Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Target's EasySweep – Simplifying Skimmer Detection

tech.target.com

Post reply on HN
Print view View original

11–20 of 151 posts

Re: Target's EasySweep – Simplifying Skimmer Detection

#11

Post by kotaKat »

noodlesUK wrote: post #6

How do these skimmers work with chip&pin? I understand how magstripe skimmers work, but my understanding is that chip&pin is an active challenge response protocol. I’d love to hear more.

The US still has a heavy reliance on magstripe, even though we rolled out EMV, and many cards still have it, and you can just take a stripe dump regardless.

The actual user of the stolen card dump will cause the terminal to allow a magstripe fallback (typically with a bad chip on a fake card that won't read) -- "aw jeez my stupid chip isn't reading" is still every much a valid excuse to a cashier to go to magstripe.

Re: Target's EasySweep – Simplifying Skimmer Detection

#12

Post by bastardoperator »

al2o3cr wrote: post #4

it allows any Target team member to easily sweep a store for skimmers I'm unclear on how this is supposed to help - unless the skimmers are being installed by frickin ninjas it seems like they already needed insider cooperation.

If the target employee cannot see the skimmer detection tool, the terminal has been compromised. Most skimmers fit on top of the terminal which would obstruct sight of this tool/layer. There are videos online of these skimmers being "installed" and it takes about 1 to 2 seconds of work and it seems anyone can do it.

Re: Target's EasySweep – Simplifying Skimmer Detection

#13

Post by noodlesUK »

CharlesW wrote: post #9
noodlesUK wrote: post #6

How do these skimmers work with chip&pin? I understand how magstripe skimmers work, but my understanding is that chip&pin is an active challenge response protocol. I’d love to hear more.

> How do these skimmers work with chip&pin? My understanding is: They don’t. If you stick to contactless payments, you’re not at risk.

The image shows the skimmer gadget sitting on top of the pin pad and the bottom card insertion slot (the one that takes a chip). On these card readers the magstripe reader is on the right hand side iirc. I’m wondering what you can do having connected to the EMV contacts and recorded the PIN. I suppose you could make a transaction, but it would have to presumably happen at the same time as the legit transaction (which would then immediately get flagged as fraudulent)

Re: Target's EasySweep – Simplifying Skimmer Detection

#14

Post by dawnerd »

groby_b wrote: post #3
starkparker wrote: post #2

Why not publicly distribute the design? Because skimmer-makers might adapt? It seems trivial to acquire one (getting a job at Target or spoofing a corp email account isn't a high barrier).

It is, however, added friction, and that's 90% of the security game. Every additional layer helps. (And a corp email account adds a paper trail, at the very least)

They also patented it so I imagine that’s part of their reasoning.

Re: Target's EasySweep – Simplifying Skimmer Detection

#15

Post by ceejayoz »

asadm wrote: post #8
al2o3cr wrote: post #4

it allows any Target team member to easily sweep a store for skimmers I'm unclear on how this is supposed to help - unless the skimmers are being installed by frickin ninjas it seems like they already needed insider cooperation.

Skimmer can be installed in seconds, just glued-on when the skimmer-guy is at the check-out.

Yup. Three seconds: https://www.youtube.com/watch?v=5b1axnNK-wI

A second guy distracting the clerk helps, too.

Re: Target's EasySweep – Simplifying Skimmer Detection

#16

Post by js2 »

noodlesUK wrote: post #6

How do these skimmers work with chip&pin? I understand how magstripe skimmers work, but my understanding is that chip&pin is an active challenge response protocol. I’d love to hear more.

Even with EMV transactions, they are apparently able to get the card # which is transmitted in clear text by the chip. And the PIN from the keyboard overlay for debit transactions. Later they can clone the card # onto a fake mag stripe card and use the fake card for card-present purchases.

They probably cannot make card-not-present (online) purchases since I don't think they can get the CVV.

https://krebsonsecurity.com/2021/02/checkout-skimmers-powere...

https://security.stackexchange.com/questions/151081/shimmers...

> In addition to the track-two data on the magnetic stripe, EMV cards generally have identical data encoded on the chip, which is read as part of the normal EMV transaction process. If an EMV reader is compromised to the extent that the conversation between the card and the terminal is intercepted, then the attacker may be able to recover both the track-two data and the PIN, allowing construction of a magnetic stripe card, which, while not usable in a Chip and PIN terminal, can be used, for example, in terminal devices that permit fallback to magstripe processing for foreign customers without chip cards, and defective cards.

https://en.wikipedia.org/wiki/EMV#Opportunities_to_harvest_P...

Re: Target's EasySweep – Simplifying Skimmer Detection

#17

Post by jerf »

starkparker wrote: post #2

Why not publicly distribute the design? Because skimmer-makers might adapt? It seems trivial to acquire one (getting a job at Target or spoofing a corp email account isn't a high barrier).

I would expect that the corporations will be asked to sign an indemnity agreement before they get the design. Target doesn't want to be held liable in case a skimmer is built that defeats this detection and the recipient needs to understand there are no guarantees.

It's nice that someone got this through the default corporate deny policies.

Re: Target's EasySweep – Simplifying Skimmer Detection

#19

Post by AYoung010 »

dangerboysteve wrote: post #18

Did I read this wrong? They are using the card chip slot to house the skimmer protection, so chip and pin will not work ?

Yes, you did I'm afraid -- this is a tool which is used to check for skimmers, not a preventative measure which is permanently installed. It only blocks the chip slot when an employee is ensuring a skimmer isn't installed on a particular terminal.

Re: Target's EasySweep – Simplifying Skimmer Detection

#20

Post by jaywalk »

dangerboysteve wrote: post #18

Did I read this wrong? They are using the card chip slot to house the skimmer protection, so chip and pin will not work ?

The device is for detection. The employees just insert it into the slot once per day and check to make sure it goes in fully. Then it's immediately removed.
Post reply on HN