Hacker News Reader

Comment by Pfhreak | Hacker News Reader

> The Skimmer Scanner is a free, open source app that detects common bluetooth based credit card skimmers predominantly found in gas pumps. The app scans for available bluetooth connections looking for a device with title HC-05. If found, the app will attempt to connect using the default password of 1234. Once connected, the letter ‘P’ will be sent. If a response of ’M' then there is a very high likelihood there is a skimmer in the bluetooth range of your phone (5 to 15 feet).

Why isn't this just a part of the gas pump itself? (Or the payment station or whatever.) Is there a market for someone to make skimmer detector addons for gas stations? (If not, why not?)

View on HN

If you read it, the scanner software they wrote is pretty specific to this exact skimmer. It looks for the default id of those Bluetooth modules and then sends a couple commands to see if it gets a particular response.

In other words, the scanner isn't really general purpose enough to have in every pump and it's easily defeated by very minor firmware tweaks or even just changing the Bluetooth id of the device. You'd have to have something much more complex to be reliable, and it'd have to have some sort of facility for updating it's signature database akin to a virus scanner. Gas station owners don't have much incentive to give a damn currently, especially not if it involves retrofitting a fairly complex device onto all of their pumps that they also have to pay for a service that provides updated device signatures.

Do gas stations have any incentive to provide skimmer scanning? I'd imagine most of their customers aren't even aware skimmers exist, so adding them probably wouldn't attract many new customers. And the margins they make selling gasoline are already pretty thin, so it's possible that the cost of adding scanners to all their machines is less than the extra money they'd make from the minority of people that would go out of their way to give their business to gas stations with scanners.

If gas stations are liable for losses that customers experience due to skimmers it's possible that gas stations would be interested, but they could just as easily decide that it's worth the risk of having to pay out lawsuits given that I'd imagine it's pretty hard to prove in court that your card was stolen by a skimmer at any one particular gas station considering how many different gas stations any one person uses on a regular basis, not to mention the variety of other vectors that your card could've been compromised through.

> Is there a market for someone to make skimmer detector addons for gas stations? (If not, why not?)

It would probably be best sold as a service instead of a device. It's not easy to train staff to operate equipment like this. Also, it's likely to engage a cat-and-mouse escalation which either means a headache-fueled field-updatable device (more complexities for gas station staff) or rapidly-obsolete devices.

But the service might be a hard sell -- the service would have to be more effective than manual pump kiosk inspections. Best to try and sell to an established brand that operates the stations themselves (are there any or are they all franchisees?) 7-11 operates gas stations in urban markets likely to be targeted, they might be a good client.

It would be easier to have a central device that could listen for any bluetooth signals that linger around the gas station all day long. Most people are gone within 5-10mins so it should be pretty obvious when there is a bluetooth device there for hours at a time that isn't a known device of someone that works there. But this would only be able to detect simple devices like these. Something a bit more advanced would stay in a listen only mode until the skimmer's owner came within range and would generate a random MAC addresses on bootup to evade pattern detection.

I imagine that gas pumps are much more costly to retrofit or replace. If such detection capability was built-in, it's much easier for the skimmers to adopt a different format to avoid detection by naive gas station operators who want something they can set-it-and-forget-it.

Reply on news.ycombinator.com