[HN Gopher] Target's EasySweep - Simplifying Skimmer Detection
       ___________________________________________________________________
        
       Target's EasySweep - Simplifying Skimmer Detection
        
       Author : ericras
       Score  : 130 points
       Date   : 2023-07-19 16:16 UTC (6 hours ago)
        
 (HTM) web link (tech.target.com)
 (TXT) w3m dump (tech.target.com)
        
       | nvaofdv3332 wrote:
       | [flagged]
        
       | [deleted]
        
       | noodlesUK wrote:
       | How do these skimmers work with chip&pin? I understand how
       | magstripe skimmers work, but my understanding is that chip&pin is
       | an active challenge response protocol. I'd love to hear more.
        
         | js2 wrote:
         | Even with EMV transactions, they are apparently able to get the
         | card # which is transmitted in clear text by the chip. And the
         | PIN from the keyboard overlay for debit transactions. Later
         | they can clone the card # onto a fake mag stripe card and use
         | the fake card for card-present purchases.
         | 
         | They probably cannot make card-not-present (online) purchases
         | since I don't think they can get the CVV.
         | 
         | https://krebsonsecurity.com/2021/02/checkout-skimmers-powere...
         | 
         | https://security.stackexchange.com/questions/151081/shimmers...
         | 
         | > In addition to the track-two data on the magnetic stripe, EMV
         | cards generally have identical data encoded on the chip, which
         | is read as part of the normal EMV transaction process. If an
         | EMV reader is compromised to the extent that the conversation
         | between the card and the terminal is intercepted, then the
         | attacker may be able to recover both the track-two data and the
         | PIN, allowing construction of a magnetic stripe card, which,
         | while not usable in a Chip and PIN terminal, can be used, for
         | example, in terminal devices that permit fallback to magstripe
         | processing for foreign customers without chip cards, and
         | defective cards.
         | 
         | https://en.wikipedia.org/wiki/EMV#Opportunities_to_harvest_P...
        
           | e28eta wrote:
           | They might not need CVV, if the transaction looks "good"
           | otherwise:
           | 
           | > A payment can still be successful even if the CVC or postal
           | code check fails. This is because card issuers take many
           | signals into account when making a decision about whether to
           | approve or decline a payment. In some cases, a card issuer
           | may still approve a payment they consider legitimate, even if
           | the CVC or postal code verification check fails.
           | 
           | source: https://stripe.com/docs/radar/rules#built-in-rules
        
             | js2 wrote:
             | :-(
             | 
             | I recently went through the opposite of this. A purchase at
             | denon.com was declined, got a "please verify" email from my
             | issuer which I approved and re-did the purchase. My issuer
             | authorized the payment the second time, but then it got
             | held up by NoFraud who sent me their own "please verify"
             | email which I did. I had used an iCloud Hide My Email
             | address for the purchase so a day later I get another email
             | from NoFraud:
             | 
             | > Thank you for confirming your recent order. We are the
             | fraud solution for the merchants website. We flagged the
             | order for additional review before we notify the merchant
             | to process it. To complete the verification for approval,
             | we require an alternate email address for the cardholder.
             | Please respond with an alternate email address.
             | 
             | At that point I tracked down NoFraud's phone # and called
             | them to finally get the transaction approved.
        
               | techsupporter wrote:
               | > I had used an iCloud Hide My Email address for the
               | purchase so a day later I get another email from NoFraud
               | 
               | I got hit by a merchant using "NoFraud" as well. After
               | making an order from the merchant's site, using Apple Pay
               | on the web (which is, allegedly, rather hard to fake), I
               | received an email saying my order was canceled as it
               | "appears that a merchant-specific email address was used"
               | and to "please resubmit the order using your personal
               | contact details".
               | 
               | They were right, because I always use
               | [merchantname]@subdomain.mydomain.com. Whatever it was
               | couldn't have been that important because I didn't bother
               | redoing it if they're going to be that picky.
               | 
               | (I can't find the purchase confirmation and subsequent
               | email in my email, probably because I deleted it out of
               | annoyance, so I'm not naming who I think I remember it
               | being just in case I'm wrong)
        
           | MBCook wrote:
           | EMV doesn't transmit the full card number in the clear. I
           | don't know how they'd get it. IIRC the track data is
           | sanitized, but maybe it wasn't always. I'm not even sure all
           | cards give it in a modern EMV transaction.
           | 
           | The old mag stripe emulation mode of contactless did, but
           | that's legacy and many places won't accept it and cards won't
           | do it.
           | 
           | However the good old "break the slot or chip reader so they
           | have to use mag stripe and scan the card things the old
           | fashioned way" technique still works great.
        
             | js2 wrote:
             | Googling "EMV sniffer" returns a bunch of sketchy sites
             | that claim they get the card number from the chip, not the
             | mag stripe. That's also what seems to be implied by the
             | submitted link. Here's another post claiming the card # is
             | readable from the chip:
             | 
             | https://security.stackexchange.com/questions/161493/what-
             | inf...
        
           | whoopdedo wrote:
           | Some skimmers have a camera to capture an image of the card's
           | CVV as well as another copy of the name/number/date.
        
             | Terr_ wrote:
             | Here I was thinking that my near-illegibly worn-away CVV
             | was a reason to get a replacement card... but instead it's
             | a surprise security bonus! :p
             | 
             | Actually, I spoke too soon... the signature-strip has been
             | worn away too and now that I really look at it, I can make
             | out the word "Void" underneath.
        
         | CharlesW wrote:
         | > _How do these skimmers work with chip &pin?_
         | 
         | My understanding is: They don't. If you stick to contactless
         | payments, you're not at risk.
        
           | noodlesUK wrote:
           | The image shows the skimmer gadget sitting on top of the pin
           | pad and the bottom card insertion slot (the one that takes a
           | chip). On these card readers the magstripe reader is on the
           | right hand side iirc. I'm wondering what you can do having
           | connected to the EMV contacts and recorded the PIN. I suppose
           | you could make a transaction, but it would have to presumably
           | happen at the same time as the legit transaction (which would
           | then immediately get flagged as fraudulent)
        
             | throwaway42968 wrote:
             | Not much. The chip doesn't transmit any credit card
             | numbers. What's really happening in an EMV transaction is
             | the amount due is transmitted along with some identifying
             | information from the host to the card reader. The reader
             | then authenticates with the chip card using asymmetric
             | cryptography. Once this authentication is done, the reader
             | sends an amount due and the chip card checks its
             | authorization rules, and responds with some encrypted data
             | that represents the transaction amount and that depends on
             | a private key embedded in the card. You could replay the
             | transaction at the exact same time as it is happening, but
             | you'd have to use the same amount due. And there are other
             | identifiers for EG the terminal that you'd have to know. If
             | you're curious, EMVco makes the specification available
             | online in documents titled Book 1, Book 2, Book 3, and so
             | on: https://www.emvco.com/specifications/
        
           | chiph wrote:
           | You'll want an RFID blocking wallet or sleeve to supplement
           | this plan. Thieves will use an RFID skimmer and just wave it
           | near your pocket to grab the info off the card when it
           | responds.
        
             | MBCook wrote:
             | Has anyone ever shown a practical attack for EMV
             | contactless?
             | 
             | I know the old mag stripe emulation was vulnerable, but EMV
             | contactless shouldn't hand out the card number and uses
             | cryptographic signatures. You'd have to capture and play
             | back a transaction (not randomly scan a card) and there are
             | time stamps and transaction counters that would be wrong
             | and the terminal ID wouldn't match.
        
         | kotaKat wrote:
         | The US still has a _heavy_ reliance on magstripe, even though
         | we rolled out EMV, and many cards still have it, and you can
         | just take a stripe dump regardless.
         | 
         | The actual user of the stolen card dump will cause the terminal
         | to allow a magstripe fallback (typically with a bad chip on a
         | fake card that won't read) -- "aw jeez my stupid chip isn't
         | reading" is still every much a valid excuse to a cashier to go
         | to magstripe.
        
           | loeg wrote:
           | I think there are also just lots of POS systems in the US
           | that aren't on EMV yet. Major retailers are on EMV but random
           | old rural businesses probably aren't.
        
             | MBCook wrote:
             | Plus lots of cards without EMV at all, usually gift cards
             | or until recently EBT.
        
             | reaperducer wrote:
             | Some big chains still haven't switched.
             | 
             | I was in a major home improvement store a few weeks ago,
             | and it was swipe-only. Either Home Depot or Lowe's.
        
               | lowmagnet wrote:
               | wal-mart has emv, but no radio-based payment
        
               | gorkish wrote:
               | Lowe's. Lord help the poor souls who maintain that
               | system; it looks like the kind of thing that's just chock
               | full of COBOL.
        
           | macNchz wrote:
           | Makes me think about intentionally corrupting the magstripe
           | on my cards. I wonder if that'd cause any issues.
           | 
           | I can't remember having to fall back from the chip to a swipe
           | in ages, and I have a couple of cards, so I could keep one as
           | a backup with a working stripe just in case (long ago I found
           | myself far from home and low on gas, with no cash, a dead
           | cell phone and a "suspicious transaction" blocked credit
           | card, and I'd rather not repeat that experience).
        
             | throwaway42968 wrote:
             | It's only an issue with EMV Fallback, which you'd probably
             | not need if you have a backup card that is good. Basically
             | if the chip or near-field antenna on your card fail, the
             | fallback is to collect a magnetic stripe read. Properly-
             | configured readers don't need the stripe read to complete a
             | transaction.
        
               | gorkish wrote:
               | Properly configured merchants don't even need the payment
               | terminal to complete a transaction. They should be able
               | to key the card number if all else fails. I say corrupt
               | your magstrip if it makes you feel better.
        
       | mkmk wrote:
       | "with inspections being done daily in all our store locations."
       | 
       | impressive.
        
       | adrianmonk wrote:
       | Could payment terminals be made with built-in physical
       | countermeasures for detection? Ideas:
       | 
       | (1) Terminal has a scale built into its feet/mount. It
       | periodically weighs itself, and if (ignoring fluctuations) it
       | weighs too much, it shuts down. It's hard to build a skimmer that
       | weighs 0 grams.
       | 
       | (2) Proximity sensors in key locations on the housing. My
       | smartphone can disable its touchscreen when I hold it against my
       | face, so a payment terminal should be able to detect when
       | something is covering a part that isn't supposed to be covered.
       | 
       | (3) Light sensors. Put some in an area where skimmers need to
       | cover (near card slot) and other where skimmers probably can't
       | cover (the display), and detect whether they get roughly the same
       | amount of light.
       | 
       | (4) Microphones. Same idea as light sensors but with sound.
        
         | crote wrote:
         | Skimming is pretty much a solved problem in Europe already. We
         | got rid of the mag stripe, so trivially cloning a card is no
         | longer possible. Furthermore we don't allow offline
         | transactions, so a skimmer must somehow get in between the
         | connection from the terminal to the card and execute a separate
         | transaction right before or after the genuine one.
         | 
         | It is still not 100% impossible, but the "overlay" type of
         | skimmer this protects against has been eliminated for a few
         | years now.
        
           | sangnoir wrote:
           | You are correct: but I think all these measures are in place
           | because liability is placed on financial institutions rather
           | than individual victims. The owners of the payment
           | infrastructure are correctly motivated to holistically solve
           | the problem, unlike in the US were the person woth the least
           | power and control is burdened with having to contend with
           | "Identity theft" and losing money by default to make up for
           | the fraud.
        
         | gorkish wrote:
         | Alternatively they could just remove the slot and require self-
         | pay terminals to be contactless. It really makes no sense to me
         | why merchants don't already do this proactively; they are well
         | incentivized:
         | 
         | 1) Contactless merchant fees are lower than dip or swipe 2)
         | Payment terminals are cheaper 3) Less fraud/shrink
         | 
         | This hunk of plastic from Target is a solution looking for a
         | problem.
        
           | MBCook wrote:
           | They're not looking for a problem. The problem exists.
           | 
           | "Just use contactless" doesn't work in the US.
           | 
           | Just yesterday a friend was commenting that he got a new
           | credit card (old card expired) and the new one still doesn't
           | have contactless. Seems his bank decided it wasn't worth it.
           | 
           | But that's not all. Target gift cards don't have contactless.
           | Don't think Visa/MC/AmEx gift cards do either. I bet EBT
           | cards don't, I think a rule requiring them to have chips was
           | just passed.
           | 
           | I know other countries are ahead of us, and that major banks
           | have been issuing chip cards for a while. But there are still
           | a lot of people that leaves out.
           | 
           | And target wants to sell to them.
        
             | gorkish wrote:
             | I was suggesting "Just use contactless" for customer
             | accessible payment terminals. Want to use something less
             | secure and more likely to result in fraud? You can hand
             | your card to the cashier or walk inside instead of paying
             | at the pump, just like you do with any non-card payment
             | already.
             | 
             | The EBT, gift card, and lazy small banks would get their
             | act together pretty damn quick, I'd wager.
        
               | MBCook wrote:
               | "Sorry. I know you're on assistance because you can't
               | afford food, but for your security we're not going to let
               | you buy food with your government benefits as you may
               | become a scam victim.
               | 
               | Come back when your state government decides to pay to
               | re-issue every card with better technology."
               | 
               | That's cruel. The move to EMV was only recently mandated
               | for EBT (if I remember correctly and it was done at all)
               | because so many people were having their benefits stolen
               | by mag stripe skimmers.
               | 
               | You can't use a stick against powerless people to affect
               | change. It just makes them suffer.
               | 
               | Even if Target did mandate contactless, the stock would
               | plummet on news of all the lost sales and the CEO would
               | be out. The new one would reverse it immediately.
        
               | gorkish wrote:
               | Where did I suggest this? The customer payment terminal
               | is not the register. Both have card readers; one is
               | fantastically less likely to be tampered with than the
               | other. There is absolutely nothing wrong with putting
               | your cashier in between the customer and a potentially
               | fraudulent payment. What happens when that person gets
               | their EBT account drained by a criminal because of a
               | skimmer? I'm not trying to marginalize anyone; get real.
        
               | pertymcpert wrote:
               | [flagged]
        
           | strictnein wrote:
           | > This hunk of plastic from Target is a solution looking for
           | a problem
           | 
           | When you're dealing with tens of thousands of terminals that
           | you want to check on a regular basis across thousands of
           | stores, having a device that verifies things quickly is a
           | solution to a real problem.
        
           | crote wrote:
           | Ironically, contactless has been the source of new types of
           | skimmer attacks. A skimmer could just add an nfc coil and
           | wouldn't even need to physically touch the card anymore.
        
         | briffle wrote:
         | Of course they can be made that way. The countermeasure built
         | into gambling equipment like slot machines is incredible.
         | 
         | But then it would cost more than their competitors. With much
         | more maintenance for false positives, etc. And the vendor
         | doesn't really pay the price for skimmer fraud..
        
           | LorenPechtel wrote:
           | If someone comes up with an anti-skimmer terminal the payment
           | processors would benefit from having a lower transaction fee
           | for transactions posted from such a terminal. That would in
           | time push the market to use such terminals.
        
       | dangerboysteve wrote:
       | Did I read this wrong? They are using the card chip slot to house
       | the skimmer protection, so chip and pin will not work ?
        
         | HWR_14 wrote:
         | You read it wrong. It's not permanently attached. They stick a
         | very precise 3D object in the chip slot, and if it doesn't fit,
         | that means the slot isn't the exact same as how the reader was
         | made from the manufacturer. So you get a cashier to do that at
         | the start of their shift, and if anything is detected they call
         | out a more trained repair man/security professional to figure
         | out if there is a skimmer.
        
           | NoMoreNicksLeft wrote:
           | So the skimmer asshole pays some Target employee $100 to
           | replace the very precise 3d object with one that hides the
           | skimmer when no one's looking?
           | 
           | I need a solution that lets me, the card holder, check these.
           | This ain't it.
           | 
           | Hell, some of the internal skimmers just solder jumper wires
           | to pcb pins/testpoints don't they? There's nothing mechanical
           | for a card to touch. Target's got so many telescreen cameras
           | in the store, they could likely get the pin numbers straight
           | from that, no need to intercept that.
        
             | HWR_14 wrote:
             | > So the skimmer asshole pays some Target employee $100 to
             | replace the very precise 3d object with one that hides the
             | skimmer when no one's looking?
             | 
             | They replace the objects every 6 months. And there are
             | multiples. So, yeah, I guess it's doable.
             | 
             | > I need a solution that lets me, the card holder, check
             | these.
             | 
             | You could just print one and carry it with you.
             | 
             | > some of the internal skimmers just solder jumper wires to
             | pcb pins/testpoints don't they?
             | 
             | At the point, there's no real security. If that's your
             | threat model, you can just substitute the entire reader for
             | a counterfeit one.
             | 
             | > Target's got so many telescreen cameras in the store,
             | they could likely get the pin numbers straight from that
             | 
             | If you are as paranoid as you sound, you should be covering
             | your hand putting the PIN in with your other hand.
             | 
             | You seem to not understand the threat threat models. A
             | skimmer is a 3 second attack that requires no accomplice
             | and can be done with slight of hand while people are
             | watching. Making that scale to a multi-person operation
             | with more physical construction, the need to swap out (and
             | hide) a bunch of red plastic going in and out is a win. In
             | much the same way that locking your jewelry in a small safe
             | isn't going to stop determined thieves, but will make
             | casual thieves abandon it.
        
               | NoMoreNicksLeft wrote:
               | > You seem to not understand the threat threat models. A
               | skimmer is a 3 second attack that requires no accomplice
               | and can be done with slight of hand while people are
               | watching. Making that scale to a multi-person operation
               | with more physical construction, the need to swap out
               | (and hide) a bunch of red plastic going in and out is a
               | win. In much the same way that locking your jewelry in a
               | small safe isn't going to stop determined thieves, but
               | will make casual thieves abandon it.
               | 
               | I'm just repeating what I've read elsewhere, seen
               | elsewhere.
               | 
               | The gas pump skimmers are completely internal. None of
               | that bullshit where their plastic fits over the top of
               | the other snugly. They wire just 4 or 5 leads to the
               | pcb... vcc and gnd, obviously... so the rest of it must
               | be 12c or some other serial/2wire protocol I guess.
               | 
               | Someone was saying "well at least they can't get the
               | cvc", but that got me to wondering with cameras so small
               | and cheap, could you hide one where it could see that on
               | the underside? At least on my cards, it's on the same end
               | as the chip itself, so maybe?
               | 
               | How many cards can they skim, before it's detected, and
               | what's the average value of skimming one card? If you
               | multiply those two together, and the answer is in the
               | tens of thousands or hundreds of thousands (or god help
               | us, millions), then it's very much worth it to be a
               | multi-person operation. Especially since such an
               | operation will have more than one card-skimmer going...
               | how many can a small team manage reliably? I guess it's
               | really `a x b x c =` here.
               | 
               | Does Target have free in-store wifi? If so and they pre-
               | configure, they never have to show up on-site again.
               | Fuck, can they get someone hired on for 3 days to do all
               | this, and switch out the skimmer detection tools? Then
               | they just no-show, no-call, and move on to the next.
               | 
               | > If you are as paranoid as you sound, you should be
               | covering your hand putting the PIN in with your other
               | hand.
               | 
               | Have been for the last 20 years. Some woman in a gas
               | station in Virginia once got pissy at me for doing it
               | "it's just you and me in here!"... "Lady, you have a
               | surveillance camera pointed right at me, I can see myself
               | on the monitor behind you".
        
             | clintonb wrote:
             | The solution for cardholders is to use tap-to-pay.
             | 
             | Frankly, as a _credit_ cardholder with zero liability, I'm
             | not overly-concerned by skimmers. I won't lose anything.
             | The card tax is already baked into all prices, so there's
             | no real benefit for me to solve this problem.
        
             | duskwuff wrote:
             | > Hell, some of the internal skimmers just solder jumper
             | wires to pcb pins/testpoints don't they?
             | 
             | No. Most modern card terminals are tamper-resistant and
             | will erase key material if opened.
             | 
             | (Besides, it's not like you're going to be able to casually
             | crack open a payment terminal, pull out a soldering iron,
             | and modify it while you're standing in the store checkout
             | line.)
        
               | delfinom wrote:
               | Payment terminals inside a retail store do have that
               | tamper magic.
               | 
               | Gas pumps are a little quirkier because they use
               | integration modules, I would imagine they got better with
               | newer ones but earlier ones, even with chips, would
               | basically just be an exposed pcb on the inside
        
             | gorkish wrote:
             | > I need a solution that lets me, the card holder, check
             | these. This ain't it.
             | 
             | No you don't. All you need to do is use a payment method
             | that is actually secure. Demand it. When they tell you tap
             | doesnt work, ask why. Hand your card to the cashier and
             | make them scan it on the register's reader.
        
         | AYoung010 wrote:
         | Yes, you did I'm afraid -- this is a tool which is used to
         | check for skimmers, not a preventative measure which is
         | permanently installed. It only blocks the chip slot when an
         | employee is ensuring a skimmer isn't installed on a particular
         | terminal.
        
         | jaywalk wrote:
         | The device is for detection. The employees just insert it into
         | the slot once per day and check to make sure it goes in fully.
         | Then it's immediately removed.
        
         | mrguyorama wrote:
         | It's not "protection" but a testing tool. If the tool fits as
         | expected then there probably isn't a skimmer. Then you remove
         | the tool
        
         | [deleted]
        
       | starkparker wrote:
       | Why not publicly distribute the design? Because skimmer-makers
       | might adapt? It seems trivial to acquire one (getting a job at
       | Target or spoofing a corp email account isn't a high barrier).
        
         | groby_b wrote:
         | It is, however, added friction, and that's 90% of the security
         | game. Every additional layer helps. (And a corp email account
         | adds a paper trail, at the very least)
        
           | dawnerd wrote:
           | They also patented it so I imagine that's part of their
           | reasoning.
        
         | jerf wrote:
         | I would expect that the corporations will be asked to sign an
         | indemnity agreement before they get the design. Target doesn't
         | want to be held liable in case a skimmer is built that defeats
         | this detection and the recipient needs to understand there are
         | no guarantees.
         | 
         | It's nice that someone got this through the default corporate
         | deny policies.
        
           | samtho wrote:
           | It's sad that this is likely the case. In general, an "As
           | is/no warranty" shrinkwrap contract should be sufficient for
           | legal protection but won't prevent people from filing
           | nuisance lawsuits, which I suspect they wish to avoid
           | altogether.
        
         | kyleyeats wrote:
         | That's what the OP is.
         | 
         | > Based on the success we saw with EasySweep, we decided to
         | offer the design, for free, to other retailers.
        
           | loeg wrote:
           | You still have to request access from Target. GP is asking
           | for it to just be published online somewhere.
        
             | gorkish wrote:
             | It's right here:
             | https://patents.google.com/patent/US11507762B2/ Took me
             | five seconds. You can make one if you feel like it.
        
               | loeg wrote:
               | That is not the "Step CAD file" available to retailers
               | who contact Target and this thread is asking to be
               | published.
        
             | kyleyeats wrote:
             | Ah good point. Target's one of the most serious companies
             | in the world about this, with a forensics lab and
             | everything. I'm surprised they're doing this much, even if
             | the skimmers obviously have access to the same
             | measurements.
        
       | hiatus wrote:
       | Sparkfun put out an app to help detect skimmers primarily on gas
       | pumps [1], though it no longer appears to be available on the
       | google play store.
       | 
       | [1]: https://github.com/sparkfunX/Skimmer_Scanner
        
         | whartung wrote:
         | It annoys me that none of the gas stations I use have the "tap
         | to pay" that actually works.
         | 
         | They seem to have the sensor on the pumps, but they never work.
        
           | selykg wrote:
           | My preferred gas station got tap to pay during the pandemic
           | and I make it a clear effort to use it every time I get gas
           | to try to bump the numbers up so it doesn't go away or gets
           | fixed if it breaks. Such a great feature.
        
             | LorenPechtel wrote:
             | Preferred gas station here did something to the UI--you can
             | "pay" by waving your phone at it, but then it will prompt
             | for your zip code. When you enter the zip code there's a
             | couple of prompts about ensuring you know you're paying
             | credit price--oops, entering the zip code also answers no
             | to the first question.
        
           | callalex wrote:
           | My pet theory is that transitioning to wireless payment also
           | opens up user expectations for the vendor to participate in
           | way more payment networks than just Visa/MC/Discover/AmEx. If
           | you have a wireless reader but no agreement with Apple Pay,
           | or Google Pay, or Samsung Pay, or WePay, or
           | WhateverSomeNewMBACrap users will start putting in reports
           | that the reader is "broken".
        
             | hackmiester wrote:
             | You don't have to have an agreement with Apple or Google to
             | accept Apple Pay or Google Pay. If the customer holds a
             | Visa then the phone presents a Visa to the reader. There is
             | no special thing you have to do to accept those payments.
        
             | yakkers wrote:
             | I'll absolutely admit knowing very little about the nuances
             | of payment networks in the US, particularly with
             | contactless --- but my experience (in Australia) is that
             | payment terminals that support contactless inherently
             | support Apple/Google/etc Pay, even if the payment terminal
             | is unaware of those things, in which case the transaction
             | will work the same as a contactless card transaction (e.g.
             | transactions >$100 require PIN).
        
           | axus wrote:
           | I wonder why. I had the same problem and assumed they'd just
           | bought some premature technology and never upgraded since.
        
       | exabrial wrote:
       | We wouldn't even need to worry about this dumb stuff if we had
       | actual cryptographic PKI for payments. Honestly at some point
       | fraud is 100% the card issuer's fault when the tech to prevent it
       | is here and now.
       | 
       | Why I still can't register a public key with my bank and say "do
       | not under any circumstance honor a transaction unless it's signed
       | with my private key" is beyond me.
        
         | throwaway42968 wrote:
         | What you are describing is essentially EMV, except that your
         | bank has gone to the trouble of picking your private key and
         | embedding it in a card you carry around and insert into payment
         | terminals.
        
         | thelastparadise wrote:
         | > Why I still can't register a public key with my bank and say
         | "do not under any circumstance honor a transaction unless it's
         | signed with my private key" is beyond me.
         | 
         | What you are describing is Bitcoin.
        
           | callalex wrote:
           | No, a bitcoin wallet is not a bank.
        
         | crote wrote:
         | That's EMV, and it is still not 100% foolproof because the card
         | itself doesn't have a display and Allow/Deny button.
        
           | Nextgrid wrote:
           | > still not 100% foolproof because the card itself doesn't
           | have a display and Allow/Deny button.
           | 
           | I'm assuming you are thinking about an attack where a
           | compromised terminal processes an attacker-issued transaction
           | (relayed from elsewhere) instead of the genuine one.
           | 
           | It seems like a solution to this would be for the card to
           | issue a challenge to the reader and only provide a very short
           | timeframe to answer, so that relaying it elsewhere is
           | impossible due to speed of light and all that.
        
       | al2o3cr wrote:
       | it allows any Target team member to easily         sweep a store
       | for skimmers
       | 
       | I'm unclear on how this is supposed to help - unless the skimmers
       | are being installed by frickin ninjas it seems like they already
       | needed insider cooperation.
        
         | bastardoperator wrote:
         | If the target employee cannot see the skimmer detection tool,
         | the terminal has been compromised. Most skimmers fit on top of
         | the terminal which would obstruct sight of this tool/layer.
         | There are videos online of these skimmers being "installed" and
         | it takes about 1 to 2 seconds of work and it seems anyone can
         | do it.
        
           | mrguyorama wrote:
           | This tool is not permanently installed. It is a daily check
           | for skimmers
        
         | snapplebobapple wrote:
         | If you make sure who is doing the skimming rotates so that
         | there is a constant stream of new people checking it would be
         | really hard to stop detection in a timely manner. It's also
         | insanely fast to install a skimmer (like 2 seconds fast) so you
         | don't necessarily need insider help. Until wireless skimmers
         | with a decent range become available this tool could bring
         | skimming down to effectively zero (and reduce it to just the
         | customer who rang through the till before it was discovered
         | when they are available). It's a pretty epic addition to the
         | retail security landscape
        
         | asadm wrote:
         | Skimmer can be installed in seconds, just glued-on when the
         | skimmer-guy is at the check-out.
        
           | ceejayoz wrote:
           | Yup. Three seconds: https://www.youtube.com/watch?v=5b1axnNK-
           | wI
           | 
           | A second guy distracting the clerk helps, too.
        
         | devrand wrote:
         | I feel like this would be particularly easy at self checkout
         | stations where there's usually like 1 employee handling a dozen
         | or so stations. You can also get someone else to go
         | "accidently" scan a pack of gum twice and hit the help button
         | to have said employee come over and fix it. That would provide
         | more than enough of a distraction to quickly place a skimmer on
         | a different station.
        
         | tennisflyi wrote:
         | It's the former more or less - https://youtu.be/Sljmr8m88P8.
         | They could do it on a lane that isn't open (read no attention)
         | just before a rush hour and hope it gets chosen.
        
       | adolph wrote:
       | This is an interesting and simple physical measurement device to
       | determine if the credit card slot is in a different orientation
       | than expected. It uses the keypad as a reference location.
       | 
       | I think the most obvious circumvention would be for the criminal
       | enterprise to focus on altering the length of the verification
       | devices, since an EasySweep does not appear to have a formal
       | method to verify its own correctness. A shortened card tab on
       | EasySweep would provide feedback that the terminal was ok since
       | the keypad finger support presses against the terminal.
        
       | gumby wrote:
       | This is quite clever.
        
       | bredren wrote:
       | It seems like this is the kind of thing Verifone aught to design,
       | maintain and distribute.
        
         | kotaKat wrote:
         | Believe it or not, Verifone part KIT177-005-01-A is, in fact, a
         | "Skimming Device Detection Tool".
         | 
         | https://www.geminicomputersinc.com/kit177-005-01-a.html
        
           | delfinom wrote:
           | I would imagine there's something wrong with it if Target
           | isn't just buying it
           | 
           | Though it could just be cost given that Target could just pay
           | for a plastic injection mold overseas and then pay peanuts
           | yearly to make a 60k batch for their yearly renewal they
           | mention, compared to $20*60k each time
        
             | loeg wrote:
             | Yeah. $8-24 a unit vs "under $1." Although 60,000 x 8 still
             | isn't a huge amount of money.
        
               | gorkish wrote:
               | This little micro-arms-race to develop and patent a
               | plastic wedge that doesn't need to exist in the first
               | place is ridiculous. The irony is that there is something
               | of a perverse incentive not to solve the actual problem
               | now that such a big industry has emerged to to combat it.
               | If they wanted to build secure card payment terminals
               | they would build them.
        
       | Terr_ wrote:
       | All this shape-based stuff makes me think of antigen/antibody
       | immune-system analogies.
       | 
       | The skimmer binds to the payment slot, some payment slots change
       | shape to prevent skimmer binding, and now the tester-block binds
       | to check that nothing is already bound...
        
       | thetwentyone wrote:
       | Since it's only implied how it works and there seems to be some
       | confusion in the comments. It seems like the technique is to
       | simply create a very form-fitting insert which won't fit properly
       | if some device is overlaid onto the machine. The insert is not
       | left in the device, but is just used for a quick in-and-out
       | check.
        
         | Dah00n wrote:
         | And it is patented..
        
           | dotBen wrote:
           | This is a good thing, some troll could patent it and then
           | deny anyone else the right to use it.
        
           | KennyBlanken wrote:
           | It's literally just a box-shaped piece of plastic with
           | specific dimensions, attached to a handle. That's it.
           | 
           | Good job, Terry Woodman. You 'invented' something that has
           | been used for probably centuries to QA things around the
           | world, a pass/fail check if calibrated test objects fit or
           | don't fit.
           | 
           | It's amazing how thirsty they apparently are for PR, for sort
           | of good public deed or something...and how they have gone out
           | of their way to be as hostile as possible to others
           | benefiting from it. patenting something which never should
           | have been patentable, and only distributing the files to
           | other retailers, because I guess otherwise the Criminal
           | Element would figure out some way to get around it.
        
             | runjake wrote:
             | > It's literally just a box-shaped piece of plastic with
             | specific dimensions, attached to a handle. That's it.
             | 
             | That could be said about a very large number of useful
             | products. It doesn't lessen their utility.
             | 
             | https://news.ycombinator.com/newsguidelines.html#comments
        
             | [deleted]
        
           | gorkish wrote:
           | Sure is. Good thing criminals are too dumb to find it, and
           | especially too dumb to replicate it. I'm sure they will never
           | be able to modify their skimmers to circumvent it. They will
           | rue the day they messed with Target's IP lawyers!!!
           | https://patents.google.com/patent/US11507762B2/
        
           | loeg wrote:
           | But also, freely licensed.
        
             | crote wrote:
             | Only for large retailers, though. Why not directly offer
             | the CAD file for download right on that page, or make the
             | resulting product available for purchase?
        
               | monkeymeister wrote:
               | Likely to avoid defeat attempts. The corporate email
               | requirement acts as a first-line defense to at least try
               | to stave-off would be skimmers / scammers grabbing the
               | CAD file and working out the measurements needed to
               | defeat it.
        
               | kalupa wrote:
               | ah, nothing like security through obscurity!
        
         | cdchn wrote:
         | Basically a Go/No-Go gauge for a payment terminal.
        
       ___________________________________________________________________
       (page generated 2023-07-19 23:02 UTC)