Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Nordstrom Finds Cash Register Skimmers

krebsonsecurity.com

Post reply on HN
Print view View original

61–70 of 83 posts

Re: Nordstrom Finds Cash Register Skimmers

#61

Post by chad_oliver »

triton wrote: post #40
nabeards wrote: post #30

Earlier quoted context omitted.

I'll admit to being amazed that people like you exist. No sense of integrity or honor? Just selfish I guess?

Hardly. Here's my perspective which will hopefully make you understand. I live in a poverty stricken area. The supermarkets shove the following distribution of fruit out (I know this because my wife works in one as well): - 20 bags of 5x apples for £1.89 each. 20% go in the bin. - 100 pink lady apple at £0.75 each. 80% go in the bin. - 20 cheap apples (one tray) at around £0.12 each. 0% go in the bin. Now, why should…

You refer to prices in pounds, which seems to indicate that you live in the UK. Your area is not poverty stricken, it is simply poorer than average for your country. Go live in Uganda to see what 'poverty stricken' really means.

Re: Nordstrom Finds Cash Register Skimmers

#62

Post by derekp7 »

tyoma wrote: post #24
ohazi wrote: post #5

chip and fucking pin. sigh This problem is solved, yet practically nobody in the US is demanding the established solution. Until we do, this is only going to continue.

The US is getting chip cards in 2015 [0], although it looks to be chip and signature. As another poster pointed out, chip and pin is not foolproof and may present a nasty liability shift to consumers when it comes to fraud. There are also more practical issues with chip cards. First, merchants will be requires to buy new chip capable card readers. They will not be happy about it, but they'll be forced into it by thei…

I usually swipe my card while items are still being scanned. Most card readers allow this. Would this not be possible with a chip card reader? i.e., does it use a private key on the card to sign the whole transaction (including final dollar amount)?

Re: Nordstrom Finds Cash Register Skimmers

#63

Post by becauseICan »

dangrossman wrote: post #45
rwmj wrote: post #43

Earlier quoted context omitted.

The population of the EU is twice the US.

But they do not use Visa cards at the same rate as the US. I didn't pull that out of thin air. EU only makes up about 40M of the 200M+ daily transactions VisaNet handles.

Visa's corporate website http://corporate.visa.com/about-visa/technology/transaction-... suggests that the quoted numbers, "40M of the 200M+", numbers are wrong or misleading. Possibly they are based on the highest volume day?

"VisaNet authorizes, clears and settles an average of 150 million transactions per day in 200 countries and territories."

Either way, the best way to prove an assertion based on numbers is to source it.

Re: Nordstrom Finds Cash Register Skimmers

#64

Post by joenathan »

cynwoody wrote: post #56
joenathan wrote: post #34

Earlier quoted context omitted.

I did read the article in full, also what does it matter who wrote it? A skimmer and a keylogger are two very distinct things. When I read the title I was interested to find out how the skimmers were placed, placing a keylogger takes much less skill and craft, it's a piece you can buy in bulk, whereas placing a skimmer usually requires a different class of criminal, skimmers often have to be fabricated for each locat…

It's a matter of semantics. What does "to skim" mean? I read the article to mean that the bad guys were using key loggers to skim mag stripe images out of the keyboard data stream (from mag stripe readers attached via "wedges"). That's one level of threat. Your link, however, calls to mind a higher level threat that happened in Rhode Island a while back. Bank customers were disavowing ATM withdrawals. Bank security n…

To skim means to remove "something" from the top(usually referring to liquids). Which makes sense to use to refer to a device that sits atop a card reader.

https://www.google.com/search?q=card+skimmer&safe=off&source...

One thing to remember is that keyloggers have been around much longer than card skimmers, keylogger is a well known and well defined term.

http://en.wikipedia.org/wiki/Hardware_keylogger

https://www.google.com/search?q=hardware+keylogger&safe=off&...

It's all very interesting to watch as criminals become more sophisticated.

Re: Nordstrom Finds Cash Register Skimmers

#66

Post by aianus »

tyoma wrote: post #24
ohazi wrote: post #5

chip and fucking pin. sigh This problem is solved, yet practically nobody in the US is demanding the established solution. Until we do, this is only going to continue.

The US is getting chip cards in 2015 [0], although it looks to be chip and signature. As another poster pointed out, chip and pin is not foolproof and may present a nasty liability shift to consumers when it comes to fraud. There are also more practical issues with chip cards. First, merchants will be requires to buy new chip capable card readers. They will not be happy about it, but they'll be forced into it by thei…

The idea is to use chip and pin for high value (>$50) purchases and PayPass/PayWave for amounts under that. That way you can pay for small purchases faster than cash while making large purchases more secure.

Unfortunately, at least in Canada, it seems like merchants were only obligated to buy the chip terminal so a lot of smaller businesses didn't bother with the wireless payments and force you to type in your pin for a $7 pita.

Re: Nordstrom Finds Cash Register Skimmers

#67

Post by aianus »

derekp7 wrote: post #62
tyoma wrote: post #24

Earlier quoted context omitted.

The US is getting chip cards in 2015 [0], although it looks to be chip and signature. As another poster pointed out, chip and pin is not foolproof and may present a nasty liability shift to consumers when it comes to fraud. There are also more practical issues with chip cards. First, merchants will be requires to buy new chip capable card readers. They will not be happy about it, but they'll be forced into it by thei…

I usually swipe my card while items are still being scanned. Most card readers allow this. Would this not be possible with a chip card reader? i.e., does it use a private key on the card to sign the whole transaction (including final dollar amount)?

I would assume it does. Here in Canada I have to approve the total before it asks for my PIN.

Re: Nordstrom Finds Cash Register Skimmers

#68

Post by seanmcdirmid »

eCa wrote: post #54
triton wrote: post #40

Earlier quoted context omitted.

Hardly. Here's my perspective which will hopefully make you understand. I live in a poverty stricken area. The supermarkets shove the following distribution of fruit out (I know this because my wife works in one as well): - 20 bags of 5x apples for £1.89 each. 20% go in the bin. - 100 pink lady apple at £0.75 each. 80% go in the bin. - 20 cheap apples (one tray) at around £0.12 each. 0% go in the bin. Now, why should…

If you spill your coke at McDonald's you get a new one for free. If you don't spill it you pay for it. Do you go back to the register and say you spilled it?

Aren't free refills common outside of America also? Maybe not.

Re: Nordstrom Finds Cash Register Skimmers

#69

Post by dietrichepp »

Sami_Lehtinen wrote: post #29
dietrichepp wrote: post #21

And the question is... why not just use secure card swipe devices? You load an encryption key onto the hardware, and then key loggers don't work any more. Sure, it won't solve all your problems, but nothing does.

Doesn't help, like I mentioned above. There's no such thing as 'secure device'. Someone is always able to tamper with those.

There's a difference between "doesn't help" and "not a perfect solution". Secure readers eliminate the ability for non-savvy criminals to drop a keystroke logger in the terminal.

Re: Nordstrom Finds Cash Register Skimmers

#70

Post by iends »

seanmcdirmid wrote: post #68
eCa wrote: post #54

Earlier quoted context omitted.

If you spill your coke at McDonald's you get a new one for free. If you don't spill it you pay for it. Do you go back to the register and say you spilled it?

Aren't free refills common outside of America also? Maybe not.

In the 6-7 countries I've been to outside the USA, nope.
Post reply on HN