Nordstrom Finds Cash Register Skimmers
krebsonsecurity.com
Nordstrom Finds Cash Register Skimmers
1–10 of 83 posts
Re: Nordstrom Finds Cash Register Skimmers
#2It occurred to me once upon a time that I could use just such a keylogger to capture my classmates' student ID card swipes when they went to release print jobs at any of the print stations on my university campus. I recognized this as a security flaw that (probably) didn't have many lucrative uses, but I never imagined such a technique might work for credit cards. I wrongly assumed that credit card readers would employ greater physical security.
Re: Nordstrom Finds Cash Register Skimmers
#3There is very little true security in retail establishments.
This lady simply swapped bar codes on expensive items for bar codes of inexpensive items. Got away with it for over a year and made as much as $30,000 per month in some months:
http://miami.cbslocal.com/latest-videos/?autoStart=true&topV...
Re: Nordstrom Finds Cash Register Skimmers
#4It occurred to me once upon a time that I could use just such a keylogger to capture my classmates' student ID card swipes when they went to release print jobs at any of the print stations on my university campus. I recognized this as a security flaw that (probably) didn't have many lucrative uses, but I never imagined such a technique might work for credit cards. I wrongly assumed that credit card readers would empl…
hardware security aside, if credit card readers employ proper encryption, that in itself would probably be an effective deterrent against such leaks, but only IF such encryption is implemented.
Re: Nordstrom Finds Cash Register Skimmers
#5chip and fucking pin. sigh This problem is solved, yet practically nobody in the US is demanding the established solution. Until we do, this is only going to continue.
Re: Nordstrom Finds Cash Register Skimmers
#6chip and fucking pin. sigh This problem is solved, yet practically nobody in the US is demanding the established solution. Until we do, this is only going to continue.
I work in the industry. Chip and pin is not statistically safer (fraud rates in Spain, UK, and US are all the same despite having very different payment landscapes). The fundamental problem is that in traditional chip-and-pin setups you also type the pin into the same machine... so adding a skimmer + video camera OR adding a skimmer that records pin is marginally possible and not that hard.
The real security would come with a second factor that the user controls, either by approving on your phone or by using one-time-numbers for each transaction. The reason why these do not exist yet is because they would impede transaction flow, and the basic math with these companies is if fraud rate > rate loss of transaction volume from security feature then use security feature. Otherwise, don't.
Re: Nordstrom Finds Cash Register Skimmers
#7chip and fucking pin. sigh This problem is solved, yet practically nobody in the US is demanding the established solution. Until we do, this is only going to continue.
This
It's ridiculous how such an important infrastructure is so vulnerable. Magnetic stripes are easily copiable and without any other "authentication method" it's a done deal.
Re: Nordstrom Finds Cash Register Skimmers
#8chip and fucking pin. sigh This problem is solved, yet practically nobody in the US is demanding the established solution. Until we do, this is only going to continue.
This It's ridiculous how such an important infrastructure is so vulnerable. Magnetic stripes are easily copiable and without any other "authentication method" it's a done deal.
because the damage so far has been very manageable, or a tiny cost of doing business. I am sure they have plans to replace them when /if...
Re: Nordstrom Finds Cash Register Skimmers
#9chip and fucking pin. sigh This problem is solved, yet practically nobody in the US is demanding the established solution. Until we do, this is only going to continue.
I work in the industry. Chip and pin is not statistically safer (fraud rates in Spain, UK, and US are all the same despite having very different payment landscapes). The fundamental problem is that in traditional chip-and-pin setups you also type the pin into the same machine... so adding a skimmer + video camera OR adding a skimmer that records pin is marginally possible and not that hard. The real security would co…
"fraud rates in Spain, UK," for what? Credit cards? Debit? There's always going to be fraud one way or another.
"you also type the pin into the same machine... so adding a skimmer..."
There's no copying of SIM Cards.
Yes, you can still copy the magnetic stripe that's there for backwards compatibility. So, yes, it's not going to be safer while there's support for old technology.
My (European) bank issued me a chip-and-pin card without the mag stripe, good for travels, where I won't risk getting my card skimmed again.
Re: Nordstrom Finds Cash Register Skimmers
#10There is very little true security in retail establishments. This lady simply swapped bar codes on expensive items for bar codes of inexpensive items. Got away with it for over a year and made as much as $30,000 per month in some months: http://miami.cbslocal.com/latest-videos/?autoStart=true&topV...
I'll admit to doing similar at the self checkouts at my local supermarket. Quite happily put pink lady apples through as cheap ones.
I started doing this after I watched a whole tray of pink lady apples go in a skip because they brought new produce out.
The same is true of a lt of retail establishments. Old stock is destroyed to keep prices up.