5 ms·

To the guy with the throwaway account who seems on a mission to discredit Krebs and this story (with as little evidence as you would expect), please stop. Your

by orf 11y ago

To the guy with the throwaway account who seems on a mission to discredit Krebs and this story (with as little evidence as you would expect), please stop. Your comments are ridiculous. As for the series, it's fantastic. I've always enjoyed Kreb's writing but never shared his fascination with skimmers, I always thought it was kind of niche and not really much of a big deal. Seems it's a lot more widespread than people think.

throwaway7767 11y ago
(not the same throwaway you are referring to :) I enjoy Krebs's writing, but to be honest I was underwhelmed by this. Based on the buildup in the first part I expected some insights into the workings of the skimmer group in the second one, but really it could have been summed up as "I walked along the tourist places in Mexico and found a bunch of skimmers of the type I described in the first part." Still interesting to see how widespread it is. I can only assume the next version will use a custom RF protocol or somehow hide the beacon unless provided with the right challenge from the phone.
fit2rule 11y ago
I didn't find the followup to be particularly enlightening. Basically, tl;dr: don't use an ATM in Mexico, you'll regret it. They're all hacked.
throwaway583467 11y ago
(This throwaway account is hellbanned at the moment, so only someone with showdead on would see it.) I actually have no beef at all with Krebs. I personally simply found it very unlikely that the configuration he showed in https://www.youtube.com/watch?v=Pi6y2soOp8Y&t=3m30s https://www.youtube.com/watch?v=Pi6y2soOp8Y&t=3m30s (after sighing and clearing his throat, at the place I linked, before starting on his explanation), in that configuration, nestled between two PCB's, would be seen by the phone from the distance at https://www.youtube.com/watch?v=Pi6y2soOp8Y&t=4m45s https://www.youtube.com/watch?v=Pi6y2soOp8Y&t=4m45s - it's outside class 2 bluetooth range (most phones are class 2) and class 1 chips usually even have an external antenna. PCB's like what the chip is sandwiched between are highly attenuating; but both signals show up at once, from an implausible distance, from inside an enclosure (the ATM) that is not designed to transmit well at all. I have many other specific reasons that confirm my suspicion, including in the video included in the present installment. To me it is completely obvious. (I also did a very light investigation in a brief email exchange with the author.) But just make a mental note of this throwaway, maybe in a few years someone else will pubicly discredit him. (I have no intention of doing so.) In the meantime, sure, he reads a forum where he realized spammers are planning to send him cocaine in the mail and SWAT his house, and averted it just in time. If you would like the other reasons I'm quite sure, then, you can reply with a brief comment and I can email you (you have your profile information linked.) It's obviously quite an egregious case of journalistic fraud if true, but there have been bigger ones. I have no beef with the guy, except that I don't find his story credible. I'm not on a mission to discredit him.
nadams 11y ago
Here is my take on it - I'm skeptical. Sure I'll believe that a number of ATMs are compromised. But it seems like every ATM he walked up to was broadcasting this. To me this seems like an, arguably exploitable, maintenance tool than a ring of ATM thieves. Free2Move appears to be a standard tool for serial over bluetooth [1]. He can't possibly be the first and only person to find this - so I attempted to google "free2move atm" and only his article shows up (about skimming). I'm not saying this is a fake article - but to me seems amateuristic for someone of his stature. I would have expected he would work with at least one authority figure to show that without a doubt an ATM is compromised - along with a tear down of the device. Also I'm not sure how I feel about him convincing people not to use an ATM that may or may not be compromised. If he did believe 100% it was compromised he should have talked to someone in management to have the ATM unplugged and serviced (that would make for an interesting article to see if they actually take him seriously and not just plug it back in when he leaves). My two cents... [1] http://www.amazon.co.uk/Cablematic-Free2Move-Bluetooth-Serial-F2M01SXA/dp/B008451VYW http://www.amazon.co.uk/Cablematic-Free2Move-Bluetooth-Seria...
- mark212 11y ago
  read the article. He did talk to people "in management" at a couple of places and only one took the suspect ATM offline. demanding that he "work with at least one authority figure" is a bit naive in Mexico.
  - tertius 11y ago
    Only if you're not from Mexico and realized that their banking industry is robust and well regulated...
  - nadams 11y ago
    > read the article. He did talk to people "in management" at a couple of places and only one took the suspect ATM offline. I don't think we read the same article. Maybe in the first one he did - but in the linked article all I see is him walking up and down streets looking for the bluetooth broadcast. I won't blindly believe that each of the ATMs he found broadcasting was exploited. I'm not saying I would use them nor would I recommend using one in Mexico - but just seeing a bluetooth signal isn't enough for me to assume that it's exploited. With all the sensational articles floating on the web - I'm just skeptical that's all. > demanding that he "work with at least one authority figure" is a bit naive in Mexico. I didn't demand it - I just expected it. Even though I'm sure there are a lot of bribes happening in Mexico - there has to be someone he can contact and work with that may or may not care.

by orf 11y ago

throwaway7767 11y ago

(not the same throwaway you are referring to :) I enjoy Krebs's writing, but to be honest I was underwhelmed by this. Based on the buildup in the first part I expected some insights into the workings of the skimmer group in the second one, but really it could have been summed up as "I walked along the tourist places in Mexico and found a bunch of skimmers of the type I described in the first part." Still interesting to see how widespread it is. I can only assume the next version will use a custom RF protocol or somehow hide the beacon unless provided with the right challenge from the phone.

fit2rule 11y ago

I didn't find the followup to be particularly enlightening. Basically, tl;dr: don't use an ATM in Mexico, you'll regret it. They're all hacked.

throwaway583467 11y ago

(This throwaway account is hellbanned at the moment, so only someone with showdead on would see it.) I actually have no beef at all with Krebs. I personally simply found it very unlikely that the configuration he showed in https://www.youtube.com/watch?v=Pi6y2soOp8Y&t=3m30s https://www.youtube.com/watch?v=Pi6y2soOp8Y&t=3m30s (after sighing and clearing his throat, at the place I linked, before starting on his explanation), in that configuration, nestled between two PCB's, would be seen by the phone from the distance at https://www.youtube.com/watch?v=Pi6y2soOp8Y&t=4m45s https://www.youtube.com/watch?v=Pi6y2soOp8Y&t=4m45s - it's outside class 2 bluetooth range (most phones are class 2) and class 1 chips usually even have an external antenna. PCB's like what the chip is sandwiched between are highly attenuating; but both signals show up at once, from an implausible distance, from inside an enclosure (the ATM) that is not designed to transmit well at all. I have many other specific reasons that confirm my suspicion, including in the video included in the present installment. To me it is completely obvious. (I also did a very light investigation in a brief email exchange with the author.) But just make a mental note of this throwaway, maybe in a few years someone else will pubicly discredit him. (I have no intention of doing so.) In the meantime, sure, he reads a forum where he realized spammers are planning to send him cocaine in the mail and SWAT his house, and averted it just in time. If you would like the other reasons I'm quite sure, then, you can reply with a brief comment and I can email you (you have your profile information linked.) It's obviously quite an egregious case of journalistic fraud if true, but there have been bigger ones. I have no beef with the guy, except that I don't find his story credible. I'm not on a mission to discredit him.

nadams 11y ago

Here is my take on it - I'm skeptical. Sure I'll believe that a number of ATMs are compromised. But it seems like every ATM he walked up to was broadcasting this. To me this seems like an, arguably exploitable, maintenance tool than a ring of ATM thieves. Free2Move appears to be a standard tool for serial over bluetooth [1]. He can't possibly be the first and only person to find this - so I attempted to google "free2move atm" and only his article shows up (about skimming). I'm not saying this is a fake article - but to me seems amateuristic for someone of his stature. I would have expected he would work with at least one authority figure to show that without a doubt an ATM is compromised - along with a tear down of the device. Also I'm not sure how I feel about him convincing people not to use an ATM that may or may not be compromised. If he did believe 100% it was compromised he should have talked to someone in management to have the ATM unplugged and serviced (that would make for an interesting article to see if they actually take him seriously and not just plug it back in when he leaves). My two cents... [1] http://www.amazon.co.uk/Cablematic-Free2Move-Bluetooth-Serial-F2M01SXA/dp/B008451VYW http://www.amazon.co.uk/Cablematic-Free2Move-Bluetooth-Seria...

mark212 11y ago
read the article. He did talk to people "in management" at a couple of places and only one took the suspect ATM offline. demanding that he "work with at least one authority figure" is a bit naive in Mexico.
- tertius 11y ago
  Only if you're not from Mexico and realized that their banking industry is robust and well regulated...
- nadams 11y ago
  > read the article. He did talk to people "in management" at a couple of places and only one took the suspect ATM offline. I don't think we read the same article. Maybe in the first one he did - but in the linked article all I see is him walking up and down streets looking for the bluetooth broadcast. I won't blindly believe that each of the ATMs he found broadcasting was exploited. I'm not saying I would use them nor would I recommend using one in Mexico - but just seeing a bluetooth signal isn't enough for me to assume that it's exploited. With all the sensational articles floating on the web - I'm just skeptical that's all. > demanding that he "work with at least one authority figure" is a bit naive in Mexico. I didn't demand it - I just expected it. Even though I'm sure there are a lot of bribes happening in Mexico - there has to be someone he can contact and work with that may or may not care.