Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Nordstrom Finds Cash Register Skimmers

krebsonsecurity.com

Post reply on HN
Print view View original

71–80 of 83 posts

Re: Nordstrom Finds Cash Register Skimmers

#71

Post by [deleted] »

triton wrote: post #40
nabeards wrote: post #30

Earlier quoted context omitted.

I'll admit to being amazed that people like you exist. No sense of integrity or honor? Just selfish I guess?

Hardly. Here's my perspective which will hopefully make you understand. I live in a poverty stricken area. The supermarkets shove the following distribution of fruit out (I know this because my wife works in one as well): - 20 bags of 5x apples for £1.89 each. 20% go in the bin. - 100 pink lady apple at £0.75 each. 80% go in the bin. - 20 cheap apples (one tray) at around £0.12 each. 0% go in the bin. Now, why should…

[deleted]

Re: Nordstrom Finds Cash Register Skimmers

#72

Post by Kim_Bruning »

triton wrote: post #46
Theodores wrote: post #44

Earlier quoted context omitted.

I am amazed at how many people do this (or put fruit through as 'onion' on self checkout). It isn't just completely stupid people that do it either, people with jobs to lose, a criminal record that doesn't need to be added to, posh people with a sense of entitlement - all kinds. On learning of such a trait in someone I ask 'what if you get caught?', but actually it is not them getting caught that matters. Think of th…

Actually people don't give a shit who work there (a big chunk of the staff steal produce or write it off and take it home as well), there are plenty of other shops to choose from, the police don't care (in the UK they send you a letter if you get mugged apologising for not coming out) and the business find it costly to deal with the people. It's only significant if it's more than a few pounds/dollars which is why hig…

Self service checkouts are there because they trust you. :-)

Re: Nordstrom Finds Cash Register Skimmers

#73

Post by willvarfar »

cynwoody wrote: post #56
joenathan wrote: post #34

Earlier quoted context omitted.

I did read the article in full, also what does it matter who wrote it? A skimmer and a keylogger are two very distinct things. When I read the title I was interested to find out how the skimmers were placed, placing a keylogger takes much less skill and craft, it's a piece you can buy in bulk, whereas placing a skimmer usually requires a different class of criminal, skimmers often have to be fabricated for each locat…

It's a matter of semantics. What does "to skim" mean? I read the article to mean that the bad guys were using key loggers to skim mag stripe images out of the keyboard data stream (from mag stripe readers attached via "wedges"). That's one level of threat. Your link, however, calls to mind a higher level threat that happened in Rhode Island a while back. Bank customers were disavowing ATM withdrawals. Bank security n…

Not knowing this case, but the general way to read a pin is a cheap thermal camera filming the keypad. After you remove your hand, your presses remain hot for a short while, and they can even usually recover the order by the relative warmth too.

They also want to film the underside of the card to read the three digit code.

Re: Nordstrom Finds Cash Register Skimmers

#74

Post by willvarfar »

raverbashing wrote: post #9
yajoe wrote: post #6

Earlier quoted context omitted.

I work in the industry. Chip and pin is not statistically safer (fraud rates in Spain, UK, and US are all the same despite having very different payment landscapes). The fundamental problem is that in traditional chip-and-pin setups you also type the pin into the same machine... so adding a skimmer + video camera OR adding a skimmer that records pin is marginally possible and not that hard. The real security would co…

"fraud rates in Spain, UK," for what? Credit cards? Debit? There's always going to be fraud one way or another. "you also type the pin into the same machine... so adding a skimmer..." There's no copying of SIM Cards. Yes, you can still copy the magnetic stripe that's there for backwards compatibility. So, yes, it's not going to be safer while there's support for old technology. My (European) bank issued me a chip-and…

I watch the industry and my understanding is that, in practice, chip & pin is not safer, the attacks just change. As does the liability.

Re: Nordstrom Finds Cash Register Skimmers

#75

Post by willvarfar »

eps wrote: post #17
yajoe wrote: post #6

Earlier quoted context omitted.

I work in the industry. Chip and pin is not statistically safer (fraud rates in Spain, UK, and US are all the same despite having very different payment landscapes). The fundamental problem is that in traditional chip-and-pin setups you also type the pin into the same machine... so adding a skimmer + video camera OR adding a skimmer that records pin is marginally possible and not that hard. The real security would co…

You don't seem to know what a chip card is. It is the second factor in a two-factor authentication scheme.

The attack just changes. That you are attacked doesn't.

Re: Nordstrom Finds Cash Register Skimmers

#76

Post by willvarfar »

aianus wrote: post #67
derekp7 wrote: post #62

Earlier quoted context omitted.

I usually swipe my card while items are still being scanned. Most card readers allow this. Would this not be possible with a chip card reader? i.e., does it use a private key on the card to sign the whole transaction (including final dollar amount)?

I would assume it does. Here in Canada I have to approve the total before it asks for my PIN.

On the screen of a terminal that may be tampered or bogus, you mean?

Re: Nordstrom Finds Cash Register Skimmers

#77

Post by aianus »

willvarfar wrote: post #76
aianus wrote: post #67

Earlier quoted context omitted.

I would assume it does. Here in Canada I have to approve the total before it asks for my PIN.

On the screen of a terminal that may be tampered or bogus, you mean?

No, on legitimate ones. You put the chip in the reader, it tells you the total amount, you hit OK, then it asks for your PIN, then the transaction goes through, then you take the card out of the reader. I don't think there's any way to pay before the reader knows the final amount.

Re: Nordstrom Finds Cash Register Skimmers

#78

Post by Amadou »

triton wrote: post #46
Theodores wrote: post #44

Earlier quoted context omitted.

I am amazed at how many people do this (or put fruit through as 'onion' on self checkout). It isn't just completely stupid people that do it either, people with jobs to lose, a criminal record that doesn't need to be added to, posh people with a sense of entitlement - all kinds. On learning of such a trait in someone I ask 'what if you get caught?', but actually it is not them getting caught that matters. Think of th…

Actually people don't give a shit who work there (a big chunk of the staff steal produce or write it off and take it home as well), there are plenty of other shops to choose from, the police don't care (in the UK they send you a letter if you get mugged apologising for not coming out) and the business find it costly to deal with the people. It's only significant if it's more than a few pounds/dollars which is why hig…

Also if they gave a shit, they'd have staff on all checkouts and not use self-service checkouts. Staff are more expensive.

They know; they just don't care.

While I agree that the stores "deserve" the amount of the theft through fraud that comes with replacing human checkers with automated checkout systems, that doesn't make your behavior in explicitly taking committing that fraud any more ethical.

Scan something wrong by accident, that's the store's fault for setting up the system to allow such accidents. But to intentionally exploit their system, that's on you.

I personally make it a rule to never go through automated check-outs because I think the stores that use them are not holding up their end of the social contract. I've even abandoned a few carts when I got to the check-out and found they had no human checkers (I found out the hard way that some grocery stores around here go 100% automated after 10pm).

Re: Nordstrom Finds Cash Register Skimmers

#79

Post by hobolobo »

triton wrote: post #40
nabeards wrote: post #30

Earlier quoted context omitted.

I'll admit to being amazed that people like you exist. No sense of integrity or honor? Just selfish I guess?

Hardly. Here's my perspective which will hopefully make you understand. I live in a poverty stricken area. The supermarkets shove the following distribution of fruit out (I know this because my wife works in one as well): - 20 bags of 5x apples for £1.89 each. 20% go in the bin. - 100 pink lady apple at £0.75 each. 80% go in the bin. - 20 cheap apples (one tray) at around £0.12 each. 0% go in the bin. Now, why should…

There's a lot of righteous indignation coming out. Just to let you know, I upvoted you for your honesty.

Re: Nordstrom Finds Cash Register Skimmers

#80

Post by fit2rule »

dguido wrote: post #37

Compelling argument to switch to iPad cash registers? har har Btw, if anyone wants to buy one, you can here: http://www.keelog.com/wifi_hardware_keylogger.html

There are already scanhacks for iPad cash registers. Mostly consisting of a touchscreen overlay wired to look like its part of the protective case. So, forget that iSense of iSecurity, its not there ..
Post reply on HN