11 ms·
Can’t Hack a Hacker: Reverse Engineering a Discovered ATM Skimmer
- siluvatari 10y agoPlease warn in tweet when you link to paywalls
- Jaruzel 10y agoFrom the FAQ: In comments, it's ok to ask how to read an article and to help other users do so. But please don't post complaints about paywalls. Those are off topic.
- deleted 10y ago[deleted]
- duaneb 10y agoGoogle cached copy: https://webcache.googleusercontent.com/search?q=cache:72ebLHTY2bMJ:https://trustfoundry.net/reverse-engineering-a-discovered-atm-skimmer/+&cd=1&hl=en&ct=clnk&gl=us https://webcache.googleusercontent.com/search?q=cache:72ebLH...
- MrQuincle 10y agoNext step: put a tracking device in the skimmer to find out where their headquarters are. :-)
- thesimon 10y agoSome banks over here (Europe) now let you block mag-stripe credit card transactions. Actually sounds like a good way to prevent ATM fraud as long as you are not visiting the US.
- fleitz 10y agoIn Canada this is by default. If you swipe your card at a machine that supports chip it will be disabled until the next time you use the chip. However, if the card reader doesn't support chip you can still swipe. Essentially all machines support chip now. Only vending machines / parking meters still use swipe.
- ry_ry 10y agoIn the UK one of our larger train companies is still using pre-hated handheld card terminals they bought from British Airways over 20 years ago on their buffet counters. Fun fact: They apparently aren't connected to anything, and transactions are processed later, so basically any valid card will go through regardless of funds etc. The market for shoddy bacon baguette & gin fraud is presumably fairly limited.
- SmellyGeekBoy 10y agoYou may laugh but those bacon baguettes are pretty expensive ;)
- raddad 10y agoAnother fun fact. Before card terminals became universal, it was common for different cards to require their own handheld terminal. A sales desk may have had half a dozen or so, in order top process the card. I really wish I could find that video again. It was interesting.
- thesimon 10y ago>Fun fact: They apparently aren't connected to anything, and transactions are processed later, so basically any valid card will go through regardless of funds etc. Cards however have a special "service code" on the mag stripe/chip. Certain cards like the Monese debit card or debit cards for customers who are not allowed to go into overdraft can only be used for online transactions. So they wouldn't work in this case where the transaction is authorized offline. Source: My experience with cards in Germany where the train company is processing credit cards the same way.
- JadeNB 10y ago> pre-hated handheld card terminals I assume that first word isn't what you meant, but I can't come up with any substitute. What was it supposed to be?
- grkvlt 10y ago
- jevinskie 10y agoThe whole situation in the US is silly. Some background: when a major iOS version comes out, thanks to Apple not allowing downgrades (grrrrr...), my company buys a new set of test devices for each major iOS version. When iOS 9 came out, I went to Walmart with my manager's company credit card to get some iPods (cheapest iOS test devices). The clerk asked me what I wanted and I said "5 iPods please". I would be suspicious if anyone asked for that many iDevices. When they realized they only had 3 iPods, I said I'd take those. When I went to check out, I asked them to break up the transactions into < $500 chunks so as to not cause additional oversight, they obliged. This was the first time I had ever used a chip-enabled card. It was obvious to the cashier, I was fumbling around with the card and had to ask how to operate it. Finally, after I bought three iPods in two transactions with a card I had obviously never used before, with the merchandise in a bag in hand, they ask for the credit card and my ID to verify the name. Busted, I thought! But no, after explaining that I was buying the devices on behalf of my boss (with no proof of this) they let me go on my merry way. I was flabbergasted. TLDR: If you have a stolen credit card and want to use it to buy expensive electronics to fence, go to the Electronics department at the West Lafayette Walmart. Chip and signature cards offer no improvement in security, even when faced with at least five big red flags that indicate fraud.
- duaneb 10y agoTo be honest, all of the behavior you would have seen as fraudulent is pretty typical in retail. Furthermore, it's always been obvious that the chip'd cards provide no improvement for online fraud. It's a PR move to hide the fact that the banks and creditors rely so heavily on transaction disputing to fend off fraud.
- nickpsecurity 10y agoYou're right. Lots of people split orders, probably one out of 4 or 5 fumble for things, and quite a few buy for their company. The phone the person bought was an iPhone rather than some weird one. Had the comment said iPods I'd have expected a bit more skepticism from cashier. Yet, a company sends someone to buy a set of mainstream phones split on two transactions? Totally believable for a cashier and not as crazy as people's grocery orders have gotten while I was in line. ;)
- SnaKeZ 10y agoRisky decision take home the skimmer
- comboy 10y agoThe only thing I kept thinking about. Police could already know about it and could have been just waiting for the owner of the skimmer to grab him. How on earth would they explain that it's not theirs?
- ethanbond 10y ago"I'm a security researcher from the opposite side of the earth on vacation in Bali." You don't think that'd work?
- mattdotc 10y agoAlso, if you're not police, you shouldn't be taking evidence of a crime for your own homebrew investigation. Call the cops and wait there until you see them dismantle the skimmer if you're so concerned about others.
- USANEEDSHELP 10y agoQuestion: Can you trust the cops? Especially in Indonesia... Don't take anything. Report it anonymously to the bank or ATM vendor or Police
- nickpsecurity 10y ago"Also, if you're not police, you shouldn't be taking evidence of a crime for your own homebrew investigation." This immediately jumped out at me. Most likely, you might get scolded or in trouble for screwing up chain of evidence or something. In a rare scenario, they might be watching the place with the skimmer there waiting for the perp to show up. Not sure of the risk there. There was debate on how to handle it on Krebs. I think one person's suggestion of sending an anonymous tip about a skimmer to number on ATM was a good one. Keeps you out of FBI's microscope, local thugs watching don't get you, no convincing store clerks, and the skimmer gets taken care of somehow. Maybe best idea.
- mavhc 10y agoInstead of banks spending millions on fraud detection how about they invent a system of moving money around that doesn't require you to give your username and password to a 3rd party and hope they only remove the amount of money they say they will?
- jadyoyster 10y agoIn many countries with chip & pin you can only pay online using your debit card with a security token generator and your PIN code.
- programmer_dude 10y agoWe have this already it is called Internet banking: https://en.wikipedia.org/wiki/Online_banking https://en.wikipedia.org/wiki/Online_banking and mobile banking: https://en.wikipedia.org/wiki/Mobile_banking https://en.wikipedia.org/wiki/Mobile_banking
- beamatronic 10y agoI think that what the parent refers to in a larger sense is the way the current financial system "pulls" money - if I for example set up Auto-Pay with the cable company, every month I pray they get the amount right. Because if they don't, it becomes a huge use of my time to fix all the damage.
- kps 10y agoPerhaps some sort of pre-printed paper or plastic slips that function like money? I know, that could never catch on — no way to track your data or charge you a commission.
- kragen 10y agoLike some kind of cryptographically authenticated public pseudonymous ledger maintained by a peer-to-peer network and constantly audited by millions of participants? Aren't you afraid that would destroy civilization?
- 10y ago
- Spare_account 10y agoJust a minor point but it really weakened the article for me: The photo at the beginning purporting to show a skimmer sitting in front of an ATM in fact shows a standard ATM without a skimmer. https://www.flickr.com/photos/angusf/4450137156 https://www.flickr.com/photos/angusf/4450137156 Then the 'keypad overlay' in the second image is just a photoshop of a keypad. Fortunately, the rest of the article was interesting enough to outweigh these issues. The best advice contained in the article, for me, was that interfering with ATM skimmers and camera modules can result in direct intervention by the criminals who may be watching nearby. The best strategy is to leave it alone and alert the bank immediately.
- dizzy3gg 10y agoI'd be cautious putting my card in that slot, but I've seen many legit machines that look a bit ropey.
- kbart 10y agoIt amazes me that cards with magstripe are still being issued. I have never needed to use magnet instead of chip despite having traveled quite a bit. I used to ask my bank to disable magstripe on my cards, but now they changed this to the default option for all new cards.
- reacweb 10y agoMy magstripe is demagnetized (because my phone jacket contains a magnet). I have no problem using my card (in France).
- pjc50 10y agoIt's worse than that: contactless payment has two modes, and one of them just lets you read the magswipe track 2 data (including card number) through the contactless interface. https://www.level2kernel.com/emv-glossary.html#MSDmode https://www.level2kernel.com/emv-glossary.html#MSDmode
- dzhiurgis 10y agoIs it used anywhere?
- ptaipale 10y agoYou can also disable the magstripe simply by using a strong magnet next to it. Putting the card in the same pocket with my Android phone with a wallet case that has a magnetic "lock" seems to be enough...
- alejohausner 10y agoGreat tip! I'll try that. ;-)
- ptaipale 10y agoBTW it also works very nicely for those hotel key cards that have a magnetic stripe. You'll be safely kept away from the minibar of your room if you put your key card in the same pocket with the phone.
- userbinator 10y agoThe beeps correspond to actual keypresses, so you can’t fool the skimmer by pretending to touch multiple keys. The keys on ATMs I've used don't actually move much, so you could put several fingers on the keys at once and press only slightly harder with the one you intended. It might confuse any PIN pad overlays too, which by design have to activate with less pressure than the real switches so as not to arouse any more suspicion.
- ck2 10y agoOr type a series of numbers, hit clear, enter real pin. Though not to hard to realize last four are pin. If the atm has a backspace instead of all clear, numbers, backspace one or two, numbers. Still, not the usual routine.
- coldcode 10y ago"Error establishing a database connection". Why does this still happen to people in 2016?
- josefresco 10y agoI get it but ... front page Hacker News is kind of a big deal, hosting is sold very cheaply - sadly not everything scales.
- colinbartlett 10y agoEven things that do scale, don't often scale automatically. If I spring for Heroku to host my blog over GoDaddy, it's still going to go down the minute it hits the front page of Hacker News.
- ck2 10y agoWrapping in aluminum foil does not make a Faraday cage. Don't believe me? Wrap your smartphone in foil and then call it. Mine rang. Freaked me out when I discovered this. It didn't ring when I put it in the freezer though.
- jobvandervoort 10y agoFaraday cages do not block all signals. From wikipedia: > A common misconception is that a Faraday cage provides full blockage or attenuation, this is not true. The reception or transmission of radio waves, a form of electromagnetic radiation, to or from an antenna within a Faraday cage is heavily attenuated or blocked by the cage. However, a Faraday cage has varied attenuation depending on wave form, frequency or distance from receiver. Near field High powered frequency transmissions like HF RFID are more likely to penetrate. Solid steel cages provide better attenuation over mesh cages.
- ck2 10y agoYou know those old school lead bags they used to use for carrying film through airport x-ray scanners? https://www.google.com/search?q=lead+bag+for+film&gbv=1&prmd=ivns&source=lnms&tbm=isch https://www.google.com/search?q=lead+bag+for+film&gbv=1&prmd... I wonder if that would be far better to almost completely kill a signal.
- aaron695 10y agoMine rings in the freezer. The theory why Snowden put the phones in the freezer was to block sound. Or he made a mistake.
- ck2 10y agoProbably depends on the fridge. Mine is old, really old, like 20 years. Also it probably just reduces the signal, not kill it completely so maybe how close to the tower you are matters too.
- rasz_pl 10y agoyou will like this: Can you call a cell phone in the microwave? Physics Girl https://www.youtube.com/watch?v=ot4_jVFXxUU https://www.youtube.com/watch?v=ot4_jVFXxUU
- deleted 10y ago[deleted]
- Pinatubo 10y agoHe's worried about being shot by gang members for stealing the skimmer, and then he posts this story with his picture?
- stefs 10y ago"Kansas City Penetration Testing & Information Security" they're probably back in the u.s. again. it's unlikely they'll send an assassin overseas.
- nthcolumn 10y agomupeng
- deleted 10y ago[deleted]
- markdown 10y ago> Cover your PIN with your hand This will not protect you from PIN overlays, but it will hide your PIN from hidden cameras. Plus it’s so easy to do, why wouldn’t you? Here in Fiji, ATMs have a an opaque plastic guard over the keypad to keep the pin out of view of a camera. Kinda like this one but bigger: http://thumbs.dreamstime.com/x/atm-keypad-22036137.jpg http://thumbs.dreamstime.com/x/atm-keypad-22036137.jpg
- chatmasta 10y agoIf you read the article, so did this ATM. Except it wasn't a guard... it was a skimmer with a pinhole camera in it.