5 ms·

I would argue that "script injection" is the means by which the credit card is "skimmed"

monoideism 6y ago
Yes, agreed, it's "skimmed" in quotes, because it's an analogy. I'm still not sure if it's wise to use the same term for both a physical and virtual skimmer, from the point of view of a regular consumer. Something like "skimware" seems better, if you must use a specific term related to "skimmer". Maybe I'm wrong, though.
- dec0dedab0de 6y ago
  A physical credit card skimmer is using the same "skimming" analogy.
  - monoideism 6y ago
    Which analogy is that? I always assumed a physical card skimmer was based on the following definition of "to skim" (from Merriam- Webster): 2: to read, study, or examine superficially and rapidly Edit: If you mean the original meaning (??) of skim (as in skim a liquid surface), then maybe???
    - im3w1l 6y ago
      Looking at the definitions from the free dictionary, they seem like different aspects of a common concept cluster. Light, superficial, quick motion, taking a small part away. Skimming a card when it's swiped fits in perfectly with this.
    - dec0dedab0de 6y ago
      Yeah like a pool skimmer or skimming fat from milk
    - sigmaprimus 6y ago
      When I think of a credit card skimmer, a pay at the pump card reader attack is what first comes to mind. Such as where the customer inserts their card, completes their purchase and the entire transaction goes through without any apparent issue. This attack seems to be more like a spoofer, the comparison would be a phoney ATM machine that victims insert their cards, the card is cloned and the victim is then prompted to enter their PIN. After which, the phoney ATM professes a network error or the like and the card is returned. No legitimate transaction occurs. I am a little concerned with the morality of publishing this attack in such detail without first notifying and giving a period of time for the susceptible vendors to patch this vulnerability. Doing so it is very reminiscent of how sensitive information was published years ago enabling drones of script kiddies to engage in Ddos attacks back a few years (decades) ago. It was my understanding that there is a general code of conduct, regarding publishing these attacts that was created to prevent the proliferation of vulnerabilities before developers had an opportunity to address the issue.
- machello13 6y ago
  Yeah, well, if you look closely, I also put "script injection" in quotes. I only did that for emphasis.

Yes, agreed, it's "skimmed" in quotes, because it's an analogy. I'm still not sure if it's wise to use the same term for both a physical and virtual skimmer, from the point of view of a regular consumer. Something like "skimware" seems better, if you must use a specific term related to "skimmer". Maybe I'm wrong, though.

dec0dedab0de 6y ago
A physical credit card skimmer is using the same "skimming" analogy.
- monoideism 6y ago
  Which analogy is that? I always assumed a physical card skimmer was based on the following definition of "to skim" (from Merriam- Webster): 2: to read, study, or examine superficially and rapidly Edit: If you mean the original meaning (??) of skim (as in skim a liquid surface), then maybe???
  - im3w1l 6y ago
    Looking at the definitions from the free dictionary, they seem like different aspects of a common concept cluster. Light, superficial, quick motion, taking a small part away. Skimming a card when it's swiped fits in perfectly with this.
  - dec0dedab0de 6y ago
    Yeah like a pool skimmer or skimming fat from milk
  - sigmaprimus 6y ago
    When I think of a credit card skimmer, a pay at the pump card reader attack is what first comes to mind. Such as where the customer inserts their card, completes their purchase and the entire transaction goes through without any apparent issue. This attack seems to be more like a spoofer, the comparison would be a phoney ATM machine that victims insert their cards, the card is cloned and the victim is then prompted to enter their PIN. After which, the phoney ATM professes a network error or the like and the card is returned. No legitimate transaction occurs. I am a little concerned with the morality of publishing this attack in such detail without first notifying and giving a period of time for the susceptible vendors to patch this vulnerability. Doing so it is very reminiscent of how sensitive information was published years ago enabling drones of script kiddies to engage in Ddos attacks back a few years (decades) ago. It was my understanding that there is a general code of conduct, regarding publishing these attacts that was created to prevent the proliferation of vulnerabilities before developers had an opportunity to address the issue.
machello13 6y ago
Yeah, well, if you look closely, I also put "script injection" in quotes. I only did that for emphasis.