The Rise of Thin, Mini and Insert Skimmers

http://krebsonsecurity.com/2014/07/the-rise-of-thin-mini-and-insert-skimmers/

by acdanger • 12 years ago

135 71 12 years ago

leorocky• 12 years ago

I like Wells Fargo ATM machines, the thing you insert the card into is a transparent green glowing device and all the ATMS look the same and have touch screens. It's easier to tell if someone put a skimmer on them. I do not use non-Wells Fargo ATM machines. I only wish I had the option to type the password on the big touch screen and not the number pad.

smoyer• 12 years ago

I designed those glowing green skimmers because they make inserting your card seem so much more inviting ... and everyone knows that green means go!

On a more serious note, when I saw the translucent skimmer in the article I immediately thought of the glowing rim around the credit card slot at my bank's (not Wells-Fargo) ATMs and realized I'd assume it was unadulterated if that skimmer also glowed.

DanBC• 12 years ago

I though that a big green thing just makes it easier for criminals to install a skimmer - they smash the original one off and add their fake version. Being big it has plenty o room for electronics.

I image searched "wells fargo atm" to find an example of the big green thing. I saw lots of older style machines, but the first link to the newer machine with a green thig was to an article about skimmers.

http://www.thedenverchannel.com/money/consumer/skimmer-camer...

ZoFreX5• 12 years ago

Not just can they remove (or overlay) the big green thing to add on their own skimmer... once the presence of the big green anti-skimming device is normalised, you can add big green skimmers to all the ATMs that don't have them yet: http://krebsonsecurity.com/2011/03/green-skimmers-skimming-g...

Nursie7• 12 years ago

Ever more reasons to ditch magnetic stripes. Get with the program USA!

Leynos• 12 years ago

I wonder if it's maybe time for banks to stop printing magstripe cards by default and offer a "world" version of their card as an option for people who travel to places like the US?

jzwinck• 12 years ago

Some banks issue chip-and-pin cards which also have a magnetic stripe, but the magstripe is not activated unless you specifically ask for it. And you can do things like activate the magstripe for a specific country for a specific time frame.

annnnd2• 12 years ago

I wonder if one could somehow temporarily disable the magnetic stripe? I wouldn't dare scratch it off completely, but I would love to cover it up as a precaution.

lucaspiller• 12 years ago

"One of the simplest ways to protect yourself from ATM skimmers is to cover the PIN pad when you enter your digits."

As I understand the PIN is stored encrypted on the magnetic strip (salted with the account number) which allows it to be verified even when offline. I wonder how strong this encryption actually is, given some ATMs still run on 20 year old hardware it can't be that intensive.

dfox• 12 years ago

Method that is used to store PIN on mag stripe is kind of weird, but reasonably secure. Idea is that card issuer has some unspecified algorithm that generates PIN from card number and what is stored on the magstripe is difference from this "default PIN". In essence this is weird formulation of counter mode of block cipher, more so that the unspecified algorithm typically entails encrypting card number with (Tripple-)DES or AES and BCD-reducing the result.

This offline verification of PIN is mostly only relevant for ATMs owned by card issuer, as whatever device that does this verification has to know secret symmetric key for this algorithm.

madeofpalk2• 12 years ago

I don't understand this one: my card didn't come with a PIN and forced me to set it myself online (of between 4 and 12 characters) - and this from a major Australian bank (CommBank).

hippich• 12 years ago

There were some cases where pin was either stored encrypted on magstrip or was generated from information on magstrip, but I think these very few cases and I don't think any bank does it anymore.

Most cards I dealt with had option to change PIN either online or via call to bank support. So it can not be stored on card for offline verification.

annnnd2• 12 years ago

I wonder how difficult would it be for banks to insert some kind of optical counter-measure which would detect tampering with the slot?

brk• 12 years ago

It's been tried (I was mildly involved in 2 such projects). Very hard to do within the constraints of a typical ATM.

One option that seemed to have promise was basically a coil around the card slot area that would detect signals from rogue electronics being placed anywhere on/around the cardslot.

arrrg2• 12 years ago

So, there are these ATMs my bank in Germany uses and they have these new translucent green protrusions (dome shaped and weirdly organic) with a lock symbol on them. They also light up when you get your card back. Do you have any idea what that is?

I assume it’s some sort of defense mechanism against skimmers, but I have no idea whether that’s actually the case. (I mean, at first sight those weird protrusions seemed like skimmers to me because they definitely look like foreign objects. But they are not.)

ZoFreX5• 12 years ago

So, in the UK I very rarely use the magstripe on my card - 99.9% of transactions I do are chip & pin.

The chip on my card broke recently, and I found out that it doesn't even work in ATMs any more. Does that mean ATMs are only looking at the chip? If I blank my magstripe with a magnet, will I have made my card skim-proof while retaining ATM capabilities?

jdong2• 12 years ago

Chip ATMs will generally only look for the chip and therefore work with the stripe missing. (Many ATMs have two slots, one chip and one stripe) So in most of EU you should be perfectly fine if you remove or otherwise disable the magstripe on your card.

You'll be screwed though if you end up in a situation where your chip doesn't work and need to pay with the stripe fallback (pretty much all cards allow this).

ZoFreX5• 12 years ago

Many companies in the UK now don't allow you to pay with the stripe fallback. Even those that do, the employees often don't know how to put the till in that mode. Found this all out the hard way!

Annoyingly I only have the one card and I'm travelling to the US at the end of the month, otherwise I'd give this a go and report back!

sigkill2• 12 years ago

Unfortunately, it doesn't even matter. If the reader detects that you have a chip card, you cannot use the magstripe even if your chip is faulty. The error you will get, after swiping the card, entering the amount and then pressing enter waiting for confirmation will be "PLEASE INSERT CARD". Quite vague but that's exactly what you get.

seszett• 12 years ago

I don't know about the UK, but in France highway toll booths only look at the magstripe (the automated booths, where you don't have to input a pin - the manned booths use chip & pin).

That's how I discovered that my card's magstripe was faulty (and being stuck in the automated booth on a busy highway is not a comfortable way to discover that).

cheald2• 12 years ago

Skimming continues to highlight the inherent vulnerability of account information transfer mechanisms (such as magstripe), as opposed to fixed currency transfer mechanisms. The fact that every vendor I transact with has the ability to capture my account information and make future requests for my money with it is terrifying. I have to trust that every 17-year old that handles my card at a restaurant isn't going to copy it and shop online with it later. The fact that the system works at all in its current state is a miracle.

Even if Bitcoin never gains mass adoption, I really like the idea of being able to encode a consumable transaction that both authorizes the transfer and encodes the transfer amount. I can imagine a similar payment system (NFC payment with phones, perhaps?) that doesn't disclose arbitrary access to my account, but instead allows a transaction to be proposed, I accept the transaction on my trusted hardware (phone), and the transaction authorization with amount is then sent up the wire.

This seems like it should be trivially accomplishable via mutual asymmetric signing. Vendor generates a request for money and signs it, sends it to my phone. My phone validates the chain-of-trust, presents me with the transaction request, and I can authorize it. If I authorize it, then the request is counter-signed with my private key, and the signed authorization is sent off to the payment processor, who has pubkeys for the vendor and myself and can validate the request and process it.

Even if you could capture the transaction-in-transit, you wouldn't be able to compromise it, since you would need signing keys for both the vendor and the customer in order to forge the transaction, or to create new transactions with the signed account information.

Is there any reason this wouldn't work?

Nursie7• 12 years ago

"I really like the idea of being able to encode a consumable transaction that both authorizes the transfer and encodes the transfer amount."

This occurs in EMV transactions. It's not exactly as you describe but there are a lot of similarities. Effectively, in your scenario, your credit card becomes your signing token.

--edit-- Just to give you a bit more detail, there is mutual auth (terminal to card, card to terminal, card to payment process and payment processor to card), and the card creates a cryptogram from various pieces of transaction data (date/time, amount, customer verification method used etc etc).

objclxt2• 12 years ago

EMV is all very well and good (to be clear, without a cryptogram the payment can't be charged), but it falls down because of the requirement for backwards compatibility. For physical, retail transactions the easy way out of this is a liability shift (make the retailer liable for any fraudulent transactions that aren't run using EMV), but it's much harder for card-not-present (online) transactions, where people just type in card numbers and go.

drzaiusapelord• 12 years ago

Chip and pin pretty much solves this. My understanding is that its much more difficult to intercept the transaction due to the cryptography involved. No one handles your card or walks away with it like in the US. They bring the wireless cc terminal to you.

These are coming to the US in 2015. I suspect a lot of the issues we have today will be minimized as we move away from magstripes and waiters walking away with your credit card.

http://blogs.wsj.com/corporate-intelligence/2014/02/06/octob...

sliverstorm• 12 years ago

I've been pestering my credit card companies for years now, asking for chip-and-pin. It's the best I can think of to do.

calpaterson• 12 years ago

Sadly that is not the case. Major problems with chip and pin:

- the chips used (32kb 90s-style smartcards AIUI) are simple to read and save, making chip and pin readers susceptible to the same social engineering attacks as magnetic stripe cards (btw, in the UK there have been skimmers for chip and pin for some time)

- most terminals on the market transmit the pin in the clear from one part of the unit to the other, so it is trivial to doctor a legitimate chip and pin unit

- it is difficult for the consumer to verify the trustworthiness of an unfamiliar chip and pin unit

- in the UK, people often still try to walk away with my card, just as when we had magnetic stripe

- transactions can be conducted offline in most configurations (true for example in the UK, but not in Germany)

IMO the main selling point of Chip and PIN to UK retail banks is that they allow banks to reassign liability to for fraud to the customer. When your signature is forged, existing law clearly says you are not liable. When you PIN is discovered and used to send transactions, existing law is unclear and currently this allows banks to convince the customer to accept the liability. IIRC, American consumer fraud law is pretty strict, which is why the US has been slower to adopt the machines than eg the UK.

In the UK, Chip and PIN seemed to cut fraud for a while, until attacks like skimming were applied. Now fraud is back on the rise :(

There is good coverage of this in chapter 10 of Security Engineering 2nd edition by Ross Anderson, a book I highly recommend!

cheald2• 12 years ago

Chip & Pin has the fatal flaw of asking me to trust unverified hardware. I know that my phone is trustworthy. I don't know that your POS terminal is. It definitely eliminates a lot of the issues present in the current magstripe setup, but what I want is something that requires access to a black box I trust.

As long as I'm handing credentials to an untrusted computer that I have to trust to behave honestly, the problem isn't solved.

mleonhard• 12 years ago

I've been working on a protocol for this, not specific to bitcoin: https://github.com/mleonhard/hipp

chrisBob• 12 years ago

Are customers really held accountable for ATM fraud? I have found credit card fraud to be handled well by my bank (USAA). The primary reason I use a credit card is because I am not sure how ATM/check card fraud is handled.

meowface• 12 years ago

I could be wrong, but I'm pretty sure all US banks will take the hit and reimburse the customer for this kind of fraud. Even in cases where it's the customer's own mistakes or ignorance that leads to the card being compromised they'll do that; they better do it when it's their own (or another bank's) ATMs that have been rigged with spying equipment.

lostcolony• 12 years ago

Credit card fraud has a LOT of federally mandated protections, giving you a lengthy window of time in which to report it, capping the maximum amount you're liable for to $50 (I believe), etc.

Debit cards tend to have fewer protections, though they still have some. And because the money has already been taken out, you can be more detrimentally effected; the bank has to investigate and decide to give you your money back, basically, which takes time (and hopefully you have an uncompromised account if you need to pay bills or whathaveyou) whereas with credit cards the bank has to investigate and decide it's not actually fraudulent behavior and re-charge you (not sure how all that works though). Just plain inertia works in your favor when it comes to credit cards.

oasisbob• 12 years ago

Debit cards have the same federally mandated protections.

In addition to the required liability rules, VISA and MasterCard both add on their own bits which reduce the liability to $0 under most circumstances, for credit and debit cards.

pessimizer2• 12 years ago

I am not sure how ATM/check card fraud is handled.

In my personal experience, through a couple of phone calls. I can't imagine that credit card fraud could be any easier than the experience that I had with debit fraud.

edit: http://www.consumer.ftc.gov/articles/0213-lost-or-stolen-cre...

tl;dr:

1) Maximum liability is $50 if you report a loss or theft within 2 days of being aware of the loss or theft, $500 afterwards, until 60 days after you receive the statement with the disputed debits on it.

2) Whether or not your card was lost or stolen (or cloned), 60 days after you receive the statement with the disputed charges on it, your liability becomes unlimited.

summary: Report loss or theft within 2 days, check your statements for crap charges at least once every 2 months, and your maximum liability is $50.

kefka• 12 years ago

The problem seems simple to solve from the bank side: Use transparent plastic on the card mechanism and surrounding areas.

If you see opaque plastic around reader, don't use it!

rdl• 12 years ago

The whole idea of building hardware to be easily verified by the user is pretty interesting -- it's the intersection of industrial design/design for manufacturing, ee. computer security, in some cases crypto, etc.

We haven't gotten much beyond stupid stickers and hologram seals.

snarfy2• 12 years ago

Can someone tell me how carrying a credit/debit card is safer than carrying cash? Thanks.

objclxt2• 12 years ago

Hard to tell if you're being facetious, but just in case...

1. If your cash gets stolen, it's goodbye cash. If your credit card gets stolen / cloned in the vast majority of cases you're not going to be liable for any of the charges.

2. The more cash you carry, the higher the risk to you, whereas a credit card has a relatively flat risk profile.

snarfy2• 12 years ago

My cash has never been stolen. I have never been mugged.

I've had my card cancelled multiple times though due to fraud and now have credit monitoring.

My card is far more likely to be skimmed or be stolen/copied in a massive database like Target than for my cash to be stolen.

If credit cards are used for risk mitigation, they are failing for the vast majority of transactions. A $10K transaction? Sure. But for a $3 coffee? It's not worth the risk.

aianus• 12 years ago

So I can simultaneously be able buy something that costs $10k but I can't get mugged and lose it all?

hga2• 12 years ago

$10K is an unreasonable amount of money to cite here. Heck, how many of us even have credit limits that high? Check or wire transfer is what I've used for such sums in times past.

Also, I don't know where you live, but in most of the US (by state and population), we're allowed to carry concealed handguns after jumping through some moderate hoops, and in the places I've lived like this, Virginia and Missouri, muggings are also not-coincidentally much less frequent (that was particularly clear when I lived in Northern Virginia with D.C. and Maryland a subway trip away).

I routinely carry ~$450 and a .45, more if needed, and just don't worry about credit card compromise aside from uses on the net.

ATM compromise is another story, of course; the one I use with a bank account with "a lot" of money is in a Wal-Mart open 24x7 that's part of a bank branch open during normal business hours, there are so many easier targets I'd be really surprised if it got hacked. The other one I use never has more than $1,000 in the account. For that matter, I don't let the first one get much above $2,500 before transferring money out of it.

xorcist• 12 years ago

Has anyone here tried overwriting their magstrip with nulls? It should at least make the immediate danger of these largely invisble skimmers go away.

casca• 12 years ago

Chip and PIN is an improvement, but don't think that it's a silver bullet - https://www.lightbluetouchpaper.org/2014/05/19/the-pre-play-...

The Rise of Thin, Mini and Insert Skimmers

Related Stories