41–50 of 151 posts
Sparkfun put out an app to help detect skimmers primarily on gas pumps [1], though it no longer appears to be available on the google play store. [1]: https://github.com/sparkfunX/Skimmer_Scanner
It annoys me that none of the gas stations I use have the "tap to pay" that actually works. They seem to have the sensor on the pumps, but they never work.
Since it's only implied how it works and there seems to be some confusion in the comments. It seems like the technique is to simply create a very form-fitting insert which won't fit properly if some device is overlaid onto the machine. The insert is not left in the device, but is just used for a quick in-and-out check.
It seems like this is the kind of thing Verifone aught to design, maintain and distribute.
Believe it or not, Verifone part KIT177-005-01-A is, in fact, a "Skimming Device Detection Tool". https://www.geminicomputersinc.com/kit177-005-01-a.html
Though it could just be cost given that Target could just pay for a plastic injection mold overseas and then pay peanuts yearly to make a 60k batch for their yearly renewal they mention, compared to $20*60k each time
Sparkfun put out an app to help detect skimmers primarily on gas pumps [1], though it no longer appears to be available on the google play store. [1]: https://github.com/sparkfunX/Skimmer_Scanner
It annoys me that none of the gas stations I use have the "tap to pay" that actually works. They seem to have the sensor on the pumps, but they never work.
How do these skimmers work with chip&pin? I understand how magstripe skimmers work, but my understanding is that chip&pin is an active challenge response protocol. I’d love to hear more.
The US still has a heavy reliance on magstripe, even though we rolled out EMV, and many cards still have it, and you can just take a stripe dump regardless. The actual user of the stolen card dump will cause the terminal to allow a magstripe fallback (typically with a bad chip on a fake card that won't read) -- "aw jeez my stupid chip isn't reading" is still every much a valid excuse to a cashier to go to magstripe.
I can’t remember having to fall back from the chip to a swipe in ages, and I have a couple of cards, so I could keep one as a backup with a working stripe just in case (long ago I found myself far from home and low on gas, with no cash, a dead cell phone and a “suspicious transaction” blocked credit card, and I’d rather not repeat that experience).
Earlier quoted context omitted.
So the skimmer asshole pays some Target employee $100 to replace the very precise 3d object with one that hides the skimmer when no one's looking? I need a solution that lets me, the card holder, check these. This ain't it. Hell, some of the internal skimmers just solder jumper wires to pcb pins/testpoints don't they? There's nothing mechanical for a card to touch. Target's got so many telescreen cameras in the store…
> Hell, some of the internal skimmers just solder jumper wires to pcb pins/testpoints don't they? No. Most modern card terminals are tamper-resistant and will erase key material if opened. (Besides, it's not like you're going to be able to casually crack open a payment terminal, pull out a soldering iron, and modify it while you're standing in the store checkout line.)
Gas pumps are a little quirkier because they use integration modules, I would imagine they got better with newer ones but earlier ones, even with chips, would basically just be an exposed pcb on the inside
Since it's only implied how it works and there seems to be some confusion in the comments. It seems like the technique is to simply create a very form-fitting insert which won't fit properly if some device is overlaid onto the machine. The insert is not left in the device, but is just used for a quick in-and-out check.
Why I still can't register a public key with my bank and say "do not under any circumstance honor a transaction unless it's signed with my private key" is beyond me.
We wouldn't even need to worry about this dumb stuff if we had actual cryptographic PKI for payments. Honestly at some point fraud is 100% the card issuer's fault when the tech to prevent it is here and now. Why I still can't register a public key with my bank and say "do not under any circumstance honor a transaction unless it's signed with my private key" is beyond me.
What you are describing is Bitcoin.
Could payment terminals be made with built-in physical countermeasures for detection? Ideas: (1) Terminal has a scale built into its feet/mount. It periodically weighs itself, and if (ignoring fluctuations) it weighs too much, it shuts down. It's hard to build a skimmer that weighs 0 grams. (2) Proximity sensors in key locations on the housing. My smartphone can disable its touchscreen when I hold it against my face,…
But then it would cost more than their competitors. With much more maintenance for false positives, etc. And the vendor doesn't really pay the price for skimmer fraud..