5 ms·

Given how entrenched the ATM card standards are, it will be hard to make fundamental changes to improve security. If one could replace all ATMs in existence, o

Given how entrenched the ATM card standards are, it will be hard to make fundamental changes to improve security. If one could replace all ATMs in existence, one obvious solution is to issue RNG cards. Perhaps, to make them easy to use, the challenge/response could be electronic ala the "Java Ring" technologies (from TI) advocated by Sun a decade ago. What could be done given that the fundamental use of an ATM machine (put in card, type in PIN) can't be changed overnight? On machines capable of displaying pictures, users could be shown what the insertion slot ought to look like so they could compare. A shroud could be placed over the keypad to reduce the viewing angles available to a pinhole camera. Could smart phones be used to provide a "have something" security model? Let's say you paid $0.25 less per ATM transaction if you used your bank's iPhone app to generate a unique pin for every visit. What else could be done simply?

praptak 17y ago
> What else could be done simply? A simple thing that is actually being done: ATMs pulling in the card with a randomly changing speed. This makes it very hard for the skimmer to get a reliable reading. The actual reading by the ATM is done during the second phase, inside the ATM.
- tptacek 17y ago
  That's something companies like JPMC and Citi are doing. But there are tens of thousands of crappy Tranax deli-style ATMs out there that aren't going to change.
  - TeHCrAzY 17y ago
    Interesting, I called my bank about this annoying "feature" and was told it is for security reasons, but never understood why (and they were unwilling or unable to inform me). Enlightening. This functionality is very common in Australia, at least in Sydney.
  - ShabbyDoo 17y ago
    Perhaps the in-store machines are safer because it would be harder install and later retrieve the skimmer? Or, maybe an insider allows the skimmer to be installed? Aren't many small, retail ATMs owner-serviced, so no one with an incentive to audit would ever check it out?
- Timothee 17y ago
  Oh is that what it is? I have been wondering why my local Wells Fargo ATM was taking the card in in such a jerky fashion.
- PanMan 17y ago
  Why does that make it harder? It's a row of bits sliding by, right? Why does the speed matter? (I'm not saying your wrong, I'm just wondering why it would help?)
  - praptak 17y ago
    The bits don't have "start of bit" nor "end of bit" marks. The only way the reader can know which impulse constitutes a bit is by timing.
    - prewett 17y ago
      There are a lot of credit card machines where the purchases swipes the card themselves. Since the speed that people swipe is going to be variable, it can't be too hard to read a card without knowing the speed. (Like, say, putting 10101010 at the beginning, which you could use for calibration) So I'm not sure how a random speed helps things. Maybe ATM bits aren't encoded like credit cards?
      - praptak 17y ago
        "Since the speed that people swipe is going to be variable, it can't be too hard to read a card without knowing the speed." The speed just has to be fairly constant within a single swipe - then you can adjust for it. It usually is when humans do that - human hand has quite an inertia. The security feature on ATMs makes it vary wildly within a single swipe.
- daveungerer 17y ago
  That's a good idea. But I guess it's only a matter of time (and feasibility) before they add an optical sensor to pick up the card speed. Or more low-tech: a rubber wheel.
pmjordan 17y ago
In Europe, they could do away with the magnetic strip on cash cards. All terminals from recent years support the smartcard interface to the chip on the card. Presumably they keep the strip around for when you visit a country that doesn't use the smart card interface, so they can charge you an arm and a leg for exchanging currencies. And that recent case in Germany where the chips didn't support the year 2010, so you could only withdraw cash when you masked the interface with tape. The smartcard mechanism hopefully uses some challenge-response setup that makes it impossible to read out by scammers. (aside from the difficulty of interfacing with the chip during the split second it's in the right position)
- ShabbyDoo 17y ago
  Doesn't the ATM offer a unique challenge each time? Would it matter if the skimmer knew what challenge had been made and what the answer was?
  - pmjordan 17y ago
    I don't know exactly how it's implemented (tptacek and cperciva would probably have a field day with it) but I think the idea is to prevent exactly such replay attacks by generating the challenge on the bank's central servers.
- Tichy 17y ago
  Hm, should I glue a strip of tinfoil on the magnetic strip? Or what would be a good way to disable it?
  - pmjordan 17y ago
    A magnetic card writer should definitely do the trick...
    - Tichy 17y ago
      True, but then I would lose the option to use it at the few places where they don't understand the chip yet. Might be the better choice, though. Thinking a bit further, perhaps it would be possible to create some fake information on the magnet stripe that would identify anybody who uses it as a thief?
timf 17y ago
Could smart phones be used to provide a "have something" security model? Could an OTP generator like RSA SecurID do the trick? Let's say you enter two memorized numbers and then the last two numbers on the fob to make the four digit PIN (you would not want the whole PIN to be on the fob). Bonus: you need to use it for web logon as well. Some customers will pay extra for such services. Potentially avoiding hassles like ATM fraud and identity theft in the first place is worth a small fee per month to me because of the massive timesuck that could take place if they happened.
cstross 17y ago
Magstripe skimmers are a solved problem here in Europe; we moved on to chip and pin (EMV technology) nearly a decade ago specifically because of this kind of attack (and, in the case of the UK, because of this: http://www.theregister.co.uk/2005/10/21/phantoms_and_rogues/ http://www.theregister.co.uk/2005/10/21/phantoms_and_rogues/ ). There are concerns over the cryptographic integrity of PIN codes in some chip and pin implementations, but it's a much harder target for ATM skimmers, which is why organized criminals have switched to tampering with retail EPOS terminals instead. And the threshold for that is a lot higher, too. (http://www.telegraph.co.uk/news/worldnews/asia/pakistan/3173161/Credit-card-scam-How-it-works.html http://www.telegraph.co.uk/news/worldnews/asia/pakistan/3173...) Overall, the level of card crime in the UK seems to have diminished significantly since the switchover, although the general rule applies: if you build a better safe, you'll attract a better class of safe-cracker.
villiros 17y ago
There is a very simple solution: pass a law that automatically absolves customers of any fraud, and places burden of proof on the banks. Transactions reported fraudulent should be automatically reversed, unless the bank can provide proof (satisfying the standards expected in civil courts) that the customer was at fault. As an example, this was largely the case with transactions not involving PINs (signed-for purchases). Recent introduction of EMV (chip-and-pin cards) was really done to shift responsibility for such transactions back onto the customers and reduce banks' losses. This is also the case with stolen cards (in the UK and Ireland, at least): losses related to such cases are covered by the bank, even for losses occurring before the card was reported stolen. This is the reason banks implement various pattern-matching techniques to try and detect such transactions as soon as possible.

praptak 17y ago

> What else could be done simply? A simple thing that is actually being done: ATMs pulling in the card with a randomly changing speed. This makes it very hard for the skimmer to get a reliable reading. The actual reading by the ATM is done during the second phase, inside the ATM.

tptacek 17y ago
That's something companies like JPMC and Citi are doing. But there are tens of thousands of crappy Tranax deli-style ATMs out there that aren't going to change.
- TeHCrAzY 17y ago
  Interesting, I called my bank about this annoying "feature" and was told it is for security reasons, but never understood why (and they were unwilling or unable to inform me). Enlightening. This functionality is very common in Australia, at least in Sydney.
- ShabbyDoo 17y ago
  Perhaps the in-store machines are safer because it would be harder install and later retrieve the skimmer? Or, maybe an insider allows the skimmer to be installed? Aren't many small, retail ATMs owner-serviced, so no one with an incentive to audit would ever check it out?
Timothee 17y ago
Oh is that what it is? I have been wondering why my local Wells Fargo ATM was taking the card in in such a jerky fashion.
PanMan 17y ago
Why does that make it harder? It's a row of bits sliding by, right? Why does the speed matter? (I'm not saying your wrong, I'm just wondering why it would help?)
- praptak 17y ago
  The bits don't have "start of bit" nor "end of bit" marks. The only way the reader can know which impulse constitutes a bit is by timing.
  - prewett 17y ago
    There are a lot of credit card machines where the purchases swipes the card themselves. Since the speed that people swipe is going to be variable, it can't be too hard to read a card without knowing the speed. (Like, say, putting 10101010 at the beginning, which you could use for calibration) So I'm not sure how a random speed helps things. Maybe ATM bits aren't encoded like credit cards?
    - praptak 17y ago
      "Since the speed that people swipe is going to be variable, it can't be too hard to read a card without knowing the speed." The speed just has to be fairly constant within a single swipe - then you can adjust for it. It usually is when humans do that - human hand has quite an inertia. The security feature on ATMs makes it vary wildly within a single swipe.
daveungerer 17y ago
That's a good idea. But I guess it's only a matter of time (and feasibility) before they add an optical sensor to pick up the card speed. Or more low-tech: a rubber wheel.

pmjordan 17y ago

In Europe, they could do away with the magnetic strip on cash cards. All terminals from recent years support the smartcard interface to the chip on the card. Presumably they keep the strip around for when you visit a country that doesn't use the smart card interface, so they can charge you an arm and a leg for exchanging currencies. And that recent case in Germany where the chips didn't support the year 2010, so you could only withdraw cash when you masked the interface with tape. The smartcard mechanism hopefully uses some challenge-response setup that makes it impossible to read out by scammers. (aside from the difficulty of interfacing with the chip during the split second it's in the right position)

ShabbyDoo 17y ago
Doesn't the ATM offer a unique challenge each time? Would it matter if the skimmer knew what challenge had been made and what the answer was?
- pmjordan 17y ago
  I don't know exactly how it's implemented (tptacek and cperciva would probably have a field day with it) but I think the idea is to prevent exactly such replay attacks by generating the challenge on the bank's central servers.
Tichy 17y ago
Hm, should I glue a strip of tinfoil on the magnetic strip? Or what would be a good way to disable it?
- pmjordan 17y ago
  A magnetic card writer should definitely do the trick...
  - Tichy 17y ago
    True, but then I would lose the option to use it at the few places where they don't understand the chip yet. Might be the better choice, though. Thinking a bit further, perhaps it would be possible to create some fake information on the magnet stripe that would identify anybody who uses it as a thief?

timf 17y ago

Could smart phones be used to provide a "have something" security model? Could an OTP generator like RSA SecurID do the trick? Let's say you enter two memorized numbers and then the last two numbers on the fob to make the four digit PIN (you would not want the whole PIN to be on the fob). Bonus: you need to use it for web logon as well. Some customers will pay extra for such services. Potentially avoiding hassles like ATM fraud and identity theft in the first place is worth a small fee per month to me because of the massive timesuck that could take place if they happened.

cstross 17y ago

Magstripe skimmers are a solved problem here in Europe; we moved on to chip and pin (EMV technology) nearly a decade ago specifically because of this kind of attack (and, in the case of the UK, because of this: http://www.theregister.co.uk/2005/10/21/phantoms_and_rogues/ http://www.theregister.co.uk/2005/10/21/phantoms_and_rogues/ ). There are concerns over the cryptographic integrity of PIN codes in some chip and pin implementations, but it's a much harder target for ATM skimmers, which is why organized criminals have switched to tampering with retail EPOS terminals instead. And the threshold for that is a lot higher, too. (http://www.telegraph.co.uk/news/worldnews/asia/pakistan/3173161/Credit-card-scam-How-it-works.html http://www.telegraph.co.uk/news/worldnews/asia/pakistan/3173...) Overall, the level of card crime in the UK seems to have diminished significantly since the switchover, although the general rule applies: if you build a better safe, you'll attract a better class of safe-cracker.

villiros 17y ago

There is a very simple solution: pass a law that automatically absolves customers of any fraud, and places burden of proof on the banks. Transactions reported fraudulent should be automatically reversed, unless the bank can provide proof (satisfying the standards expected in civil courts) that the customer was at fault. As an example, this was largely the case with transactions not involving PINs (signed-for purchases). Recent introduction of EMV (chip-and-pin cards) was really done to shift responsibility for such transactions back onto the customers and reduce banks' losses. This is also the case with stolen cards (in the UK and Ireland, at least): losses related to such cases are covered by the bank, even for losses occurring before the card was reported stolen. This is the reason banks implement various pattern-matching techniques to try and detect such transactions as soon as possible.