Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Nordstrom Finds Cash Register Skimmers

krebsonsecurity.com

Post reply on HN
Print view View original

11–20 of 83 posts

Re: Nordstrom Finds Cash Register Skimmers

#11

Post by ufmace »

ohazi wrote: post #5

chip and fucking pin. sigh This problem is solved, yet practically nobody in the US is demanding the established solution. Until we do, this is only going to continue.

Sounds like it depends more on how sophisticated the readers are. The current ones are apparently pretty dumb, and just pretend to be a PS2 keyboard and send the info as keypresses, since the guys in the article just used a off-the-shelf keylogger to steal the data. You could easily make a chip and pin pad that did the same thing and was just as easy to compromise.

For real security, you'd need to do something like have the reader internally encrypt the data with the card processor's public key and only send an encrypted blob out of the device. If you're doing that, then anything's secure against this kind of attack. But the readers would have to cost like 10x more, and it probably isn't enough of a problem to bother replacing them all.

Re: Nordstrom Finds Cash Register Skimmers

#12

Post by _pmf_ »

triton wrote: post #10
300bps wrote: post #3

There is very little true security in retail establishments. This lady simply swapped bar codes on expensive items for bar codes of inexpensive items. Got away with it for over a year and made as much as $30,000 per month in some months: http://miami.cbslocal.com/latest-videos/?autoStart=true&topV...

I'll admit to doing similar at the self checkouts at my local supermarket. Quite happily put pink lady apples through as cheap ones. I started doing this after I watched a whole tray of pink lady apples go in a skip because they brought new produce out. The same is true of a lt of retail establishments. Old stock is destroyed to keep prices up.

In some countries, this is fraud as opposed to theft, leading to significantly higher penalties.

Re: Nordstrom Finds Cash Register Skimmers

#14

Post by eksith »

I once worked for a retailer which was connected via Megapath (they outsourced to whatever local ISP is available at the store location). The internet setup was so abysmal in security, in some cases the stores used wifi to connect to the front registers with the password being (not kidding) [storename:storenumber]. That's it.

These fools are getting caught doing elaborate plants. That's not how real criminals key log (btw, this is not a skimmer, but is a 'keylogger' as joenathan points out). Real criminals sit in the comfort of their car or nearby coffee shop and scan for open connections and insecure use of credentials.

Re: Nordstrom Finds Cash Register Skimmers

#15

Post by crazygringo »

raverbashing wrote: post #9
yajoe wrote: post #6

Earlier quoted context omitted.

I work in the industry. Chip and pin is not statistically safer (fraud rates in Spain, UK, and US are all the same despite having very different payment landscapes). The fundamental problem is that in traditional chip-and-pin setups you also type the pin into the same machine... so adding a skimmer + video camera OR adding a skimmer that records pin is marginally possible and not that hard. The real security would co…

"fraud rates in Spain, UK," for what? Credit cards? Debit? There's always going to be fraud one way or another. "you also type the pin into the same machine... so adding a skimmer..." There's no copying of SIM Cards. Yes, you can still copy the magnetic stripe that's there for backwards compatibility. So, yes, it's not going to be safer while there's support for old technology. My (European) bank issued me a chip-and…

Not good for travels to the US! :)

Re: Nordstrom Finds Cash Register Skimmers

#16

Post by eps »

joenathan wrote: post #13

These are keyloggers and not skimmers, a skimmer looks something like this http://scams.wikispaces.com/file/view/camera02.jpg/30681221/...

Look up the guy whose blog this is. Also, it might help to read the article in full before blurting out trivialities.

Re: Nordstrom Finds Cash Register Skimmers

#17

Post by eps »

yajoe wrote: post #6
ohazi wrote: post #5

chip and fucking pin. sigh This problem is solved, yet practically nobody in the US is demanding the established solution. Until we do, this is only going to continue.

I work in the industry. Chip and pin is not statistically safer (fraud rates in Spain, UK, and US are all the same despite having very different payment landscapes). The fundamental problem is that in traditional chip-and-pin setups you also type the pin into the same machine... so adding a skimmer + video camera OR adding a skimmer that records pin is marginally possible and not that hard. The real security would co…

You don't seem to know what a chip card is.

It is the second factor in a two-factor authentication scheme.

Re: Nordstrom Finds Cash Register Skimmers

#18

Post by linkregister »

ohazi wrote: post #5

chip and fucking pin. sigh This problem is solved, yet practically nobody in the US is demanding the established solution. Until we do, this is only going to continue.

In the UK and EU, chip and pin carry with it some nasty liability problems. That is, the consumer is now de facto liable for all fraud that happens, in spite of the statute.[1] A significant amount of skimming still occurs in the EU.[2] The protocol, just like the traditional charge card method, used is considered insecure.[3]

The U.S. method, where the low-security retailer is liable, is the most fair. The current charge back system works. Retailers that use inventory control, secure systems, and require ID with large purchases receive few legitimate charge backs. [4]

[1] http://www.cl.cam.ac.uk/~rja14/Papers/unattack.pdf

[2] http://www.telegraph.co.uk/news/uknews/law-and-order/3173346...

[3] http://www.techrepublic.com/blog/it-security/chip-and-pin-th...

[4] http://www.internetretailer.com/2012/10/31/how-karmaloop-cle...

Re: Nordstrom Finds Cash Register Skimmers

#19

Post by raverbashing »

crazygringo wrote: post #15
raverbashing wrote: post #9

Earlier quoted context omitted.

"fraud rates in Spain, UK," for what? Credit cards? Debit? There's always going to be fraud one way or another. "you also type the pin into the same machine... so adding a skimmer..." There's no copying of SIM Cards. Yes, you can still copy the magnetic stripe that's there for backwards compatibility. So, yes, it's not going to be safer while there's support for old technology. My (European) bank issued me a chip-and…

Not good for travels to the US! :)

Yes, I'm not sure about the US, but it worked like a charm in Canadian ATMs

Re: Nordstrom Finds Cash Register Skimmers

#20

Post by ChuckMcM »

This is another interesting case because it points out how vulnerable this part of the financial transaction chain is. Of course even after they catch the guys who were installing the skimmers they don't get the 'top' guys who make the fake cards and then withdraw funds in Serbia.

I did see a talk where the folks noted (but did not remove) such devices and then began tracking every account that went through the modified device. This was to figure out who the bad guys were. By watching the fraudulent transactions that happened later they were able to roll up a carding group in the Baltics. But it does take a more proactive approach.

From a future products prospective the use of cards with embedded processors seems better and better.

Post reply on HN