[HN Gopher] Target's EasySweep - Simplifying Skimmer Detection
___________________________________________________________________
Target's EasySweep - Simplifying Skimmer Detection
Author : ericras
Score : 130 points
Date : 2023-07-19 16:16 UTC (6 hours ago)
(HTM) web link (tech.target.com)
(TXT) w3m dump (tech.target.com)
| nvaofdv3332 wrote:
| [flagged]
| [deleted]
| noodlesUK wrote:
| How do these skimmers work with chip&pin? I understand how
| magstripe skimmers work, but my understanding is that chip&pin is
| an active challenge response protocol. I'd love to hear more.
| js2 wrote:
| Even with EMV transactions, they are apparently able to get the
| card # which is transmitted in clear text by the chip. And the
| PIN from the keyboard overlay for debit transactions. Later
| they can clone the card # onto a fake mag stripe card and use
| the fake card for card-present purchases.
|
| They probably cannot make card-not-present (online) purchases
| since I don't think they can get the CVV.
|
| https://krebsonsecurity.com/2021/02/checkout-skimmers-powere...
|
| https://security.stackexchange.com/questions/151081/shimmers...
|
| > In addition to the track-two data on the magnetic stripe, EMV
| cards generally have identical data encoded on the chip, which
| is read as part of the normal EMV transaction process. If an
| EMV reader is compromised to the extent that the conversation
| between the card and the terminal is intercepted, then the
| attacker may be able to recover both the track-two data and the
| PIN, allowing construction of a magnetic stripe card, which,
| while not usable in a Chip and PIN terminal, can be used, for
| example, in terminal devices that permit fallback to magstripe
| processing for foreign customers without chip cards, and
| defective cards.
|
| https://en.wikipedia.org/wiki/EMV#Opportunities_to_harvest_P...
| e28eta wrote:
| They might not need CVV, if the transaction looks "good"
| otherwise:
|
| > A payment can still be successful even if the CVC or postal
| code check fails. This is because card issuers take many
| signals into account when making a decision about whether to
| approve or decline a payment. In some cases, a card issuer
| may still approve a payment they consider legitimate, even if
| the CVC or postal code verification check fails.
|
| source: https://stripe.com/docs/radar/rules#built-in-rules
| js2 wrote:
| :-(
|
| I recently went through the opposite of this. A purchase at
| denon.com was declined, got a "please verify" email from my
| issuer which I approved and re-did the purchase. My issuer
| authorized the payment the second time, but then it got
| held up by NoFraud who sent me their own "please verify"
| email which I did. I had used an iCloud Hide My Email
| address for the purchase so a day later I get another email
| from NoFraud:
|
| > Thank you for confirming your recent order. We are the
| fraud solution for the merchants website. We flagged the
| order for additional review before we notify the merchant
| to process it. To complete the verification for approval,
| we require an alternate email address for the cardholder.
| Please respond with an alternate email address.
|
| At that point I tracked down NoFraud's phone # and called
| them to finally get the transaction approved.
| techsupporter wrote:
| > I had used an iCloud Hide My Email address for the
| purchase so a day later I get another email from NoFraud
|
| I got hit by a merchant using "NoFraud" as well. After
| making an order from the merchant's site, using Apple Pay
| on the web (which is, allegedly, rather hard to fake), I
| received an email saying my order was canceled as it
| "appears that a merchant-specific email address was used"
| and to "please resubmit the order using your personal
| contact details".
|
| They were right, because I always use
| [merchantname]@subdomain.mydomain.com. Whatever it was
| couldn't have been that important because I didn't bother
| redoing it if they're going to be that picky.
|
| (I can't find the purchase confirmation and subsequent
| email in my email, probably because I deleted it out of
| annoyance, so I'm not naming who I think I remember it
| being just in case I'm wrong)
| MBCook wrote:
| EMV doesn't transmit the full card number in the clear. I
| don't know how they'd get it. IIRC the track data is
| sanitized, but maybe it wasn't always. I'm not even sure all
| cards give it in a modern EMV transaction.
|
| The old mag stripe emulation mode of contactless did, but
| that's legacy and many places won't accept it and cards won't
| do it.
|
| However the good old "break the slot or chip reader so they
| have to use mag stripe and scan the card things the old
| fashioned way" technique still works great.
| js2 wrote:
| Googling "EMV sniffer" returns a bunch of sketchy sites
| that claim they get the card number from the chip, not the
| mag stripe. That's also what seems to be implied by the
| submitted link. Here's another post claiming the card # is
| readable from the chip:
|
| https://security.stackexchange.com/questions/161493/what-
| inf...
| whoopdedo wrote:
| Some skimmers have a camera to capture an image of the card's
| CVV as well as another copy of the name/number/date.
| Terr_ wrote:
| Here I was thinking that my near-illegibly worn-away CVV
| was a reason to get a replacement card... but instead it's
| a surprise security bonus! :p
|
| Actually, I spoke too soon... the signature-strip has been
| worn away too and now that I really look at it, I can make
| out the word "Void" underneath.
| CharlesW wrote:
| > _How do these skimmers work with chip &pin?_
|
| My understanding is: They don't. If you stick to contactless
| payments, you're not at risk.
| noodlesUK wrote:
| The image shows the skimmer gadget sitting on top of the pin
| pad and the bottom card insertion slot (the one that takes a
| chip). On these card readers the magstripe reader is on the
| right hand side iirc. I'm wondering what you can do having
| connected to the EMV contacts and recorded the PIN. I suppose
| you could make a transaction, but it would have to presumably
| happen at the same time as the legit transaction (which would
| then immediately get flagged as fraudulent)
| throwaway42968 wrote:
| Not much. The chip doesn't transmit any credit card
| numbers. What's really happening in an EMV transaction is
| the amount due is transmitted along with some identifying
| information from the host to the card reader. The reader
| then authenticates with the chip card using asymmetric
| cryptography. Once this authentication is done, the reader
| sends an amount due and the chip card checks its
| authorization rules, and responds with some encrypted data
| that represents the transaction amount and that depends on
| a private key embedded in the card. You could replay the
| transaction at the exact same time as it is happening, but
| you'd have to use the same amount due. And there are other
| identifiers for EG the terminal that you'd have to know. If
| you're curious, EMVco makes the specification available
| online in documents titled Book 1, Book 2, Book 3, and so
| on: https://www.emvco.com/specifications/
| chiph wrote:
| You'll want an RFID blocking wallet or sleeve to supplement
| this plan. Thieves will use an RFID skimmer and just wave it
| near your pocket to grab the info off the card when it
| responds.
| MBCook wrote:
| Has anyone ever shown a practical attack for EMV
| contactless?
|
| I know the old mag stripe emulation was vulnerable, but EMV
| contactless shouldn't hand out the card number and uses
| cryptographic signatures. You'd have to capture and play
| back a transaction (not randomly scan a card) and there are
| time stamps and transaction counters that would be wrong
| and the terminal ID wouldn't match.
| kotaKat wrote:
| The US still has a _heavy_ reliance on magstripe, even though
| we rolled out EMV, and many cards still have it, and you can
| just take a stripe dump regardless.
|
| The actual user of the stolen card dump will cause the terminal
| to allow a magstripe fallback (typically with a bad chip on a
| fake card that won't read) -- "aw jeez my stupid chip isn't
| reading" is still every much a valid excuse to a cashier to go
| to magstripe.
| loeg wrote:
| I think there are also just lots of POS systems in the US
| that aren't on EMV yet. Major retailers are on EMV but random
| old rural businesses probably aren't.
| MBCook wrote:
| Plus lots of cards without EMV at all, usually gift cards
| or until recently EBT.
| reaperducer wrote:
| Some big chains still haven't switched.
|
| I was in a major home improvement store a few weeks ago,
| and it was swipe-only. Either Home Depot or Lowe's.
| lowmagnet wrote:
| wal-mart has emv, but no radio-based payment
| gorkish wrote:
| Lowe's. Lord help the poor souls who maintain that
| system; it looks like the kind of thing that's just chock
| full of COBOL.
| macNchz wrote:
| Makes me think about intentionally corrupting the magstripe
| on my cards. I wonder if that'd cause any issues.
|
| I can't remember having to fall back from the chip to a swipe
| in ages, and I have a couple of cards, so I could keep one as
| a backup with a working stripe just in case (long ago I found
| myself far from home and low on gas, with no cash, a dead
| cell phone and a "suspicious transaction" blocked credit
| card, and I'd rather not repeat that experience).
| throwaway42968 wrote:
| It's only an issue with EMV Fallback, which you'd probably
| not need if you have a backup card that is good. Basically
| if the chip or near-field antenna on your card fail, the
| fallback is to collect a magnetic stripe read. Properly-
| configured readers don't need the stripe read to complete a
| transaction.
| gorkish wrote:
| Properly configured merchants don't even need the payment
| terminal to complete a transaction. They should be able
| to key the card number if all else fails. I say corrupt
| your magstrip if it makes you feel better.
| mkmk wrote:
| "with inspections being done daily in all our store locations."
|
| impressive.
| adrianmonk wrote:
| Could payment terminals be made with built-in physical
| countermeasures for detection? Ideas:
|
| (1) Terminal has a scale built into its feet/mount. It
| periodically weighs itself, and if (ignoring fluctuations) it
| weighs too much, it shuts down. It's hard to build a skimmer that
| weighs 0 grams.
|
| (2) Proximity sensors in key locations on the housing. My
| smartphone can disable its touchscreen when I hold it against my
| face, so a payment terminal should be able to detect when
| something is covering a part that isn't supposed to be covered.
|
| (3) Light sensors. Put some in an area where skimmers need to
| cover (near card slot) and other where skimmers probably can't
| cover (the display), and detect whether they get roughly the same
| amount of light.
|
| (4) Microphones. Same idea as light sensors but with sound.
| crote wrote:
| Skimming is pretty much a solved problem in Europe already. We
| got rid of the mag stripe, so trivially cloning a card is no
| longer possible. Furthermore we don't allow offline
| transactions, so a skimmer must somehow get in between the
| connection from the terminal to the card and execute a separate
| transaction right before or after the genuine one.
|
| It is still not 100% impossible, but the "overlay" type of
| skimmer this protects against has been eliminated for a few
| years now.
| sangnoir wrote:
| You are correct: but I think all these measures are in place
| because liability is placed on financial institutions rather
| than individual victims. The owners of the payment
| infrastructure are correctly motivated to holistically solve
| the problem, unlike in the US were the person woth the least
| power and control is burdened with having to contend with
| "Identity theft" and losing money by default to make up for
| the fraud.
| gorkish wrote:
| Alternatively they could just remove the slot and require self-
| pay terminals to be contactless. It really makes no sense to me
| why merchants don't already do this proactively; they are well
| incentivized:
|
| 1) Contactless merchant fees are lower than dip or swipe 2)
| Payment terminals are cheaper 3) Less fraud/shrink
|
| This hunk of plastic from Target is a solution looking for a
| problem.
| MBCook wrote:
| They're not looking for a problem. The problem exists.
|
| "Just use contactless" doesn't work in the US.
|
| Just yesterday a friend was commenting that he got a new
| credit card (old card expired) and the new one still doesn't
| have contactless. Seems his bank decided it wasn't worth it.
|
| But that's not all. Target gift cards don't have contactless.
| Don't think Visa/MC/AmEx gift cards do either. I bet EBT
| cards don't, I think a rule requiring them to have chips was
| just passed.
|
| I know other countries are ahead of us, and that major banks
| have been issuing chip cards for a while. But there are still
| a lot of people that leaves out.
|
| And target wants to sell to them.
| gorkish wrote:
| I was suggesting "Just use contactless" for customer
| accessible payment terminals. Want to use something less
| secure and more likely to result in fraud? You can hand
| your card to the cashier or walk inside instead of paying
| at the pump, just like you do with any non-card payment
| already.
|
| The EBT, gift card, and lazy small banks would get their
| act together pretty damn quick, I'd wager.
| MBCook wrote:
| "Sorry. I know you're on assistance because you can't
| afford food, but for your security we're not going to let
| you buy food with your government benefits as you may
| become a scam victim.
|
| Come back when your state government decides to pay to
| re-issue every card with better technology."
|
| That's cruel. The move to EMV was only recently mandated
| for EBT (if I remember correctly and it was done at all)
| because so many people were having their benefits stolen
| by mag stripe skimmers.
|
| You can't use a stick against powerless people to affect
| change. It just makes them suffer.
|
| Even if Target did mandate contactless, the stock would
| plummet on news of all the lost sales and the CEO would
| be out. The new one would reverse it immediately.
| gorkish wrote:
| Where did I suggest this? The customer payment terminal
| is not the register. Both have card readers; one is
| fantastically less likely to be tampered with than the
| other. There is absolutely nothing wrong with putting
| your cashier in between the customer and a potentially
| fraudulent payment. What happens when that person gets
| their EBT account drained by a criminal because of a
| skimmer? I'm not trying to marginalize anyone; get real.
| pertymcpert wrote:
| [flagged]
| strictnein wrote:
| > This hunk of plastic from Target is a solution looking for
| a problem
|
| When you're dealing with tens of thousands of terminals that
| you want to check on a regular basis across thousands of
| stores, having a device that verifies things quickly is a
| solution to a real problem.
| crote wrote:
| Ironically, contactless has been the source of new types of
| skimmer attacks. A skimmer could just add an nfc coil and
| wouldn't even need to physically touch the card anymore.
| briffle wrote:
| Of course they can be made that way. The countermeasure built
| into gambling equipment like slot machines is incredible.
|
| But then it would cost more than their competitors. With much
| more maintenance for false positives, etc. And the vendor
| doesn't really pay the price for skimmer fraud..
| LorenPechtel wrote:
| If someone comes up with an anti-skimmer terminal the payment
| processors would benefit from having a lower transaction fee
| for transactions posted from such a terminal. That would in
| time push the market to use such terminals.
| dangerboysteve wrote:
| Did I read this wrong? They are using the card chip slot to house
| the skimmer protection, so chip and pin will not work ?
| HWR_14 wrote:
| You read it wrong. It's not permanently attached. They stick a
| very precise 3D object in the chip slot, and if it doesn't fit,
| that means the slot isn't the exact same as how the reader was
| made from the manufacturer. So you get a cashier to do that at
| the start of their shift, and if anything is detected they call
| out a more trained repair man/security professional to figure
| out if there is a skimmer.
| NoMoreNicksLeft wrote:
| So the skimmer asshole pays some Target employee $100 to
| replace the very precise 3d object with one that hides the
| skimmer when no one's looking?
|
| I need a solution that lets me, the card holder, check these.
| This ain't it.
|
| Hell, some of the internal skimmers just solder jumper wires
| to pcb pins/testpoints don't they? There's nothing mechanical
| for a card to touch. Target's got so many telescreen cameras
| in the store, they could likely get the pin numbers straight
| from that, no need to intercept that.
| HWR_14 wrote:
| > So the skimmer asshole pays some Target employee $100 to
| replace the very precise 3d object with one that hides the
| skimmer when no one's looking?
|
| They replace the objects every 6 months. And there are
| multiples. So, yeah, I guess it's doable.
|
| > I need a solution that lets me, the card holder, check
| these.
|
| You could just print one and carry it with you.
|
| > some of the internal skimmers just solder jumper wires to
| pcb pins/testpoints don't they?
|
| At the point, there's no real security. If that's your
| threat model, you can just substitute the entire reader for
| a counterfeit one.
|
| > Target's got so many telescreen cameras in the store,
| they could likely get the pin numbers straight from that
|
| If you are as paranoid as you sound, you should be covering
| your hand putting the PIN in with your other hand.
|
| You seem to not understand the threat threat models. A
| skimmer is a 3 second attack that requires no accomplice
| and can be done with slight of hand while people are
| watching. Making that scale to a multi-person operation
| with more physical construction, the need to swap out (and
| hide) a bunch of red plastic going in and out is a win. In
| much the same way that locking your jewelry in a small safe
| isn't going to stop determined thieves, but will make
| casual thieves abandon it.
| NoMoreNicksLeft wrote:
| > You seem to not understand the threat threat models. A
| skimmer is a 3 second attack that requires no accomplice
| and can be done with slight of hand while people are
| watching. Making that scale to a multi-person operation
| with more physical construction, the need to swap out
| (and hide) a bunch of red plastic going in and out is a
| win. In much the same way that locking your jewelry in a
| small safe isn't going to stop determined thieves, but
| will make casual thieves abandon it.
|
| I'm just repeating what I've read elsewhere, seen
| elsewhere.
|
| The gas pump skimmers are completely internal. None of
| that bullshit where their plastic fits over the top of
| the other snugly. They wire just 4 or 5 leads to the
| pcb... vcc and gnd, obviously... so the rest of it must
| be 12c or some other serial/2wire protocol I guess.
|
| Someone was saying "well at least they can't get the
| cvc", but that got me to wondering with cameras so small
| and cheap, could you hide one where it could see that on
| the underside? At least on my cards, it's on the same end
| as the chip itself, so maybe?
|
| How many cards can they skim, before it's detected, and
| what's the average value of skimming one card? If you
| multiply those two together, and the answer is in the
| tens of thousands or hundreds of thousands (or god help
| us, millions), then it's very much worth it to be a
| multi-person operation. Especially since such an
| operation will have more than one card-skimmer going...
| how many can a small team manage reliably? I guess it's
| really `a x b x c =` here.
|
| Does Target have free in-store wifi? If so and they pre-
| configure, they never have to show up on-site again.
| Fuck, can they get someone hired on for 3 days to do all
| this, and switch out the skimmer detection tools? Then
| they just no-show, no-call, and move on to the next.
|
| > If you are as paranoid as you sound, you should be
| covering your hand putting the PIN in with your other
| hand.
|
| Have been for the last 20 years. Some woman in a gas
| station in Virginia once got pissy at me for doing it
| "it's just you and me in here!"... "Lady, you have a
| surveillance camera pointed right at me, I can see myself
| on the monitor behind you".
| clintonb wrote:
| The solution for cardholders is to use tap-to-pay.
|
| Frankly, as a _credit_ cardholder with zero liability, I'm
| not overly-concerned by skimmers. I won't lose anything.
| The card tax is already baked into all prices, so there's
| no real benefit for me to solve this problem.
| duskwuff wrote:
| > Hell, some of the internal skimmers just solder jumper
| wires to pcb pins/testpoints don't they?
|
| No. Most modern card terminals are tamper-resistant and
| will erase key material if opened.
|
| (Besides, it's not like you're going to be able to casually
| crack open a payment terminal, pull out a soldering iron,
| and modify it while you're standing in the store checkout
| line.)
| delfinom wrote:
| Payment terminals inside a retail store do have that
| tamper magic.
|
| Gas pumps are a little quirkier because they use
| integration modules, I would imagine they got better with
| newer ones but earlier ones, even with chips, would
| basically just be an exposed pcb on the inside
| gorkish wrote:
| > I need a solution that lets me, the card holder, check
| these. This ain't it.
|
| No you don't. All you need to do is use a payment method
| that is actually secure. Demand it. When they tell you tap
| doesnt work, ask why. Hand your card to the cashier and
| make them scan it on the register's reader.
| AYoung010 wrote:
| Yes, you did I'm afraid -- this is a tool which is used to
| check for skimmers, not a preventative measure which is
| permanently installed. It only blocks the chip slot when an
| employee is ensuring a skimmer isn't installed on a particular
| terminal.
| jaywalk wrote:
| The device is for detection. The employees just insert it into
| the slot once per day and check to make sure it goes in fully.
| Then it's immediately removed.
| mrguyorama wrote:
| It's not "protection" but a testing tool. If the tool fits as
| expected then there probably isn't a skimmer. Then you remove
| the tool
| [deleted]
| starkparker wrote:
| Why not publicly distribute the design? Because skimmer-makers
| might adapt? It seems trivial to acquire one (getting a job at
| Target or spoofing a corp email account isn't a high barrier).
| groby_b wrote:
| It is, however, added friction, and that's 90% of the security
| game. Every additional layer helps. (And a corp email account
| adds a paper trail, at the very least)
| dawnerd wrote:
| They also patented it so I imagine that's part of their
| reasoning.
| jerf wrote:
| I would expect that the corporations will be asked to sign an
| indemnity agreement before they get the design. Target doesn't
| want to be held liable in case a skimmer is built that defeats
| this detection and the recipient needs to understand there are
| no guarantees.
|
| It's nice that someone got this through the default corporate
| deny policies.
| samtho wrote:
| It's sad that this is likely the case. In general, an "As
| is/no warranty" shrinkwrap contract should be sufficient for
| legal protection but won't prevent people from filing
| nuisance lawsuits, which I suspect they wish to avoid
| altogether.
| kyleyeats wrote:
| That's what the OP is.
|
| > Based on the success we saw with EasySweep, we decided to
| offer the design, for free, to other retailers.
| loeg wrote:
| You still have to request access from Target. GP is asking
| for it to just be published online somewhere.
| gorkish wrote:
| It's right here:
| https://patents.google.com/patent/US11507762B2/ Took me
| five seconds. You can make one if you feel like it.
| loeg wrote:
| That is not the "Step CAD file" available to retailers
| who contact Target and this thread is asking to be
| published.
| kyleyeats wrote:
| Ah good point. Target's one of the most serious companies
| in the world about this, with a forensics lab and
| everything. I'm surprised they're doing this much, even if
| the skimmers obviously have access to the same
| measurements.
| hiatus wrote:
| Sparkfun put out an app to help detect skimmers primarily on gas
| pumps [1], though it no longer appears to be available on the
| google play store.
|
| [1]: https://github.com/sparkfunX/Skimmer_Scanner
| whartung wrote:
| It annoys me that none of the gas stations I use have the "tap
| to pay" that actually works.
|
| They seem to have the sensor on the pumps, but they never work.
| selykg wrote:
| My preferred gas station got tap to pay during the pandemic
| and I make it a clear effort to use it every time I get gas
| to try to bump the numbers up so it doesn't go away or gets
| fixed if it breaks. Such a great feature.
| LorenPechtel wrote:
| Preferred gas station here did something to the UI--you can
| "pay" by waving your phone at it, but then it will prompt
| for your zip code. When you enter the zip code there's a
| couple of prompts about ensuring you know you're paying
| credit price--oops, entering the zip code also answers no
| to the first question.
| callalex wrote:
| My pet theory is that transitioning to wireless payment also
| opens up user expectations for the vendor to participate in
| way more payment networks than just Visa/MC/Discover/AmEx. If
| you have a wireless reader but no agreement with Apple Pay,
| or Google Pay, or Samsung Pay, or WePay, or
| WhateverSomeNewMBACrap users will start putting in reports
| that the reader is "broken".
| hackmiester wrote:
| You don't have to have an agreement with Apple or Google to
| accept Apple Pay or Google Pay. If the customer holds a
| Visa then the phone presents a Visa to the reader. There is
| no special thing you have to do to accept those payments.
| yakkers wrote:
| I'll absolutely admit knowing very little about the nuances
| of payment networks in the US, particularly with
| contactless --- but my experience (in Australia) is that
| payment terminals that support contactless inherently
| support Apple/Google/etc Pay, even if the payment terminal
| is unaware of those things, in which case the transaction
| will work the same as a contactless card transaction (e.g.
| transactions >$100 require PIN).
| axus wrote:
| I wonder why. I had the same problem and assumed they'd just
| bought some premature technology and never upgraded since.
| exabrial wrote:
| We wouldn't even need to worry about this dumb stuff if we had
| actual cryptographic PKI for payments. Honestly at some point
| fraud is 100% the card issuer's fault when the tech to prevent it
| is here and now.
|
| Why I still can't register a public key with my bank and say "do
| not under any circumstance honor a transaction unless it's signed
| with my private key" is beyond me.
| throwaway42968 wrote:
| What you are describing is essentially EMV, except that your
| bank has gone to the trouble of picking your private key and
| embedding it in a card you carry around and insert into payment
| terminals.
| thelastparadise wrote:
| > Why I still can't register a public key with my bank and say
| "do not under any circumstance honor a transaction unless it's
| signed with my private key" is beyond me.
|
| What you are describing is Bitcoin.
| callalex wrote:
| No, a bitcoin wallet is not a bank.
| crote wrote:
| That's EMV, and it is still not 100% foolproof because the card
| itself doesn't have a display and Allow/Deny button.
| Nextgrid wrote:
| > still not 100% foolproof because the card itself doesn't
| have a display and Allow/Deny button.
|
| I'm assuming you are thinking about an attack where a
| compromised terminal processes an attacker-issued transaction
| (relayed from elsewhere) instead of the genuine one.
|
| It seems like a solution to this would be for the card to
| issue a challenge to the reader and only provide a very short
| timeframe to answer, so that relaying it elsewhere is
| impossible due to speed of light and all that.
| al2o3cr wrote:
| it allows any Target team member to easily sweep a store
| for skimmers
|
| I'm unclear on how this is supposed to help - unless the skimmers
| are being installed by frickin ninjas it seems like they already
| needed insider cooperation.
| bastardoperator wrote:
| If the target employee cannot see the skimmer detection tool,
| the terminal has been compromised. Most skimmers fit on top of
| the terminal which would obstruct sight of this tool/layer.
| There are videos online of these skimmers being "installed" and
| it takes about 1 to 2 seconds of work and it seems anyone can
| do it.
| mrguyorama wrote:
| This tool is not permanently installed. It is a daily check
| for skimmers
| snapplebobapple wrote:
| If you make sure who is doing the skimming rotates so that
| there is a constant stream of new people checking it would be
| really hard to stop detection in a timely manner. It's also
| insanely fast to install a skimmer (like 2 seconds fast) so you
| don't necessarily need insider help. Until wireless skimmers
| with a decent range become available this tool could bring
| skimming down to effectively zero (and reduce it to just the
| customer who rang through the till before it was discovered
| when they are available). It's a pretty epic addition to the
| retail security landscape
| asadm wrote:
| Skimmer can be installed in seconds, just glued-on when the
| skimmer-guy is at the check-out.
| ceejayoz wrote:
| Yup. Three seconds: https://www.youtube.com/watch?v=5b1axnNK-
| wI
|
| A second guy distracting the clerk helps, too.
| devrand wrote:
| I feel like this would be particularly easy at self checkout
| stations where there's usually like 1 employee handling a dozen
| or so stations. You can also get someone else to go
| "accidently" scan a pack of gum twice and hit the help button
| to have said employee come over and fix it. That would provide
| more than enough of a distraction to quickly place a skimmer on
| a different station.
| tennisflyi wrote:
| It's the former more or less - https://youtu.be/Sljmr8m88P8.
| They could do it on a lane that isn't open (read no attention)
| just before a rush hour and hope it gets chosen.
| adolph wrote:
| This is an interesting and simple physical measurement device to
| determine if the credit card slot is in a different orientation
| than expected. It uses the keypad as a reference location.
|
| I think the most obvious circumvention would be for the criminal
| enterprise to focus on altering the length of the verification
| devices, since an EasySweep does not appear to have a formal
| method to verify its own correctness. A shortened card tab on
| EasySweep would provide feedback that the terminal was ok since
| the keypad finger support presses against the terminal.
| gumby wrote:
| This is quite clever.
| bredren wrote:
| It seems like this is the kind of thing Verifone aught to design,
| maintain and distribute.
| kotaKat wrote:
| Believe it or not, Verifone part KIT177-005-01-A is, in fact, a
| "Skimming Device Detection Tool".
|
| https://www.geminicomputersinc.com/kit177-005-01-a.html
| delfinom wrote:
| I would imagine there's something wrong with it if Target
| isn't just buying it
|
| Though it could just be cost given that Target could just pay
| for a plastic injection mold overseas and then pay peanuts
| yearly to make a 60k batch for their yearly renewal they
| mention, compared to $20*60k each time
| loeg wrote:
| Yeah. $8-24 a unit vs "under $1." Although 60,000 x 8 still
| isn't a huge amount of money.
| gorkish wrote:
| This little micro-arms-race to develop and patent a
| plastic wedge that doesn't need to exist in the first
| place is ridiculous. The irony is that there is something
| of a perverse incentive not to solve the actual problem
| now that such a big industry has emerged to to combat it.
| If they wanted to build secure card payment terminals
| they would build them.
| Terr_ wrote:
| All this shape-based stuff makes me think of antigen/antibody
| immune-system analogies.
|
| The skimmer binds to the payment slot, some payment slots change
| shape to prevent skimmer binding, and now the tester-block binds
| to check that nothing is already bound...
| thetwentyone wrote:
| Since it's only implied how it works and there seems to be some
| confusion in the comments. It seems like the technique is to
| simply create a very form-fitting insert which won't fit properly
| if some device is overlaid onto the machine. The insert is not
| left in the device, but is just used for a quick in-and-out
| check.
| Dah00n wrote:
| And it is patented..
| dotBen wrote:
| This is a good thing, some troll could patent it and then
| deny anyone else the right to use it.
| KennyBlanken wrote:
| It's literally just a box-shaped piece of plastic with
| specific dimensions, attached to a handle. That's it.
|
| Good job, Terry Woodman. You 'invented' something that has
| been used for probably centuries to QA things around the
| world, a pass/fail check if calibrated test objects fit or
| don't fit.
|
| It's amazing how thirsty they apparently are for PR, for sort
| of good public deed or something...and how they have gone out
| of their way to be as hostile as possible to others
| benefiting from it. patenting something which never should
| have been patentable, and only distributing the files to
| other retailers, because I guess otherwise the Criminal
| Element would figure out some way to get around it.
| runjake wrote:
| > It's literally just a box-shaped piece of plastic with
| specific dimensions, attached to a handle. That's it.
|
| That could be said about a very large number of useful
| products. It doesn't lessen their utility.
|
| https://news.ycombinator.com/newsguidelines.html#comments
| [deleted]
| gorkish wrote:
| Sure is. Good thing criminals are too dumb to find it, and
| especially too dumb to replicate it. I'm sure they will never
| be able to modify their skimmers to circumvent it. They will
| rue the day they messed with Target's IP lawyers!!!
| https://patents.google.com/patent/US11507762B2/
| loeg wrote:
| But also, freely licensed.
| crote wrote:
| Only for large retailers, though. Why not directly offer
| the CAD file for download right on that page, or make the
| resulting product available for purchase?
| monkeymeister wrote:
| Likely to avoid defeat attempts. The corporate email
| requirement acts as a first-line defense to at least try
| to stave-off would be skimmers / scammers grabbing the
| CAD file and working out the measurements needed to
| defeat it.
| kalupa wrote:
| ah, nothing like security through obscurity!
| cdchn wrote:
| Basically a Go/No-Go gauge for a payment terminal.
___________________________________________________________________
(page generated 2023-07-19 23:02 UTC)