Target's EasySweep – Simplifying Skimmer Detection • Hacker News Board

Re: Target's EasySweep – Simplifying Skimmer Detection

#61

Post by adolph » Wed, Jul 19, 2023, 8:44 PM UTC

This is an interesting and simple physical measurement device to determine if the credit card slot is in a different orientation than expected. It uses the keypad as a reference location.

I think the most obvious circumvention would be for the criminal enterprise to focus on altering the length of the verification devices, since an EasySweep does not appear to have a formal method to verify its own correctness. A shortened card tab on EasySweep would provide feedback that the terminal was ok since the keypad finger support presses against the terminal.

Re: Target's EasySweep – Simplifying Skimmer Detection

#62

Post by throwaway42968 » Wed, Jul 19, 2023, 8:49 PM UTC

noodlesUK wrote: post #13

CharlesW wrote: post #9

Earlier quoted context omitted.

> How do these skimmers work with chip&pin? My understanding is: They don’t. If you stick to contactless payments, you’re not at risk.

The image shows the skimmer gadget sitting on top of the pin pad and the bottom card insertion slot (the one that takes a chip). On these card readers the magstripe reader is on the right hand side iirc. I’m wondering what you can do having connected to the EMV contacts and recorded the PIN. I suppose you could make a transaction, but it would have to presumably happen at the same time as the legit transaction (which…

Not much. The chip doesn't transmit any credit card numbers. What's really happening in an EMV transaction is the amount due is transmitted along with some identifying information from the host to the card reader. The reader then authenticates with the chip card using asymmetric cryptography. Once this authentication is done, the reader sends an amount due and the chip card checks its authorization rules, and responds with some encrypted data that represents the transaction amount and that depends on a private key embedded in the card. You could replay the transaction at the exact same time as it is happening, but you'd have to use the same amount due. And there are other identifiers for EG the terminal that you'd have to know. If you're curious, EMVco makes the specification available online in documents titled Book 1, Book 2, Book 3, and so on: https://www.emvco.com/specifications/

Re: Target's EasySweep – Simplifying Skimmer Detection

#63

Post by lowmagnet » Wed, Jul 19, 2023, 8:50 PM UTC

reaperducer wrote: post #59

loeg wrote: post #54

Earlier quoted context omitted.

I think there are also just lots of POS systems in the US that aren't on EMV yet. Major retailers are on EMV but random old rural businesses probably aren't.

Some big chains still haven't switched. I was in a major home improvement store a few weeks ago, and it was swipe-only. Either Home Depot or Lowe's.

wal-mart has emv, but no radio-based payment

Re: Target's EasySweep – Simplifying Skimmer Detection

#64

Post by throwaway42968 » Wed, Jul 19, 2023, 8:51 PM UTC

exabrial wrote: post #48

We wouldn't even need to worry about this dumb stuff if we had actual cryptographic PKI for payments. Honestly at some point fraud is 100% the card issuer's fault when the tech to prevent it is here and now. Why I still can't register a public key with my bank and say "do not under any circumstance honor a transaction unless it's signed with my private key" is beyond me.

What you are describing is essentially EMV, except that your bank has gone to the trouble of picking your private key and embedding it in a card you carry around and insert into payment terminals.

Re: Target's EasySweep – Simplifying Skimmer Detection

#65

Post by callalex » Wed, Jul 19, 2023, 8:52 PM UTC

whartung wrote: post #40

hiatus wrote: post #30

Sparkfun put out an app to help detect skimmers primarily on gas pumps [1], though it no longer appears to be available on the google play store. [1]: https://github.com/sparkfunX/Skimmer_Scanner

It annoys me that none of the gas stations I use have the "tap to pay" that actually works. They seem to have the sensor on the pumps, but they never work.

My pet theory is that transitioning to wireless payment also opens up user expectations for the vendor to participate in way more payment networks than just Visa/MC/Discover/AmEx. If you have a wireless reader but no agreement with Apple Pay, or Google Pay, or Samsung Pay, or WePay, or WhateverSomeNewMBACrap users will start putting in reports that the reader is “broken”.

Re: Target's EasySweep – Simplifying Skimmer Detection

#66

Post by gorkish » Wed, Jul 19, 2023, 8:53 PM UTC

adrianmonk wrote: post #38

Could payment terminals be made with built-in physical countermeasures for detection? Ideas: (1) Terminal has a scale built into its feet/mount. It periodically weighs itself, and if (ignoring fluctuations) it weighs too much, it shuts down. It's hard to build a skimmer that weighs 0 grams. (2) Proximity sensors in key locations on the housing. My smartphone can disable its touchscreen when I hold it against my face,…

Alternatively they could just remove the slot and require self-pay terminals to be contactless. It really makes no sense to me why merchants don't already do this proactively; they are well incentivized:

1) Contactless merchant fees are lower than dip or swipe 2) Payment terminals are cheaper 3) Less fraud/shrink

This hunk of plastic from Target is a solution looking for a problem.

Re: Target's EasySweep – Simplifying Skimmer Detection

#67

Post by techsupporter » Wed, Jul 19, 2023, 8:54 PM UTC

js2 wrote: post #31

e28eta wrote: post #28

Earlier quoted context omitted.

They might not need CVV, if the transaction looks “good” otherwise: > A payment can still be successful even if the CVC or postal code check fails. This is because card issuers take many signals into account when making a decision about whether to approve or decline a payment. In some cases, a card issuer may still approve a payment they consider legitimate, even if the CVC or postal code verification check fails. so…

:-( I recently went through the opposite of this. A purchase at denon.com was declined, got a "please verify" email from my issuer which I approved and re-did the purchase. My issuer authorized the payment the second time, but then it got held up by NoFraud who sent me their own "please verify" email which I did. I had used an iCloud Hide My Email address for the purchase so a day later I get another email from NoFra…

> I had used an iCloud Hide My Email address for the purchase so a day later I get another email from NoFraud

I got hit by a merchant using "NoFraud" as well. After making an order from the merchant's site, using Apple Pay on the web (which is, allegedly, rather hard to fake), I received an email saying my order was canceled as it "appears that a merchant-specific email address was used" and to "please resubmit the order using your personal contact details".

They were right, because I always use [merchantname]@subdomain.mydomain.com. Whatever it was couldn't have been that important because I didn't bother redoing it if they're going to be that picky.

(I can't find the purchase confirmation and subsequent email in my email, probably because I deleted it out of annoyance, so I'm not naming who I think I remember it being just in case I'm wrong)

Re: Target's EasySweep – Simplifying Skimmer Detection

#68

Post by gorkish » Wed, Jul 19, 2023, 8:55 PM UTC

loeg wrote: post #53

kyleyeats wrote: post #51

Earlier quoted context omitted.

That's what the OP is. > Based on the success we saw with EasySweep, we decided to offer the design, for free, to other retailers.

You still have to request access from Target. GP is asking for it to just be published online somewhere.

It's right here: https://patents.google.com/patent/US11507762B2/ Took me five seconds. You can make one if you feel like it.

Re: Target's EasySweep – Simplifying Skimmer Detection

#69

Post by whoopdedo » Wed, Jul 19, 2023, 9:00 PM UTC

js2 wrote: post #16

noodlesUK wrote: post #6

How do these skimmers work with chip&pin? I understand how magstripe skimmers work, but my understanding is that chip&pin is an active challenge response protocol. I’d love to hear more.

Even with EMV transactions, they are apparently able to get the card # which is transmitted in clear text by the chip. And the PIN from the keyboard overlay for debit transactions. Later they can clone the card # onto a fake mag stripe card and use the fake card for card-present purchases. They probably cannot make card-not-present (online) purchases since I don't think they can get the CVV. https://krebsonsecurity.c…

Some skimmers have a camera to capture an image of the card's CVV as well as another copy of the name/number/date.

Re: Target's EasySweep – Simplifying Skimmer Detection

#70

Post by Terr_ » Wed, Jul 19, 2023, 9:03 PM UTC

All this shape-based stuff makes me think of antigen/antibody immune-system analogies.

The skimmer binds to the payment slot, some payment slots change shape to prevent skimmer binding, and now the tester-block binds to check that nothing is already bound...