Finding an ATM Skimmer: It pays to be paranoid
linkedin.com
linkedin.com
I notified the branch manager and he immediately deactivated the machine and called their security team and the police. I didn't hang around to see their response, but happily they were very thankful and took it seriously.
It was fairly thick - maybe 1/2" - so had plenty space for an SD card, battery, etc. I don't think they leave them on the ATM for a very long time before retrieval so it wouldn't need a huge battery.
I'm going to stop by the bank tomorrow to find out what happened with it.
Would you say that grabbing the receptacle and trying to move it briefly would have made it obvious it was a cover? Or did you really need to put some force behind it and pry it off?
I'm curious how effective my efforts may be from the standpoint of "general ATM security" and whether they would actually protect me from anything.
I first checked for a keypad overlay before noticing the camera. Its bezel was pretty loose when pulled on. Probably just double-sided tape.
Here are a few more angles: https://imgur.com/a/IQR4j
As a security professional I cringe at this sort of thing every time it happens. Fundamentally this isn't something to go reverse engineer, to show off to the person next to you to show how smart you are, it's evidence of a crime and needs to be handled as such by contacting the authorities. Perhaps there are fingerprints on the inside. Maybe the police have stopped someone who was suspicious around that ATM previously and would now have evidence to bring them in for further questioning. Maybe they could pull video. By not calling the authorities all of those potential angles to find the perpetrator are lost. Further, in many jurisdictions, not immediately calling the police can get you in a lot of trouble:
1) What if the police were watching, waiting for the criminal to return to remove it? You're now their prime suspect and a video of your 'discovery' isn't going to help you as you sit in jail for a few days.
2) This is directly tampering with evidence of a crime. Removing it is fine, that's discovery, but keeping it without contacting the authorities? That could be criminal.
a) not report a crime & b) take evidence from the scene of the crime
because the police likely don't care, are incompetent, and have no resources?
Instead, it's on the front page of Hacker News, and a LOT more people are aware of how sophisticated skimmers have become, and will be a lot more careful to check for skimmers on ATMs, and probably start warning family members and friends. IMO, this had a much more positive impact overall than anything the police would have done. But perhaps my opinion of police does not apply to Austrian police...
In terms of this as valuable education, lets put our critical thinking hats on. Did this ultimately make the world safer and help real people? Likely very little because most people have zero liability for credit-card fraud and if we think through this a bit more maybe it makes the world more dangerous.
What happens when someone who watched this video decides to do the same when they find a skimmer in Mexico, but someone from the local crime syndicate that placed it there see's them remove it, then follows them until they have a chance to take it back with force? Now someone gets hurt.
In all cases, immediately call the police.
EDIT: and if you don't trust the police, leave it, walk away, and anon call it in or call the bank.
However, this is an ATM skimmer + PIN cam. Not credit card fraud. Debit and ATM cards have much less protection. Consumers have 0 liability for CC fraud; when but your card is skimmed and PIN is stolen your checking account can get emptied, and you potentially have the burden of proving that it wasn't you using your card in a card-present, PIN transaction.
Sure regarding technology they are not always up to industry standards, they might have to deal with too much workload, they might be under-funded, and someone working for the police will most likely not be smart enough to work for Google and earn 200000$ a year. But they can take fingerprints, they do have databases where they collect such information, they certainly can analyse video material, and it's stupid to think that in a country like Austria this won't be investigated (it's also Vienna we are talking about).
Even if they just take some fingerprints, analyse the video material, maybe notify the bank and send out a memo, how is this not worth reporting it immediately?! The bank being notified can warn customers, change pins for customers they think might be victims, are paying more attention, ...
I won't name other countries as I don't want to insult anyone, so let's just say in a "tourist-heavy corruption-ridden non-1st world country" I could sympathize a little bit more with your sentiment, but in this case I think you are just wrong and should re-think your attitude.
We've had a rash of car break-ins in my neighborhood. My roomate had a large metal ball hucked through his car window, and when the police called, the dude refused to bag it for evidence, take it with him, fingerprint it, or anything. I'd say to consider yourself lucky if your local beat police give a damn about collecting evidence of a crime that's not drugs, violence, or human trafficking.
EDIT: Just remembered, instead, he picked up the metal ball and started tossing it around, from hand to hand, into the air, etc. All casual like - as if it were a toy. Callous disregard for his job and totally destroyed the evidence.
-) Even if no fingerprints are taken, the other points I made stand.
-) Anecdotal evidence is weak/no evidence, though I will not disregard it completely.
-) Not sure where this happened, call me biased (I really don't want to open a can of worms here), but I have more believe in the police of Austria compared to many other (including the USA for example) countries. [1]
[1] I don't mean to imply the capabilities are different, I want to say that I think the police in the USA, especially on the level of "normal" police officers, seems to get away with far more misconduct / inappropriate behaviour than a police officer in Austria ever would. Crime rates also have a huge impact, in areas of high crime rates or under-funded police especially "smaller" cases will not be investigated properly, et cetera...
To make matters worse, it was most likely payback from a person who previously vandalized his car and got arrested for it. The cop wouldn't even listen.
Obviously card skimming is a massively serious offence and should be thoroughly investigated.
As in your case, the police did not bag it or take it away. I was surprised as, even if there were no fingerprints, the engraved inscription on the knife would make it unique and would surely provide some clue. They told us to bin it, which we did.
They did not hold out much hope that they would find the perpetrators or our belongings. They suggested we go around to local pawn shops to see if any of our stuff showed up.
Ugh. Equating market value and intelligence is a cancer in tech circles. I've worked in government. I've worked in private sector. My last job at a highly valued SV firm had me in close proximity to people in government. The private sector guys weren't any smarter, but they sure thought they were.
Some people knowingly go into the government sector and take pay cuts because they believe in civil service.
A minority perhaps, but you shouldn't dismiss them out-of-hand.
Source: I live in Vienna, and I follow the news.
In a world of mostly-dumb-people: no, I disagree. The overwhelming majority of my direct life experience, so far, to date, says we are awash in a world of dumb people. Therefore, I can't say I agree with you. "Report a vulnerability? They'll assume you are an evil attacker. Glance at a pretty girl? They'll assume you're an evil pedophile. Wear camo pattern pants? They'll assume you're an evil militant revolutionary gun nut freak mass murderer waiting-to-happen."
Takeaway: The world in reality is very different than the world as it exists in your theory or ideal.
in SF/Paris/London? sure, different
in Kansas/rural/etc? see the first rule
you might be so smart that you don't know what "dumb" means. I assure you: speaking after enough decades on this planet, that "dumb" means something which includes, at a minimum, totally lacking or ignorant in what a "smart" person might include as "common sense". speaking in broad strokes. any kind of phrase of "even a dumb person surely wouldn't do X, Y, Z" should be assumed false/wrong. otherwise "dumb" means nothing. again, speaking in broadstrokes, obviously. (again: for "smart" folks it should be obvious but to "dumb" folks may not be obvious. HN readership, however imperfect they may be, is overwhelmingly weighted towards the "smart" end.)
* Suicide attempt by close relative: Police called us in the middle of the night after making sure immediate medical aid was given. They let us stay in the police night office until we could enter the hospital in the morning, gave us coffe, calmed us as much as possible. At that point the suicide attempt vs murder attempt part wasnt very clear and they could have treated us as potential murderers.
* Unexpected death of another close relative in Holland: Both Belgian and Dutch police gave every help they could, even calling back the 2 cops from a day of who had found him in very messy circumstances (which explains the day off). Lots of legal wrangling because he died in another country, but they did everything they could and more.
* Failure of a traffic light in heavy storm with zero visibility in the middle of the night. It was a temp traffic light in road works, that sank away in the mud. So basically everyone from one direction ignored the red light while seeing almost nothing. We had just avoided an accident ourselves, then witnessed another one seconds later. So we called 112. Ten minutes later, in the storm, in the night, they came and started regulating traffic until they found the guy (hours later) that could fix the light.
I hear horrible police stories from the USA, but at least in western europe the police has by default my respect.
You can't just change the tech of the cards because it needs to allow people from all over the world to use an ATM and most importantly you can't switch over ATM's and credit cards every few years that alone would cost more than what is lost to skimmers.
ATM's need to be reliable and consistent that actually makes it easier for both end users to detect skimmers and for ATM manufacturers to make them more resistant to skimmers.
Just to drive the point home ATM skimmers with the ability to read or probe the chip & pin were implemented before any chip & pin ATM's were out there it was simple enough to do in real time by just inserting an additional shim that would touch the smart card interface on your bank card.
The skimmer shown in this video is a fairly basic one there are already skimmers with NFC and Chip & Pin capabilities that read out the pin pad in real time to process a direct charge transaction while you use the ATM (they don't care about stealing your Track 1 and Track 2 data).
The ways of reading the pads vary from using cameras that are not that different from the kinect one to laying a thin touch sensor over the keypad to actually running a differential capacitive touch analysis on the metal keys as they are grounded.
A single skimmer in a tourist spot can be used to access 10,000's of accounts over a single weekend with that financial incentive the cost of the skimmer can almost be ignored.
So while the economic ROI is so high the behavior will continue, it does slow them down.
Not a complete fix by any means, but adding friction to their criminal behavior.
The labor to replace skimmers is already not an issue skimmers do not last for years, or even weeks most of them have a battery that only lasts for a few days and they are put at strategic locations usually hot spots around big venues or events.
The same holds for NFC skimmers which are now becoming more and more relevant and popular especially with the commercial availability of ultra-low-power and ultra-compact wireless SOC's.
If some one was wondering what are things like ESP8266[2] that give you WiFi connectivity with less than 1mW standby draw while being the size of a quarter are good for; if nothing less they are a pretty damn good platform for real time NFC or ICC skimming.
[0]http://sec.cs.ucl.ac.uk/users/smurdoch/papers/oakland14chipa...
Looking it up, you might mean it glows in some color?
Are you familiar with poker? We have another use of the word `flush` in that context, https://en.wikipedia.org/wiki/List_of_poker_hands#Flush where all of the cards are the same suit. So it's a similar use of flush in this instance, that everything is the same. It's similar to this thread's use of "flush".
As in, your face will go flush if you realize your credit card reader is not flush because you might have just flushed all your winnings from having a poker flush down the toilet.
To be "flush with money" is to have a lot of money---in poker, to be flush with hearts is to have 5 hearts.
http://www.oed.com/view/Entry/72182?rskey=4UKORw&result=4&is...
For example, if you take two tables of the same height, and push them together, their surfaces will be "flush".
Or, if something is embedded inside a surface, so that it sits at the same level as the surface. The slot on some optical drives is a good example of a slot that is "flush" [1].
So on an ATM a "flush" slot would be one that is just a plain slot in the flat plastic surface of the ATM, without any anti-skimming device which sticks out the front.
[1] https://www.dataquest.ch/images/uploads/newsimages/9056/usb_...
http://www.learnersdictionary.com/definition/flush
Scroll down to the 4th listing, which is the adjective version. "even or level with another surface"
So the original poster meant that he thought the card reader should just be completely even or level with the front of the machine. I guess that would just be a plain slot.
It doesn't help though, ATM skimming is just so lucrative that they can easily spend a couple of thousand dollars on a skimming device. It pays for itself after less than a day of 'deployment'.
Thats also the reason why removing a skimmer by yourself is always a _very very_ bad idea. There is a good chance that the owner of that device is very close. If its a non-wireless skimmer (like most of them are, only few have GSM or bluetooth) the criminal has to retrieve it to collect his loot. If he doesn't, he'll looses thousands of dollars. You might get stabbed for this. Better alert the authorities and let them handle it.
As somebody already mentioned, Brian Krebs has many very interesting posts about skimming technology, like this one about a similar skimming device:
http://krebsonsecurity.com/2011/12/pro-grade-3d-printer-made...
there's a blue sticker on the front of the ATM, above the PIN pad. On the woman's ATM the sticker goes up to the edge of the screen; on his ATM there's a small white/gray strip covering it. He hypothesized that's a pinhole camera to capture PINs.
Paranoid, but maybe not paranoid enough?
For online purchases, banks validate the CVV2, which is not the same as the CVV on the magstripe.
Flip the bit, write to a blank card, and make purchases.
http://krebsonsecurity.com/?s=skimmers&x=0&y=0
Check them out. Be warned, it's a black hole!
I only need the mag stripe in the US. Every terminal or ATM in Germany I ever encountered the last few years would read the chip. Only ATMs (most likely being undetected attacked by skimmer) swallow the whole card.
I don't get this industry.
On a related note: Is there something I can cover the mag stripe with that makes it unreadable, but can be removed easily if I need it?
I suppose taking a cell phone video describing your thought process and recording your interactions with the device is a good precaution to take whatever you end up doing with it.
I think they would be pretty eager to get down there and recover the device and remove the pin capturing method (camera, keypad overlay, etc).
If for whatever reason that didn't work I would probably call the police.
I'm not sure about the relative likelihood in the US vs Europe, but they certainly do exist. I've personally had my card stolen via skimmer before.
My suspicion is they're more prevalent in the US, since more merchants will accept legacy magstripe cards there.
Since nobody in my country ever used the magstripe for anything, I went ahead and disabled it, which theoretically should prevent against skimmers. It also has options to decline transactions from a location other than where your phone is, or transactions online.
Pretty interesting what you can do when your credit card has a companion app.
This is only now changing with the advent of Chip + Signature, with a tiny portion of stores now accepting it years after the deadline.
I still don't get why ATMs in the EU don't let you just dip the chip in instead of sucking in the whole card.
And it also seems like there are several physical (or software) locking designs you could use to work around the problem.
While I applaud your valor, I am grateful I clicked on this because I've only heard ATM scanner used in passing conversation -- had no idea they could be outfitted like this. Your parent comment & this comment make it seem like you got a chip on your shoulder.
This would absolutely not qualify as evidence tampering in most jurisdictions.
1. I would be very suspicious of anyone approaching me at at ATM, especially at a major tourist area. There's no reason to bother someone
2. There's a chance she's in on it! She may have come up there because she saw someone fiddling with the skimmer.
He should have either called the Bank or the Police. Don't bother strangers.