51–60 of 83 posts
Compelling argument to switch to iPad cash registers? har har Btw, if anyone wants to buy one, you can here: http://www.keelog.com/wifi_hardware_keylogger.html
[deleted]
People need to be made aware of any and all threats to their security that may exist. They need to make sure such hardware is not deployed against them. And they need to design the vulnerability out of future systems.
I think a large factor in the lack of change in payment security (In the US anyway, I can't speak for anywhere else) is the rise of the "protected" card. I have no incentive to protect anything about my Amex. Card got skimmed a few years ago somehow, Amex called, asked if I was in Nicaragua (I wasn't) they apologized, removed the $200 or so in charges and next-day aired me a new card. Almost zero hassle. I'd hate to…
Erm, how is the end user supposed to protect against keyloggers installed in reputable stores? It's much better for the banks to carry the can here, so they implement more secure devices.
The rollout date is supposed to be Oct 2013.
As an end user, you are not able to protect from this type of fraud. That's why the liability doesn't reside with you.
Earlier quoted context omitted.
I'll admit to being amazed that people like you exist. No sense of integrity or honor? Just selfish I guess?
Hardly. Here's my perspective which will hopefully make you understand. I live in a poverty stricken area. The supermarkets shove the following distribution of fruit out (I know this because my wife works in one as well): - 20 bags of 5x apples for £1.89 each. 20% go in the bin. - 100 pink lady apple at £0.75 each. 80% go in the bin. - 20 cheap apples (one tray) at around £0.12 each. 0% go in the bin. Now, why should…
If you don't spill it you pay for it.
Do you go back to the register and say you spilled it?
Earlier quoted context omitted.
I'll admit to being amazed that people like you exist. No sense of integrity or honor? Just selfish I guess?
Hardly. Here's my perspective which will hopefully make you understand. I live in a poverty stricken area. The supermarkets shove the following distribution of fruit out (I know this because my wife works in one as well): - 20 bags of 5x apples for £1.89 each. 20% go in the bin. - 100 pink lady apple at £0.75 each. 80% go in the bin. - 20 cheap apples (one tray) at around £0.12 each. 0% go in the bin. Now, why should…
Earlier quoted context omitted.
Look up the guy whose blog this is. Also, it might help to read the article in full before blurting out trivialities.
I did read the article in full, also what does it matter who wrote it? A skimmer and a keylogger are two very distinct things. When I read the title I was interested to find out how the skimmers were placed, placing a keylogger takes much less skill and craft, it's a piece you can buy in bulk, whereas placing a skimmer usually requires a different class of criminal, skimmers often have to be fabricated for each locat…
I read the article to mean that the bad guys were using key loggers to skim mag stripe images out of the keyboard data stream (from mag stripe readers attached via "wedges"). That's one level of threat.
Your link, however, calls to mind a higher level threat that happened in Rhode Island a while back. Bank customers were disavowing ATM withdrawals. Bank security noticed that the complaining customers had all used their debit cards at the same all-night Stop & Shop. A review of the store's security video showed a gang of four guys coming in during third shift and installing hacked PIN pads at the registers while keeping the thin staff distracted. They were busted when they returned to harvest their next haul of debit card details.
How they compromised the PIN pads I do not know. PIN pads are supposed to be sealed and tamper-proof. Your PIN is supposed to be encrypted before it leaves the keypad and decrypted only when it reaches the payment processor. The encryption key is supposed to be erased if someone tampers with the device. In order for the hack to work, they would need to be recording the mag stripe data along with cleartext PINs.
I see it happened to Barnes & Noble more recently and on a larger scale:
http://www.esecurityplanet.com/hackers/hackers-compromise-ba...
chip and fucking pin. sigh This problem is solved, yet practically nobody in the US is demanding the established solution. Until we do, this is only going to continue.
I work in the industry. Chip and pin is not statistically safer (fraud rates in Spain, UK, and US are all the same despite having very different payment landscapes). The fundamental problem is that in traditional chip-and-pin setups you also type the pin into the same machine... so adding a skimmer + video camera OR adding a skimmer that records pin is marginally possible and not that hard. The real security would co…
I seem to recall reading a while back that the overall credit card fraud rate is at the level of single-digit basis points. Is that really true? (I can't seem to find a good link.)
The Cherry PS/2 keyboard with built in card reader is designed for retail and used in places where there is no C+P: http://www.cherrycorp.com/english/keyboards/pos/8000/ This explains the 'attack vector'. Presumably the scammers have USB dongles too.
You save some $$ in hardware but take on risk.
The Cherry PS/2 keyboard with built in card reader is designed for retail and used in places where there is no C+P: http://www.cherrycorp.com/english/keyboards/pos/8000/ This explains the 'attack vector'. Presumably the scammers have USB dongles too.
I may be mistaken, but I thought that the PCI/DSS forbids using such devices (unencrypted transmission from the keypad), and if a merchant uses them then they're automatically liable in full for all such fraud; i.e., banks just refund all cardholders for their losses and bill that+card replacements to that merchant. You save some $$ in hardware but take on risk.
Earlier quoted context omitted.
Your parents may have told you two wrongs don't make a right.
How do you explain capitalism and politics then? My parents taught me to be wary of both.
To be clear: there are many businessmen who are greedy selfish exploiters. However, the purpose of capitalism is to take these natural human tendencies and make them into a force for good.
You could say the same thing about democracy. It's a game whereby people can seek power and influence without having to kill each other or their subjects. If you doubt that democracy is an effective solution, just read up about all the Wars of Succession that Europe has witnessed when those countries were monarchies. Elections are practically love-fests in comparison.