Crooks Hack Music Players For ATM Skimmers 82
tsu doh nimh sends in a report that criminals increasingly are cannibalizing parts from handheld audio players and cheap spy cams to make extremely stealthy and effective ATM skimmers. These are devices designed to be attached to cash machines to siphon card +PIN data. "The European ATM Security Team (EAST) found that a new type of analogue skimming device — using audio technology — has been reported by five countries, two of them 'major ATM deployers' (defined as having more than 40,000 ATMs)... The basic method for conducting these attacks was mentioned in a 1992 edition of the hacker e-zine Phrack (the edition that explains audio-based skimmers is Phrack 37)."
Been said before (Score:3, Insightful)
But we really need to do something about this whole security thing.
Personally I’m all for a one time password key token type device. You have a little key fob dealie generating numbers via a stream cipher at an interval (and with a key) synced with your bank. Once a pin is used, it is invalidated, so an attacker would have to skim the code, than use it before you punched it in. You could even combine it with some kind of traditional pin or even biometrics if you want to be all new age, giving you the very trendy “3 factor authentication”.
Heck you could even automate the first bit with some kind of challenge/response system.
This isn’t a radical or new idea.. people have been talking about this forever, and a few systems like this have actually been implemented.. but I don’t get why this isn’t wide spread yet? Are there vulnerabilities, user issues, or is it just a case of “cheaper to fix the problems reactively than prevent them”?
As has been said, security is a trade off of convenience. But I think money is one area people might be willing to put up with a slightly more cumbersome process.
Re:Been said before (Score:4, Insightful)
You could even combine it with some kind of traditional pin or even biometrics if you want to be all new age, giving you the very trendy "3 factor authentication".
Sorry, One reason this will fail - People are inherently lazy.
If they can't get their swipe and walk away then they'll not be happy...
Granted, I also don't want yet another thing to hang off my keychain, but I'd rather have THAT safety than nothing.
Re: (Score:1)
You could even combine it with some kind of traditional pin or even biometrics if you want to be all new age, giving you the very trendy "3 factor authentication".
Sorry, One reason this will fail - People are inherently lazy.
If they can't get their swipe and walk away then they'll not be happy...
Granted, I also don't want yet another thing to hang off my keychain, but I'd rather have THAT safety than nothing.
I think you are underestimating your fellow man here my friend. In the UK we ditched the swipe only method a long while back in favour of chip and pin for everything. A small minority bitched, but just got on with it as the benefits are obvious enough for the minor inconvenience of having to remember four digits. If you added another small layer of security to the existing chip + pin method I suspect the public reaction would be largely the same - a minority will complain, but then everyone will just get on
Re: (Score:1)
CC's have had PINs the entire time here in Canada. Probably everywhere else too. When those machines first came out, I would have people yelling at me that I was wrong and their card never had a PIN ever. This happened more often than you think. So many of them want me too just 'punch it in manually'. I just say we're not equipped for it.
Money transactions should never be made convenient. This transition we're experiencing into chip+pin in Canada has made me realize that more now than ever before.
Re: (Score:2)
CC's have had PINs the entire time here in Canada. Probably everywhere else too.
Was over in Canada around a month ago. Several times in my first few days the ATMs wouldn't accept my Chip'n'PIN cards, but the "swipe-only" readers would accept the same card.
Off the back of an envelope, I'd say that around 1/3 of the ATMs I looked at were swipe-only.
(I'd got all new cards, due to having my pocket picked shortly before ; this may have been why the rejection rate was so high.)
Re: (Score:3, Interesting)
Re: (Score:2)
Have they fixed the idiotic security issue with chip+PIN yet? You know, the one where the chip verifies the PIN? I remember a story where it turns out during PIN verification, the chip sends the reader an "OK" value (0x90, I believe?) if the PIN is OK and the transaction goes through. No, the bank's not checking your PIN at all - it's all done on the card you have. Which means anyone who can clone it doesn't need a PIN.
It is a feature that the card confirms the PIN. This allows offline-transactions, and is not per se insecure, if the protocol between terminal+card would have been designed correctly (which it unfortunately was not). The problem (link [cam.ac.uk]) is, that the current protocol allows a man-in-the-middle degradation attack: Ther terminal uses PIN+chip, but the man-in-the-middle tells the card not to use PIN+chip (i.e. to use chip+sign). The confirmation of the card is used to make the terminal think the PIN was accepted
Re: (Score:1)
Chip and PIN is horrible, and most people in the UK only think it is more secure cause their banks tell them it is. It isn't, it in fact shifts liability from the bank to the consumer -- it's horrible. However, due to a great advertising campaign, most brits will be very skeptical of any non CHip+PIN card thinking it horribly outdated and insecure. In Australia, we can't swipe without entering a PIN or signing, the same as in most sane countries.
The US desperately needs a revamp of their banking system whe
Re: (Score:1)
Re: (Score:1)
Ballpeen hammer (Score:4, Insightful)
Just carry a ballpeen hammer around with you. Before inserting your card, take a couple of good hard swipes with the hammer. Skimmers aren't mounted solidly, and the rest of the machine is pretty much unbreakable.
Re:Ballpeen hammer (Score:4, Insightful)
Sounds great. I'm sure a random police officer who happens to be passing by when you strike the ATM with a hammer will completely agree with your plan.
Re:Ballpeen hammer (Score:4, Interesting)
Dont even need to do that. Pull on the card slot housing, lift on the keypad,etc... , if it comes off, take it.
Dont turn it in, your fingerprints are all over it now. Plus these things go for big $$$ on ebay. $1500 for cheap ones.
Re:Ballpeen hammer (Score:5, Funny)
Just throw your ballpeen hammer at them.
Re: (Score:2)
And shortly afterward, get shot by the person who put it there, who was hiding nearby.
Comments this stupid are the reason why anonymous posting should be disabled on Slashdot. It's not like your slashdot account has to be tied to your real identity.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
with $20 you can buy many peanuts... (Score:2)
good luck getting on the plane with that, though...
Re: (Score:2)
Before inserting your card, take a couple of good hard swipes with the hammer.
Half the point of a credit card is portability and ease of use. Carrying around a hammer is rather counterproductive towards that end.
Re: (Score:3, Funny)
You need the new Chase(tm) Big Iron(sm)(r) card! For when you need convenience and heft, complete with a sensible no-hassle rewards program.
Re: (Score:3, Funny)
I thought that came with a no-reward hassle program?
Do not take me seriously (Score:4, Funny)
Insightful? Uh, it was supposed to be a joke. Please don't actually do this. As someone else mentioned, just tug on the thing.
Re:Been said before (Score:5, Interesting)
But we really need to do something about this whole security thing.
Why would banks care about that? Secure digital cash systems have been around for a very long time, but banks do not like the concept very much, probably because it would mean losing certain revenue streams. Credit card processors and banks sell spending data to marketing firms; secure digital cash generally makes that difficult or impossible, since digital cash allows for anonymous payments. Additionally, digital cash would make it hard for banks to do things like profit from debit card overdraft fees (although with the new regulations, perhaps this is less of a valid argument).
It is not that the technology is not there, it is that it solves the wrong problem.
Re:Been said before (Score:5, Interesting)
I don't know about other countries, but at least in Mexico and the Cayman Islands, devices like the one you describe (RSA SecureID) are commonly used for online bank transactions.
It would seem trivial to extend the use to ATM and POS terminals, it would end this type of scam for good.
Re: (Score:2)
Re: (Score:2)
Why 3? Are your banks ran by complete scumbags that wont use a single common one like the verisign device?
Hell I got an iphone app that also does it so I dont need my keyfob with me.
Re: (Score:3, Insightful)
Are your banks ran by complete scumbags
Yes, yes they are.
Re: (Score:2)
Same with politicians overseeing the banking industry. Both (D) and (R) are into it.
Re: (Score:2)
One for work, one for bank, one for warcraft.
I don't know why they aren't used (Score:2)
I have one with my bank (Bank of America). It is a credit card, or so it appears at first glance. Looking closer you notice it has a smart chip in it and that the 6 digit number in one corner looks a lot like a segmented LCD readout. It is actually eInk, so it doesn't draw power except to change. Squeeze the button, it generates a new code. My online account is set up so that is required to get in, as well as a password. However the ATMs for the same bank take no note of it. That just uses regular debit car
Re: (Score:2)
Seems silly that the bank would push this new security feature but not use it for ATMs.
Or they should atleast (I am assuming they don't) provide you the option to not allow the card to be used by devices which don't support this.
I really hate that.. it's like the whole "verified by visa". Useless because someone can just use your card at a site that doesn't require it. All it serves is to protect site owners (which may have been the point.. but it could have served both site and card owner).
Re: (Score:1)
Re: (Score:2)
Even better than that, there is an RSA SecureID application for smartphones (Blackberry and iPhone). You do not even need the dongle anymore. Just fire up the app on your cellphone to get the current PIN.
Re: (Score:2)
Re: (Score:2)
First off ANY card will open that outer door,
Second, Ok, the thief goes in and places his device right after the bank closes on friday and takes it back sunday morning Hm, you security guy reviews the tap on monday sometime but all the accounts have already been cleaned out sunday.
The skimmer collects the card info, the camera records the pin, and the thief gets all our money.
Re: (Score:3, Insightful)
IC card based authentication is well-kown and established, and is secure against skimming attacks without the need of external devices. Just slip in the card and enter your PIN. Even if your PIN is observed it's useless without the chip, and the chip is not easily readable (and thus, not really copy-able). The technology has been around for years (at least since the 1990), and is widely used. Only missing step is for the credit card companies to 1. adopt them (they are actually in the process of doing this,
Re: (Score:2)
A simple two factor solution, requiring no additional hardware for the average consumer has long existed. Leverage the existing cellphone. There's a commercial firm with a packaged solution (www.PhoneFactor.com) out there.
However, the cost of such services+customer resistance may well keep it out of wide spread usage.
Just because it's possible to be safer, doesn't necessarily make it cost effective.
However, most customers would probably be less resistant to using their phone than carrying yet another device
Re: (Score:2, Interesting)
i replied to a starwars post as the 3d poster -- then the starwars post disappeared
Re: (Score:2)
These are not the articles you are looking for.
Zero-knowledge protocols (Score:2, Interesting)
http://en.wikipedia.org/wiki/Zero-knowledge_protocol
It's possible to make an authentication scheme which is completely immune to skimming attacks.
The RIAA was *almost* right. (Score:5, Funny)
Home taping is killing ATMs.
Crooks? (Score:2)
Re: (Score:3, Insightful)
Not crooks: Geniuses! :-)
They're not mutually exclusive.
Re: (Score:2)
Not crooks: Geniuses! :-)
Geniuses? It only took them EIGHTEEN YEARS to deploy something that was published in Phrack.
wow (Score:3)
Re: (Score:1)
My thoughts exactly; right on top of the TAP xeroxes. The scam actually reminds me of a blue box.
Ummm. Wargames? Anyone? (Score:2)
If anything, the only surprise here is that criminals were ever not taking advantage of cheap MP3 player/recorder hardware. The economies of scale with your basic anonymous fleabay-special "designers MP5 player" are stupendous, and most of the (comparatively) difficult stuff is in software, which is an easier trail to hide...
Audio recording? (Score:2)
Here in Canada the ATMs they do the same frequency and length of "beep" for all keys, it's a simple audio feedback to let the user know the key has been pressed and registered properly.
Do ATMs in other countries do different tones for different keys? If they do, that's just insane.
Re: (Score:2)
The summary talks about "music players", I haven't seen any mp3 player with a magstripe reader yet.
No, I still haven't RTFA.
Re: (Score:2)
Take something like a digital audio recorder as the core, and add a walkman cassett head, and peice them together with a few passive components, and you have a simple, cheap and effective device to skim credit cards.
Later you download the recorded audio (it is a Digital audio recorder) and run it through say a quick matlab script, and you decode the card data.
Audio-based cards = low security (Score:3, Interesting)
I read the linked Phrack file (brought me back to my BBS days), interesting read. Here's the relevant passage. Note the bolded text:
Not all magstripe cards operate on a digital encoding method. SOME cards .5 the freq of
encode AUDIO TONES, as opposed to digital data. These cards are usually
used with old, outdated, industrial-strength equipment where security is not an
issue and not a great deal of data need be encoded on the card. Some subway
passes are like this. They require only expiration data on the magstripe, and
a short series of varying frequencies and durations are enough. Frequencies
will vary with the speed of swiping, but RELATIVE frequencies will remain the
same (for instance, tone 1 is twice the freq. of tone 2, and
tone 3, regardless of the original frequencies!). Grab an oscilloscope to
visualize the tones, and listen to them on your stereo. I haven't experimented
with these types of cards at all.
Only being used with outdated equipment where security isn't an issue? This was written in 1992! Assuming the format hasn't changed much on these new systems, why the hell are ATMs now(still?) using this format?
Re: (Score:2)
The last image in the article shows a screenshot of a tool that has decoded a waveform skimmed from a magstripe. It's clearly showing flux reversals from Manchester encoded data and not any sort of "audio" signal.
Re: (Score:2)
Isn't this how Square's cardreaders for iPhone work, anyhow?
Re: (Score:1)
At the local 7-11 I can look inside the ATM at the back, where it has a small monitor, and it clearly is Windows XP.
Windows XP is also running your ATM... [guardian.co.uk]
RTFA FFS! (Score:2)
Nothing is recording audio of your keypresses (which usually are just
Re: (Score:1)
Use the eraser end of a pencil to press the keys.
Make a better design of ATM (Score:2)
I have seen designs of ATM that make attaching card skimmers harder yet too many ATMs (even brand new ATMs) are of designs where attaching skimmers without it being obvious is simple to do.
Its not rocket science to design an ATM that makes it harder to attach a card skimmer or more obvious that one has been attached.
You can also add covers of various to the pin pad so its almost impossible to see the numbers being keyed in if you are shoulder surfing or have attached a hidden camera to the ATM. (and I have
Transparency (Score:2)
Might it help to make card readers transparent - so there's nothing but clear plastic and a very small read head with some wires leading off into the ATM?
Then if you ever see other electronic cruft surrounding the read head, or see a non-transparent reader, you'd know to be suspicious...