote: post #9
lucb1e wrote: post #3

And that's why we use chips instead of magnetic strips nowadays. For a longer list, see: https://krebsonsecurity.com/all-about-skimmers/ The one with the keylogger-featuring keypad is what has me most worried, someone could rob me of my card a bit later. Then again, they might as well rob my card and demand the code, having someone else try it while keeping me at gunpoint. Yeah guns are outlawed here, but that doesn'…

How do chips solve the problem? From my understanding, a man-in-the-middle scanner can gather enough information about query-responses to simulate the chip. This was one of the big problems identified with RFID chips embedded in passports because all a criminal would need to do is brush by other travelers with his skimmer.

No, it can't. The chip works with a challenge/response system (and this only works after the pin is input to the chip)

What happens is that they clone the magnetic strip, so sometimes that and pin is enough to produce a card that does withdraws.

Re: ATM Skimmers

#70

Post by raverbashing »

lucaspiller wrote: post #26
kalleboo wrote: post #13

Earlier quoted context omitted.

I just wish banks had the option to get a card without a magstripe. I could use the chip-only card for day to day stuff and only use the magstripe when I travel to the U.S.

You can easily demagnetise it, with even a kitchen magnet [0]. [0] http://lifehacker.com/5780617/how-to-prevent-yourself-from-o...

Yes

And then your card is useless when in a place that only reads the stripe (like, that uses Square)

Post reply on HN