10 ms·

While I've seen skimmers that cover the entire front of the ATM, it boggles my mind that the credit card acceptor isn't designed to be flush with the front face

While I've seen skimmers that cover the entire front of the ATM, it boggles my mind that the credit card acceptor isn't designed to be flush with the front face. That would make it much harder to plant an additional device on top without it looking more conspicuous.

honkhonkpants 10y ago
Yeah I don't know why they have designed the card readers this way. It conditions the user to expect a ridiculous thing slapped on the front of the machine. In my opinion it makes it much easier for the skimmers.
- idbehold 10y ago
  It wouldn't matter. See here: http://krebsonsecurity.com/2016/05/crooks-go-deep-with-deep-insert-skimmers/ http://krebsonsecurity.com/2016/05/crooks-go-deep-with-deep-...
  - Shivetya 10y ago
    I am curious if the stripe can be retained only for orientation and then have something embedded in the holographic image so many cards use that can be visually read. Kind of like a fixed CD
    - dogma1138 10y ago
      Then the skimmers will evolve to read it. As long as you can compromise the device it's fair game.
      - tokensimian 10y ago
        Ensuring that skimmers need to evolve frequently is a valid counter-strategy because it increases their cost of goods stolen.
        dogma1138 10y ago
        Eh not really skimmers are always going to be cheap to produce compared to what you can get in return. You can't just change the tech of the cards because it needs to allow people from all over the world to use an ATM and most importantly you can't switch over ATM's and credit cards every few years that alone would cost more than what is lost to skimmers. ATM's need to be reliable and consistent that actually makes it easier for both end users to detect skimmers and for ATM manufacturers to make them more resistant to skimmers. Just to drive the point home ATM skimmers with the ability to read or probe the chip & pin were implemented before any chip & pin ATM's were out there it was simple enough to do in real time by just inserting an additional shim that would touch the smart card interface on your bank card. The skimmer shown in this video is a fairly basic one there are already skimmers with NFC and Chip & Pin capabilities that read out the pin pad in real time to process a direct charge transaction while you use the ATM (they don't care about stealing your Track 1 and Track 2 data). The ways of reading the pads vary from using cameras that are not that different from the kinect one to laying a thin touch sensor over the keypad to actually running a differential capacitive touch analysis on the metal keys as they are grounded. A single skimmer in a tourist spot can be used to access 10,000's of accounts over a single weekend with that financial incentive the cost of the skimmer can almost be ignored.
        tokensimian 10y ago
        The cost of the skimmer is insignificant, but the labor to replace it adds friction and is going to reduce the number of active skimmers. To replace the removed skimmer will also expose the criminal to more risk of getting caught, especially if the police are aware of the removal and can set up a sting or something. So while the economic ROI is so high the behavior will continue, it does slow them down. Not a complete fix by any means, but adding friction to their criminal behavior.
        dogma1138 10y ago
        It's not a fix both cards and ATM's have to serve the lowest common denominator you can't just replace billions of cards and millions of ATM's every few years because of skimmers. The labor to replace skimmers is already not an issue skimmers do not last for years, or even weeks most of them have a battery that only lasts for a few days and they are put at strategic locations usually hot spots around big venues or events.
      - niij 10y ago
        From my understanding the new chip cards are, in effect, smart cards meaning that after the first use, the information collected is useless. Whereas with a magnetic stripe the CC #, CVV #, expiration date, and name are all transferred plaintext.
        dogma1138 10y ago
        Your understanding is incorrect. This is just one example [0] there are many ways to skim Chip & Pin (EMV[1]) cards, even if you build a card which cannot be cloned through active or passive monitoring of the ICC component you can still perform at least 1 illicit transaction by proxying to it. The same holds for NFC skimmers which are now becoming more and more relevant and popular especially with the commercial availability of ultra-low-power and ultra-compact wireless SOC's. If some one was wondering what are things like ESP8266[2] that give you WiFi connectivity with less than 1mW standby draw while being the size of a quarter are good for; if nothing less they are a pretty damn good platform for real time NFC or ICC skimming. [0]http://sec.cs.ucl.ac.uk/users/smurdoch/papers/oakland14chipandskim.pdf http://sec.cs.ucl.ac.uk/users/smurdoch/papers/oakland14chipa... [1]https://en.wikipedia.org/wiki/EMV https://en.wikipedia.org/wiki/EMV [2]https://www.sparkfun.com/products/13678 https://www.sparkfun.com/products/13678
        niij 10y ago
        I stand corrected. Thank you for the information.
    - kalleboo 10y ago
      Chip cards use challenge-and-response with an embedded secret key and can't be cloned. (well, unless your bank so helpfully puts the card number+name in plaintext on the chip, as some do)
russdill 10y ago
Even if it was flush, people are so used to seeing ones that stick out it wouldn't matter. I wonder if it's possible to demagnetize certain cards so they only use chips.
lucb1e 10y ago
I'm sorry, but what does "flush" mean here? I only know it in the context of toilets and computer caches. (I'm not a native speaker.) Looking it up, you might mean it glows in some color?
- perflexive 10y ago
  Flush in this instance means "not protruding."
- rdiddly 10y ago
  Similar to "flat"
- Terr_ 10y ago
  Providing an unbroken continuous outer surface.
- FatAmerican 10y ago
  It means 'flat' in this context.
- civilian 10y ago
  Like the other people are saying, it means" flat" or "broken outer surface". Are you familiar with poker? We have another use of the word `flush` in that context, https://en.wikipedia.org/wiki/List_of_poker_hands#Flush https://en.wikipedia.org/wiki/List_of_poker_hands#Flush where all of the cards are the same suit. So it's a similar use of flush in this instance, that everything is the same. It's similar to this thread's use of "flush".
  - ChristianGeek 10y ago
    The poker analogy is terrible.
    - salmon30salmon 10y ago
      Please keep comments constructive. This does not help the original questioner, who may not understand why it isn't a fantastic analogy. Please either refrain from the negative commentary, or enhance the conversation by clarifying why you feel it is lacking.
hiharryhere 10y ago
I agree. Have a smooth front with a flush slot and show on the screen a picture of what the ATM should look like so you can compare to see if there are any protruding bits that shouldn't be there.
tdy721 10y ago
I don't think this is a design issue. Unless you're proposing a standard? (In that case, how about a better system?)
nom 10y ago
The 'green eye' card slot show in the video is actually designed like this in order to make it harder to hide a skimming device in the slot. It doesn't help though, ATM skimming is just so lucrative that they can easily spend a couple of thousand dollars on a skimming device. It pays for itself after less than a day of 'deployment'. Thats also the reason why removing a skimmer by yourself is always a _very very_ bad idea. There is a good chance that the owner of that device is very close. If its a non-wireless skimmer (like most of them are, only few have GSM or bluetooth) the criminal has to retrieve it to collect his loot. If he doesn't, he'll looses thousands of dollars. You might get stabbed for this. Better alert the authorities and let them handle it. As somebody already mentioned, Brian Krebs has many very interesting posts about skimming technology, like this one about a similar skimming device: http://krebsonsecurity.com/2011/12/pro-grade-3d-printer-made-atm-skimmer/ http://krebsonsecurity.com/2011/12/pro-grade-3d-printer-made...
retroencabulato 10y ago
What I think would be more effective is strategically placed range sensors that shutdown the ATM if something covers them for a period of time.

honkhonkpants 10y ago

Yeah I don't know why they have designed the card readers this way. It conditions the user to expect a ridiculous thing slapped on the front of the machine. In my opinion it makes it much easier for the skimmers.

idbehold 10y ago
It wouldn't matter. See here: http://krebsonsecurity.com/2016/05/crooks-go-deep-with-deep-insert-skimmers/ http://krebsonsecurity.com/2016/05/crooks-go-deep-with-deep-...
- Shivetya 10y ago
  I am curious if the stripe can be retained only for orientation and then have something embedded in the holographic image so many cards use that can be visually read. Kind of like a fixed CD
  - dogma1138 10y ago
    Then the skimmers will evolve to read it. As long as you can compromise the device it's fair game.
    - tokensimian 10y ago
      Ensuring that skimmers need to evolve frequently is a valid counter-strategy because it increases their cost of goods stolen.
      - dogma1138 10y ago
        Eh not really skimmers are always going to be cheap to produce compared to what you can get in return. You can't just change the tech of the cards because it needs to allow people from all over the world to use an ATM and most importantly you can't switch over ATM's and credit cards every few years that alone would cost more than what is lost to skimmers. ATM's need to be reliable and consistent that actually makes it easier for both end users to detect skimmers and for ATM manufacturers to make them more resistant to skimmers. Just to drive the point home ATM skimmers with the ability to read or probe the chip & pin were implemented before any chip & pin ATM's were out there it was simple enough to do in real time by just inserting an additional shim that would touch the smart card interface on your bank card. The skimmer shown in this video is a fairly basic one there are already skimmers with NFC and Chip & Pin capabilities that read out the pin pad in real time to process a direct charge transaction while you use the ATM (they don't care about stealing your Track 1 and Track 2 data). The ways of reading the pads vary from using cameras that are not that different from the kinect one to laying a thin touch sensor over the keypad to actually running a differential capacitive touch analysis on the metal keys as they are grounded. A single skimmer in a tourist spot can be used to access 10,000's of accounts over a single weekend with that financial incentive the cost of the skimmer can almost be ignored.
        tokensimian 10y ago
        The cost of the skimmer is insignificant, but the labor to replace it adds friction and is going to reduce the number of active skimmers. To replace the removed skimmer will also expose the criminal to more risk of getting caught, especially if the police are aware of the removal and can set up a sting or something. So while the economic ROI is so high the behavior will continue, it does slow them down. Not a complete fix by any means, but adding friction to their criminal behavior.
        dogma1138 10y ago
        It's not a fix both cards and ATM's have to serve the lowest common denominator you can't just replace billions of cards and millions of ATM's every few years because of skimmers. The labor to replace skimmers is already not an issue skimmers do not last for years, or even weeks most of them have a battery that only lasts for a few days and they are put at strategic locations usually hot spots around big venues or events.
    - niij 10y ago
      From my understanding the new chip cards are, in effect, smart cards meaning that after the first use, the information collected is useless. Whereas with a magnetic stripe the CC #, CVV #, expiration date, and name are all transferred plaintext.
      - dogma1138 10y ago
        Your understanding is incorrect. This is just one example [0] there are many ways to skim Chip & Pin (EMV[1]) cards, even if you build a card which cannot be cloned through active or passive monitoring of the ICC component you can still perform at least 1 illicit transaction by proxying to it. The same holds for NFC skimmers which are now becoming more and more relevant and popular especially with the commercial availability of ultra-low-power and ultra-compact wireless SOC's. If some one was wondering what are things like ESP8266[2] that give you WiFi connectivity with less than 1mW standby draw while being the size of a quarter are good for; if nothing less they are a pretty damn good platform for real time NFC or ICC skimming. [0]http://sec.cs.ucl.ac.uk/users/smurdoch/papers/oakland14chipandskim.pdf http://sec.cs.ucl.ac.uk/users/smurdoch/papers/oakland14chipa... [1]https://en.wikipedia.org/wiki/EMV https://en.wikipedia.org/wiki/EMV [2]https://www.sparkfun.com/products/13678 https://www.sparkfun.com/products/13678
        niij 10y ago
        I stand corrected. Thank you for the information.
  - kalleboo 10y ago
    Chip cards use challenge-and-response with an embedded secret key and can't be cloned. (well, unless your bank so helpfully puts the card number+name in plaintext on the chip, as some do)

russdill 10y ago

Even if it was flush, people are so used to seeing ones that stick out it wouldn't matter. I wonder if it's possible to demagnetize certain cards so they only use chips.

lucb1e 10y ago

I'm sorry, but what does "flush" mean here? I only know it in the context of toilets and computer caches. (I'm not a native speaker.) Looking it up, you might mean it glows in some color?

perflexive 10y ago
Flush in this instance means "not protruding."
rdiddly 10y ago
Similar to "flat"
Terr_ 10y ago
Providing an unbroken continuous outer surface.
FatAmerican 10y ago
It means 'flat' in this context.
civilian 10y ago
Like the other people are saying, it means" flat" or "broken outer surface". Are you familiar with poker? We have another use of the word `flush` in that context, https://en.wikipedia.org/wiki/List_of_poker_hands#Flush https://en.wikipedia.org/wiki/List_of_poker_hands#Flush where all of the cards are the same suit. So it's a similar use of flush in this instance, that everything is the same. It's similar to this thread's use of "flush".
- ChristianGeek 10y ago
  The poker analogy is terrible.
  - salmon30salmon 10y ago
    Please keep comments constructive. This does not help the original questioner, who may not understand why it isn't a fantastic analogy. Please either refrain from the negative commentary, or enhance the conversation by clarifying why you feel it is lacking.

hiharryhere 10y ago

I agree. Have a smooth front with a flush slot and show on the screen a picture of what the ATM should look like so you can compare to see if there are any protruding bits that shouldn't be there.

tdy721 10y ago

I don't think this is a design issue. Unless you're proposing a standard? (In that case, how about a better system?)

nom 10y ago

The 'green eye' card slot show in the video is actually designed like this in order to make it harder to hide a skimming device in the slot. It doesn't help though, ATM skimming is just so lucrative that they can easily spend a couple of thousand dollars on a skimming device. It pays for itself after less than a day of 'deployment'. Thats also the reason why removing a skimmer by yourself is always a _very very_ bad idea. There is a good chance that the owner of that device is very close. If its a non-wireless skimmer (like most of them are, only few have GSM or bluetooth) the criminal has to retrieve it to collect his loot. If he doesn't, he'll looses thousands of dollars. You might get stabbed for this. Better alert the authorities and let them handle it. As somebody already mentioned, Brian Krebs has many very interesting posts about skimming technology, like this one about a similar skimming device: http://krebsonsecurity.com/2011/12/pro-grade-3d-printer-made-atm-skimmer/ http://krebsonsecurity.com/2011/12/pro-grade-3d-printer-made...

retroencabulato 10y ago

What I think would be more effective is strategically placed range sensors that shutdown the ATM if something covers them for a period of time.