Would you have spotted the fraud?

http://www.krebsonsecurity.com/2010/01/would-you-have-spotted-the-fraud/

by ax0n • 17 years ago

118 55 17 years ago

tiffani2• 17 years ago

I'm always terribly suspicious of ATMs--especially those off-brand ones that pop up in random establishments that don't take debit cards nowadays. I understand some businesses just don't want to pay the fees behind accepting debit cards, but I'm increasingly becoming of the ilk where if you don't accept debit/credit I'm not shopping with you. Sure, you have folks that will handle your card and still do nefarious things with it, but at least you're not walking up to a machine prone to this kind of thing.

And for the first skimmer, I'd be suspicious of why they had to put a diagram to show you how to use what should be a universally understood sort of thing now. Slot? Card. The others, no, I wouldn't have caught those. :\

aarongough• 17 years ago

The 'diagram' was a plastic plaque designed to contain/hide the electronics responsible for storing the skimmed data.

tiffani2• 17 years ago

I know. But, anyone should be suspicious of why that's even needed.

nickpleis• 17 years ago

You mean the same diagram used on virtually every gas station pump I've ever used?

pavel_lishin2• 17 years ago

> I'd be suspicious of why they had to put a diagram to show you how to use what should be a universally understood sort of thing now.

Clearly you've never seen someone in a self-checkout aisle trying oh so hard to scan their discount card through the magnetic reader when the video on the POS is telling you to swipe it. Or vice versa.

There will always be someone too dumb to use something.

rdj• 17 years ago

I'm curious about the video monitoring on the machines that have been tampered with. What do these security cameras normally see? Do the perps block the camera so it can't see them installing their hardware? If so, couldn't some program be written to determine that the image of a person is abnormal (measure the amount of "whitespace"" around a subject) and trigger some sort of real-time alarm?

pavel_lishin2• 17 years ago

I don't think most of the video cameras on ATM machines are actually pointed at the machine; they're designed to capture the user's face.

I would imagine that gluing a piece of plastic onto an ATM can look just like a regular transaction - person walks up, looks at the screen while their hands are doing something below.

TeHCrAzY2• 17 years ago

It likely would be difficult to do a transaction and modify the ATM at the same time however.

ShabbyDoo6• 17 years ago

I wonder if the cameras are proactively monitor-able or if they exist for after-the-fact, reactive evidence in the case of a mugging. Obviously, ATM owners could upgrade to better systems though. Perhaps images with suspicious light levels over time could be shown to a human for assessment.

gecko• 17 years ago

Most recorders only record about 24 hours of video before they recycle. The really robust ones can keep about a week at once, but that's it. They're designed to help the banks out when you call and say that you just got held up--not a month later when police finally realize that a given ATM is ripping someone off. (In fact, early ATMs with cameras took a still photo, and only then while you withdrew cash--totally useless in this scenario.)

ShabbyDoo6• 17 years ago

Given how entrenched the ATM card standards are, it will be hard to make fundamental changes to improve security. If one could replace all ATMs in existence, one obvious solution is to issue RNG cards. Perhaps, to make them easy to use, the challenge/response could be electronic ala the "Java Ring" technologies (from TI) advocated by Sun a decade ago.

What could be done given that the fundamental use of an ATM machine (put in card, type in PIN) can't be changed overnight?

On machines capable of displaying pictures, users could be shown what the insertion slot ought to look like so they could compare.

A shroud could be placed over the keypad to reduce the viewing angles available to a pinhole camera.

Could smart phones be used to provide a "have something" security model? Let's say you paid $0.25 less per ATM transaction if you used your bank's iPhone app to generate a unique pin for every visit.

What else could be done simply?

praptak3• 17 years ago

> What else could be done simply?

A simple thing that is actually being done: ATMs pulling in the card with a randomly changing speed. This makes it very hard for the skimmer to get a reliable reading. The actual reading by the ATM is done during the second phase, inside the ATM.

tptacek• 17 years ago

That's something companies like JPMC and Citi are doing. But there are tens of thousands of crappy Tranax deli-style ATMs out there that aren't going to change.

Timothee• 17 years ago

Oh is that what it is? I have been wondering why my local Wells Fargo ATM was taking the card in in such a jerky fashion.

PanMan• 17 years ago

Why does that make it harder? It's a row of bits sliding by, right? Why does the speed matter? (I'm not saying your wrong, I'm just wondering why it would help?)

daveungerer• 17 years ago

That's a good idea. But I guess it's only a matter of time (and feasibility) before they add an optical sensor to pick up the card speed. Or more low-tech: a rubber wheel.

pmjordan4• 17 years ago

In Europe, they could do away with the magnetic strip on cash cards. All terminals from recent years support the smartcard interface to the chip on the card. Presumably they keep the strip around for when you visit a country that doesn't use the smart card interface, so they can charge you an arm and a leg for exchanging currencies. And that recent case in Germany where the chips didn't support the year 2010, so you could only withdraw cash when you masked the interface with tape.

The smartcard mechanism hopefully uses some challenge-response setup that makes it impossible to read out by scammers. (aside from the difficulty of interfacing with the chip during the split second it's in the right position)

ShabbyDoo6• 17 years ago

Doesn't the ATM offer a unique challenge each time? Would it matter if the skimmer knew what challenge had been made and what the answer was?

Tichy2• 17 years ago

Hm, should I glue a strip of tinfoil on the magnetic strip? Or what would be a good way to disable it?

timf• 17 years ago

Could smart phones be used to provide a "have something" security model?

Could an OTP generator like RSA SecurID do the trick? Let's say you enter two memorized numbers and then the last two numbers on the fob to make the four digit PIN (you would not want the whole PIN to be on the fob). Bonus: you need to use it for web logon as well.

Some customers will pay extra for such services. Potentially avoiding hassles like ATM fraud and identity theft in the first place is worth a small fee per month to me because of the massive timesuck that could take place if they happened.

cstross• 17 years ago

Magstripe skimmers are a solved problem here in Europe; we moved on to chip and pin (EMV technology) nearly a decade ago specifically because of this kind of attack (and, in the case of the UK, because of this: http://www.theregister.co.uk/2005/10/21/phantoms_and_rogues/ ).

There are concerns over the cryptographic integrity of PIN codes in some chip and pin implementations, but it's a much harder target for ATM skimmers, which is why organized criminals have switched to tampering with retail EPOS terminals instead. And the threshold for that is a lot higher, too. (http://www.telegraph.co.uk/news/worldnews/asia/pakistan/3173...) Overall, the level of card crime in the UK seems to have diminished significantly since the switchover, although the general rule applies: if you build a better safe, you'll attract a better class of safe-cracker.

villiros2• 17 years ago

There is a very simple solution: pass a law that automatically absolves customers of any fraud, and places burden of proof on the banks. Transactions reported fraudulent should be automatically reversed, unless the bank can provide proof (satisfying the standards expected in civil courts) that the customer was at fault.

As an example, this was largely the case with transactions not involving PINs (signed-for purchases). Recent introduction of EMV (chip-and-pin cards) was really done to shift responsibility for such transactions back onto the customers and reduce banks' losses.

This is also the case with stolen cards (in the UK and Ireland, at least): losses related to such cases are covered by the bank, even for losses occurring before the card was reported stolen. This is the reason banks implement various pattern-matching techniques to try and detect such transactions as soon as possible.

ShabbyDoo6• 17 years ago

Another thought... When someone steals account information using such methods, it is unlikely the ATM owner/operator who is responsible for losses. After all, it would be really hard to prove conclusively that it was the fault of a particular ATM's lack of security that led to future thefts. Perhaps strong correlation could be shown, but the legal costs associated with reimbursement likely outweigh the efforts, at least in the short term.

Do ATM owners have any incentive to prevent thefts? I suppose those who process mostly the transactions of their own customers (BoA in SF, etc.) have the greatest incentive as the problem is their own.

bruceba3• 17 years ago

I was just a victim of ATM fraud (presumably by skimmer) and according to the detective who handled the police report, there is almost no cooperation from banks and card providers. It is not in their interest that you know how much fraud there is out there. I have heard figures of over 8-10% in the US. That's a lot of overhead to be passing onto the consumer.

ShabbyDoo6• 17 years ago

How hard was it to convince your bank that you hadn't withdrawn lots of cash?

tedunangst• 17 years ago

8-10% of what?

Confusion• 17 years ago

I've started to pull and wiggle the card slot a bit before sticking the card in. From these photo's, I have the impression these skimming devices should be a little 'looser' than the regular thing. However, it may be completely useless.

My second countermeasure is screening the number pad with my hand while entering my PIN. They can probably make out the PIN from hand movements, but I'm hoping it'll be too much trouble for them and they will just move on to the next, easier, target.

JacobAldridge• 17 years ago

I've mastered the ability to type my PIN with three fingers all hitting different buttons each time (but only one, and it differs for each number, actually hitting it hard enough to register). With the right recording and enough time I doubt it would stop a truly committed thief, but it makes me feel safer.

If they crack that, the $20 I keep in my ATM account to prevent over-drawn fees are all theirs.

noodle• 17 years ago

i also wiggle the slot and tend to use my entire body to cover the key pad when i type in my pin number. i do so because i have friends who were skimmed and it has made me paranoid.

thinkbohemian• 17 years ago

I'm a wiggler as well.

ajross• 17 years ago

Simple answer: almost certainly not. That article inspired me to audit the last few months of my checking account. Scary.

sid-• 17 years ago

Well windows laptops have fingerprint scanners to log you in these days. So a fingerprint scan and pin ought to be enough ?

litewulf• 17 years ago

Revocation would suck though. And I understand you leave your fingerprints everywhere you go, so it would probably be "easy" to steal.

rmorrison• 17 years ago

Damn.. time to change my pin.

sjs• 17 years ago

Here's a video that shows how easy it is for people to set these up.

http://www.wimp.com/cashscam/

sown• 17 years ago

It depends how well glued solid it is.

Ever since I read about these a few years ago I got into the habit of pushing and trying to move around parts of the ATM, like windows, the card reader, brochure boxes, etc to see if they can come off.

Also, inspect by touch for places where a camera or stray wire could hide, that are out of view, under perhaps a display sign, brochure box, on the upper part of the keypad that might be hidden from view.

Also, use other hand to cover up fingers when entering pin.

jcapote• 17 years ago

I do the same thing, people look at me like I'm crazy.

thwarted• 17 years ago

I wonder if there's a risk that some random bank security reviewer would consider this to be tampering.

andrewvc• 17 years ago

That scared the shit out of me, because I'm a Citibank customer, and I live in Woodland Hills. In fact, I just noticed that they just put a giant opaque enclosure around their ATMs for privacy recently, wonder if this is why.

OC, luckily, I never actually use the Citi ATMs, thank god.

enneff• 17 years ago

My bank (ANZ) has new ATMs with prominent, translucent green housings around the card slot that flash when the card is inserted or removed. It's a very distinctive design, and one that I feel must have been crafted specifically to mitigate these kinds of attacks.

villiros2• 17 years ago

I've noticed some newer ATMs around these parts started doing that as well. However, is is of absolutely no use without associated customer education. The machines don't even say "here is what the slot should look like, please check it before entering your PIN." There were even reports of people calling the police thinking this security feature was a skimming device, since it looks so out of place and different from what's usually on the machines.

visitor4rmindia• 17 years ago

There is actually a very simple solution that a bank could use to mitigate this issue - just send a SMS everytime there is an ATM withdrawal.

I believe the bank I've just moved to (http://www.kotak.com/) does do this. It sends me an SMS for every transaction done so far (I haven't used the ATM yet).

gcb• 17 years ago

In Brazil almost all ATMs have negative inserts instead of positive ones.

http://tadificil.files.wordpress.com/2007/05/caixa.jpg

instead of raising the sides it usually have a insert in the middle for your fingers.

even tough the raised ones are starting to popup.

Would you have spotted the fraud?

Related Stories