loose wire | blog – Page 96 – Jeremy Wagstaff: ex Reuters/BBC/WSJ etc. Now consulting and writing. Blogging here since 2001

Watch Out For the Big Skim

By jeremy | October 14, 2008

By Jeremy Wagstaff

For those of you nervous about doing your banking online, here are some comforting words: It may be just as dangerous to do it at an ATM machine.

That’s because scammers have figured out how to steal your account details and PIN number straight from the machine. And they’ve been doing it for a while. And they’re getting better at it: Think of it as an industry with its own standards, supply chain and, well, ethics.

Here’s, roughly, how it works. A scammer walks up to an ATM machine. He chooses one in a place that’s not too busy, where there aren’t too many surveillance cameras, and where there are lots of tourists or rich people. He reaches into a plastic shopping bag and pulls out what looks like the card slot of an ordinary ATM machine—the bit on the panel where you slide in your ATM card.

Actually, it is the slot of an ATM machine, only it’s got an extra card reader built in. He sticks this over the top of the existing slot; it fits so well that unless you look carefully you won’t see anything odd. The only thing is that now the magnetic strip on your card would be read twice as it goes in—once by the bad guy’s reader and once by the bank’s machine.

The other part is the PIN reader. This can be done in a couple of ways: either by laying an extra key pad over the existing one, in much the same way he’s laid an extra card reader over the legitimate one. This will just capture your PIN number as you key it in.

Another way is to hide a little camera somewhere near the screen to record you tapping in your PIN number. This could be hidden in a fake speaker—which is where an alert customer found one in Pennsylvania last year—or a leaflet holder, or over the customer’s head.

(If you’re interested, you can watch some alleged bad guys installing this gear in less than a minute here: http://is.gd/41XO.)

All this information is stored on a flash card or something inside the fake keypad or card slot. Now the scammer has all the information necessary to make a fake card, program it with your account, waltz up to an ATM machine and enter your PIN number.

(Oh, and before you ask, you can buy a machine that makes a credit or ATM card, complete with magnetic strip, online for a few hundred dollars. Legitimately.)

This may be news to you, but it’s certainly not new. ATM skimming, as it’s called, has been on the go for quite a few years—at least 2004, but probably earlier. And it’s big business: Turkish police last month (Sept) arrested a man who, they said, had sold skimming devices to 10 countries including in North America and Europe. The police footage of his house—which has a swimming pool, by the way—includes boxes of ATM slot covers, keypads, and what looks like either a sun-bed or an ATM card maker. (You can watch the raid here: http://is.gd/41Xz.)

He also ran an online network which had details of at least 15,000 credit cards. Members bought gear, swapped stories, sold and bought credit card numbers, bitched about the neighbors and the FBI. The web-site was shut down earlier this month, but there’s bound to be another one up soon.

Now you may think that your visit to an ATM should be safer than this. OK, you might say, I can understand that my bank can’t be sending folk around to my house to check my computer is free of viruses, trojans and key-loggers, but surely they can have someone go around and periodically check that their ATM machines don’t have dodgy bits stuck on them, like extra card readers or keypads?

And if that’s too tricky, how about looking out for the more obvious stuff like speakers and brochure holders that weren’t part of the original design? Surely if a customer can spot these things, an employee should be able to? If you thought that I think you’d be thinking straight.

The thing is that banks do seem to be getting smarter. The problem for bad guys is that until recently they would have to go back to the ATM machine to pick up their gear and download the data. This is the risky bit, because the banks are beginning to wise up, figured out something is amiss and may be waiting for them.

So now they’re getting smarter. (The bad guys, not the banks.) They are putting cellphones or wireless chips inside the card slots or keypads or speakers or brochure holders to transmit the data back to Starbucks or wherever they’re waiting.

Now they don’t need to pick up their gear. Skimmers, as these people are called, can now buy a complete device which would transmit more than 1,800 cards via short message service before needing a re-charge. The whole kaboosh for $8,000. Or they could dial into the device when they like and download the data. By then they’ve probably got enough ATM data to buy their own bank.

In other words, you got to feel slightly sorry for the banks. This is sophisticated stuff. And it’s getting more so; according to some security consultants, there are indications that the slot covers that these guys use so closely match the ATM machines in color, material and dimensions that they well be made by the same manufacturer. As the blurb to one skimmer’s brochure put it:

Thus, we achieved the full and precise compliance of the paint’s tone, gleam, hue at the different light angles, the paint’s surface feelings to the touch etc. In the real situations the skimmers really look like an integral part of ATM.

The scammers are clearly getting smarter—either by being in cahoots with the employees of the companies that make these machines, or else by studying the material very carefully.

Either way, it looks like the banks are woefully out-gunned. They’re trying a few things—one is ‘jitter’, which moves the card around while it’s being read, confusing a scammer’s reader—but this means replacing all the old ATM machines. I can’t see that happening any time soon.

Bottom line? This may not happen everywhere, and it may not happen very often. But it makes sense to use ATM machines that are in your bank (i.e. not in a mall or the middle of a red light district), that you’re familiar with, and that you’ve thoroughly inspected for oddities—from extra card readers to brochure holders with little cameras coming out of them.

The Financial Crisis in Charts

By jeremy | November 22, 2011

0 Comment

Thought I’d offer a brief history of the financial crisis as seen through Google Insights, which measures the popularity of a search term over time.

Interest in the word subprime spiked a couple of times in 2007 (above) before we figured out it was all about toxic debts (below):

and credit crunches:

Then we realised suddenly we had to learn a bit more about Freddie Mac and Fannie Mae:

and even basic terms like liquidity:

Useful information. And it wasn’t just an economics lesson. We had to gen up on countries that we had recently given little attention to, like Iceland:

Although it’s worth keeping it all in perspective. Search for the word meltdown, a commonly used term to capture the excitement of the past few weeks, and you get this. Clearly rising interest, but that spoke in 2005? It’s linked to Ice Age: The Meltdown, which grossed $70 million at the box office in its debut week:

Technorati Tags: financial crisis,credit crunch,economics,charts,google,zeitgeist,iceland

The Financial Crisis in Charts

By jeremy | November 22, 2011

3 Comments

Thought I’d offer a brief history of the financial crisis as seen through Google Insights, which measures the popularity of a search term over time.

Interest in the word subprime spiked a couple of times in 2007 (above) before we figured out it was all about toxic debts (below):

and credit crunches:

Then we realised suddenly we had to learn a bit more about Freddie Mac and Fannie Mae:

and even basic terms like liquidity:

Useful information. And it wasn’t just an economics lesson. We had to gen up on countries that we had recently given little attention to, like Iceland:

Although it’s worth keeping it all in perspective. Search for the word meltdown, a commonly used term to capture the excitement of the past few weeks, and you get this. Clearly rising interest, but that spike in 2005? It’s linked to Ice Age: The Meltdown, which grossed $70 million at the box office in its debut week:

Hollywood still trumps global financial disaster, I guess.

Technorati Tags: financial crisis,credit crunch,economics,charts,google,zeitgeist,iceland

Fail, Seinfeld and Tina Fey: A Zeitgeist

By jeremy | November 22, 2011

1 Comment

I use Google Insights quite a bit—I find it a very useful way to measure interest in topics. Here’s one I keyed in just for the hell of it. Red is the word success and blue is the word fail. The chart covers from 2004 to today:

What seems to have happened is a surge of interest in the word fail relative to the word success.

To the point where, in the past week or two, it’s become a more popular word to include in search terms than the word success, for the first time in four years.

Just to magnify that last bit:

What does this mean? Probably not very much. But I found it intriguing. Are we now more interested in failure than success, or is it just this ridiculous new fascination with the word FAIL?

I think these Google searches reveal a lot more than we’re really giving them credit for. If nothing else, I believe they offer a pretty good idea of a celebrity’s career trajectory.

Take these clowns, for example. Here’s the gradually declining interest in Bill Gates (red) and Seinfeld (blue), revived, briefly, by the Microsoft ads:

(The blips in 2006 and 2007 for Seinfeld, by the way, are ‘Kramer’s’ racial slurs and Seinfeld’s aptly titled The Bee Movie, by the way.)

Here are the two comediennes, Sarah Palin and Tina Fey, their careers apparently forever intertwined. Palin is of course red:

A close-up reveals that Palin might be on the decline, whereas Tina is on the up:

Because all these things are relative, put Seinfeld and Tina Fey (red) in the same room and you get an idea of how big a shot she has become this year:

Just to stress that last spike:

Seinfeld was right when he said he was a has-been. Still a funny guy though.

And I can’t resist taking a look at how Techcrunch and Scoble (blue) face up:

Ouch. Seems Scoble started losing ground in in 2006. But hey, who knows? With this new dotcom crunch, maybe he’ll have the last laugh. Gotta admire someone who’s kept his own for 4+ years.

Talking of not leaving the party after it’s over, how does Vista shape up against XP? The chart is surprisingly revealing. Vista (red) enjoys a spike in early 2007 on its launch, but never seems to be able to shake off the XP shadow:

That’s one FAIL, I reckon.

Who says graphs are boring?

Technorati Tags: windows,xp,vista,seinfeld,palin,tina fey,success,charts,google,zeitgeist,techcrunch,scoble,microsoft

Social Engineering, Part XIV

By jeremy | November 22, 2011

0 Comment

Further to my earlier piece about the scamming potential of Web 2.0, here are a couple more examples of why social engineering is a bigger problem than it might appear.

First off, governments and organisations are not as careful with your information as you might expect them to. There are plenty of examples of CD-ROMs and laptops going missing, but often even that doesn’t need to happen. Some governments openly publish such information on the Internet. Indonesia’s minsitry of education, for example, has published the names, addresses, age, date of birth, school and education number of 36 million Indonesian students in easily downloadable XLS format.

Who might use such information? The mind boggles at the possibilities. But one hint might be found in this Straits Times article from neighboring Singapore, which reports a growing wave of faux kidnappings: Gangs phone someone with enough information about their loved one—child, spouse, or whatever—to convince them they’ve been kidnapped and the mark must pay the ransom immediately. In the past six months employees at one bank alone have foiled 14 such attempts—merely by alerting the victims trying to withdraw large amounts of money that they’re being conned.

In the first half of this year, according to the newspaper, 21 people have been scammed out of S$322,000 ($216,000) in this way. Such scams rely on having access to just the kind of information contained in the ministry of education’s database: Knowing kids’ names, their class, their home address, their school chums—all would be invaluable in doing a scam like this. Or any other number of scams.

The point is that we need to think beyond the narrow confines of single channels of data. Scammers don’t: They use a combination of techniques to build up enough information about their mark to be able to either impersonate them or convince them of something. In the above case, it’s that they have kidnapped a relative. In this (still ongoing) Hong Kong-based scam, it’s that they are their bank.

I’m not suggesting Web 2.0 is going to breed a different kind of scam, it’s just going to breed a new kind of opportunity. Social engineering relies on gathering just the sort of data that social networking and presence tools base themselves on.