Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Target's EasySweep – Simplifying Skimmer Detection

tech.target.com

Post reply on HN
Print view View original

31–40 of 151 posts

Re: Target's EasySweep – Simplifying Skimmer Detection

#31

Post by js2 »

e28eta wrote: post #28
js2 wrote: post #16

Earlier quoted context omitted.

Even with EMV transactions, they are apparently able to get the card # which is transmitted in clear text by the chip. And the PIN from the keyboard overlay for debit transactions. Later they can clone the card # onto a fake mag stripe card and use the fake card for card-present purchases. They probably cannot make card-not-present (online) purchases since I don't think they can get the CVV. https://krebsonsecurity.c…

They might not need CVV, if the transaction looks “good” otherwise: > A payment can still be successful even if the CVC or postal code check fails. This is because card issuers take many signals into account when making a decision about whether to approve or decline a payment. In some cases, a card issuer may still approve a payment they consider legitimate, even if the CVC or postal code verification check fails. so…

:-(

I recently went through the opposite of this. A purchase at denon.com was declined, got a "please verify" email from my issuer which I approved and re-did the purchase. My issuer authorized the payment the second time, but then it got held up by NoFraud who sent me their own "please verify" email which I did. I had used an iCloud Hide My Email address for the purchase so a day later I get another email from NoFraud:

> Thank you for confirming your recent order. We are the fraud solution for the merchants website. We flagged the order for additional review before we notify the merchant to process it. To complete the verification for approval, we require an alternate email address for the cardholder. Please respond with an alternate email address.

At that point I tracked down NoFraud's phone # and called them to finally get the transaction approved.

Re: Target's EasySweep – Simplifying Skimmer Detection

#32

Post by duskwuff »

NoMoreNicksLeft wrote: post #29
HWR_14 wrote: post #26

Earlier quoted context omitted.

You read it wrong. It's not permanently attached. They stick a very precise 3D object in the chip slot, and if it doesn't fit, that means the slot isn't the exact same as how the reader was made from the manufacturer. So you get a cashier to do that at the start of their shift, and if anything is detected they call out a more trained repair man/security professional to figure out if there is a skimmer.

So the skimmer asshole pays some Target employee $100 to replace the very precise 3d object with one that hides the skimmer when no one's looking? I need a solution that lets me, the card holder, check these. This ain't it. Hell, some of the internal skimmers just solder jumper wires to pcb pins/testpoints don't they? There's nothing mechanical for a card to touch. Target's got so many telescreen cameras in the store…

> Hell, some of the internal skimmers just solder jumper wires to pcb pins/testpoints don't they?

No. Most modern card terminals are tamper-resistant and will erase key material if opened.

(Besides, it's not like you're going to be able to casually crack open a payment terminal, pull out a soldering iron, and modify it while you're standing in the store checkout line.)

Re: Target's EasySweep – Simplifying Skimmer Detection

#33

Post by HWR_14 »

NoMoreNicksLeft wrote: post #29
HWR_14 wrote: post #26

Earlier quoted context omitted.

You read it wrong. It's not permanently attached. They stick a very precise 3D object in the chip slot, and if it doesn't fit, that means the slot isn't the exact same as how the reader was made from the manufacturer. So you get a cashier to do that at the start of their shift, and if anything is detected they call out a more trained repair man/security professional to figure out if there is a skimmer.

So the skimmer asshole pays some Target employee $100 to replace the very precise 3d object with one that hides the skimmer when no one's looking? I need a solution that lets me, the card holder, check these. This ain't it. Hell, some of the internal skimmers just solder jumper wires to pcb pins/testpoints don't they? There's nothing mechanical for a card to touch. Target's got so many telescreen cameras in the store…

> So the skimmer asshole pays some Target employee $100 to replace the very precise 3d object with one that hides the skimmer when no one's looking?

They replace the objects every 6 months. And there are multiples. So, yeah, I guess it's doable.

> I need a solution that lets me, the card holder, check these.

You could just print one and carry it with you.

> some of the internal skimmers just solder jumper wires to pcb pins/testpoints don't they?

At the point, there's no real security. If that's your threat model, you can just substitute the entire reader for a counterfeit one.

> Target's got so many telescreen cameras in the store, they could likely get the pin numbers straight from that

If you are as paranoid as you sound, you should be covering your hand putting the PIN in with your other hand.

You seem to not understand the threat threat models. A skimmer is a 3 second attack that requires no accomplice and can be done with slight of hand while people are watching. Making that scale to a multi-person operation with more physical construction, the need to swap out (and hide) a bunch of red plastic going in and out is a win. In much the same way that locking your jewelry in a small safe isn't going to stop determined thieves, but will make casual thieves abandon it.

Re: Target's EasySweep – Simplifying Skimmer Detection

#34

Post by clintonb »

NoMoreNicksLeft wrote: post #29
HWR_14 wrote: post #26

Earlier quoted context omitted.

You read it wrong. It's not permanently attached. They stick a very precise 3D object in the chip slot, and if it doesn't fit, that means the slot isn't the exact same as how the reader was made from the manufacturer. So you get a cashier to do that at the start of their shift, and if anything is detected they call out a more trained repair man/security professional to figure out if there is a skimmer.

So the skimmer asshole pays some Target employee $100 to replace the very precise 3d object with one that hides the skimmer when no one's looking? I need a solution that lets me, the card holder, check these. This ain't it. Hell, some of the internal skimmers just solder jumper wires to pcb pins/testpoints don't they? There's nothing mechanical for a card to touch. Target's got so many telescreen cameras in the store…

The solution for cardholders is to use tap-to-pay.

Frankly, as a _credit_ cardholder with zero liability, I’m not overly-concerned by skimmers. I won’t lose anything. The card tax is already baked into all prices, so there’s no real benefit for me to solve this problem.

Re: Target's EasySweep – Simplifying Skimmer Detection

#35

Post by samtho »

jerf wrote: post #17
starkparker wrote: post #2

Why not publicly distribute the design? Because skimmer-makers might adapt? It seems trivial to acquire one (getting a job at Target or spoofing a corp email account isn't a high barrier).

I would expect that the corporations will be asked to sign an indemnity agreement before they get the design. Target doesn't want to be held liable in case a skimmer is built that defeats this detection and the recipient needs to understand there are no guarantees. It's nice that someone got this through the default corporate deny policies.

It’s sad that this is likely the case. In general, an “As is/no warranty” shrinkwrap contract should be sufficient for legal protection but won’t prevent people from filing nuisance lawsuits, which I suspect they wish to avoid altogether.

Re: Target's EasySweep – Simplifying Skimmer Detection

#36

Post by kotaKat »

bredren wrote: post #22

It seems like this is the kind of thing Verifone aught to design, maintain and distribute.

Believe it or not, Verifone part KIT177-005-01-A is, in fact, a "Skimming Device Detection Tool".

https://www.geminicomputersinc.com/kit177-005-01-a.html

Re: Target's EasySweep – Simplifying Skimmer Detection

#38

Post by adrianmonk »

Could payment terminals be made with built-in physical countermeasures for detection? Ideas:

(1) Terminal has a scale built into its feet/mount. It periodically weighs itself, and if (ignoring fluctuations) it weighs too much, it shuts down. It's hard to build a skimmer that weighs 0 grams.

(2) Proximity sensors in key locations on the housing. My smartphone can disable its touchscreen when I hold it against my face, so a payment terminal should be able to detect when something is covering a part that isn't supposed to be covered.

(3) Light sensors. Put some in an area where skimmers need to cover (near card slot) and other where skimmers probably can't cover (the display), and detect whether they get roughly the same amount of light.

(4) Microphones. Same idea as light sensors but with sound.

Re: Target's EasySweep – Simplifying Skimmer Detection

#39

Post by NoMoreNicksLeft »

HWR_14 wrote: post #33
NoMoreNicksLeft wrote: post #29

Earlier quoted context omitted.

So the skimmer asshole pays some Target employee $100 to replace the very precise 3d object with one that hides the skimmer when no one's looking? I need a solution that lets me, the card holder, check these. This ain't it. Hell, some of the internal skimmers just solder jumper wires to pcb pins/testpoints don't they? There's nothing mechanical for a card to touch. Target's got so many telescreen cameras in the store…

> So the skimmer asshole pays some Target employee $100 to replace the very precise 3d object with one that hides the skimmer when no one's looking? They replace the objects every 6 months. And there are multiples. So, yeah, I guess it's doable. > I need a solution that lets me, the card holder, check these. You could just print one and carry it with you. > some of the internal skimmers just solder jumper wires to pc…

> You seem to not understand the threat threat models. A skimmer is a 3 second attack that requires no accomplice and can be done with slight of hand while people are watching. Making that scale to a multi-person operation with more physical construction, the need to swap out (and hide) a bunch of red plastic going in and out is a win. In much the same way that locking your jewelry in a small safe isn't going to stop determined thieves, but will make casual thieves abandon it.

I'm just repeating what I've read elsewhere, seen elsewhere.

The gas pump skimmers are completely internal. None of that bullshit where their plastic fits over the top of the other snugly. They wire just 4 or 5 leads to the pcb... vcc and gnd, obviously... so the rest of it must be 12c or some other serial/2wire protocol I guess.

Someone was saying "well at least they can't get the cvc", but that got me to wondering with cameras so small and cheap, could you hide one where it could see that on the underside? At least on my cards, it's on the same end as the chip itself, so maybe?

How many cards can they skim, before it's detected, and what's the average value of skimming one card? If you multiply those two together, and the answer is in the tens of thousands or hundreds of thousands (or god help us, millions), then it's very much worth it to be a multi-person operation. Especially since such an operation will have more than one card-skimmer going... how many can a small team manage reliably? I guess it's really `a x b x c =` here.

Does Target have free in-store wifi? If so and they pre-configure, they never have to show up on-site again. Fuck, can they get someone hired on for 3 days to do all this, and switch out the skimmer detection tools? Then they just no-show, no-call, and move on to the next.

> If you are as paranoid as you sound, you should be covering your hand putting the PIN in with your other hand.

Have been for the last 20 years. Some woman in a gas station in Virginia once got pissy at me for doing it "it's just you and me in here!"... "Lady, you have a surveillance camera pointed right at me, I can see myself on the monitor behind you".

Re: Target's EasySweep – Simplifying Skimmer Detection

#40

Post by whartung »

hiatus wrote: post #30

Sparkfun put out an app to help detect skimmers primarily on gas pumps [1], though it no longer appears to be available on the google play store. [1]: https://github.com/sparkfunX/Skimmer_Scanner

It annoys me that none of the gas stations I use have the "tap to pay" that actually works.

They seem to have the sensor on the pumps, but they never work.

Post reply on HN