Slashdot Log In
Possible Serious Security Flaw In ATMs
Posted by
Zonk
on Thu Nov 30, 2006 05:45 PM
from the my-money-is-flighty-enough-as-it-is dept.
from the my-money-is-flighty-enough-as-it-is dept.
sfjoe writes "According to a story at MSNBC.com, researchers at Algorithmic Research (ARX) have shown it may be possible for 'someone with access to the ATM network to attack the special computers that transmit bank account numbers and PIN codes, called hardware security modules'. Using these methods, an attacker could trick the security modules into exposing a PIN. It has long been considered impossible to access PINs as they are traveling through the ATM network without the encryption key used by the card-issuing bank. If PINs can be compromised, the almost 8 billion transactions per year they handle may be in danger. Not to mention all the transaction at retail stores."
Related Stories
[+]
Ask Slashdot: Would You Trust RFID-Enabled ATM Cards? 214 comments
race_k2 asks: "As a regular Slashdot reader I've followed the development and implementation of RFID devices in many ubiquitous areas such as clothing, passports and even people. Given that our environment is becoming increasingly tagged, often without our knowledge or consent, and can be monitored or hacked by anyone with the proper hardware, skills and motivation, I viewed the recent arrival of two new ATM cards containing RFID chips with skepticism. While this feature may bring the increased convenience of speedy checkouts, it is not something I am completely comfortable using and decided that the safety of my personal data was more important than the ability to buy things quickly. The vulnerable nature of RFID security coupled with recent, though unrelated, reports of a Possible Security Flaw In ATMs make me seriously question whether the marriage of wireless data transfer with personal finance is a wise application of technology." So race's question basically boils down to: How safe and secure are the RFID chips that are being embedded in debit and credit cards? To add another issue on to the fire: Would you trust RFID technology on your cards?
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Poink-Poink-Poink-Poink (Score:5, Funny)
Stop reading my tones!
Re: (Score:2)
If this is like a windows exploit then we're all in for it.
If on the other hand it's like a linux issue: If you're local, have this obscure package installed, stand on your head and swallow a glass of water you can become root, then I'm not nearly as worried. Still needs to be fixed, but much less worried.
-nB
Re: (Score:3, Interesting)
There's almost no State/Federal regulation (that I'm aware of).
Re:Poink-Poink-Poink-Poink (Score:5, Interesting)
http://www.beyondrobson.com/tech/2006/10/avoid_ba
Therefore, not only is the ATM network insecure, it always has been for other reasons.
--jeffk++
Parent
The reality of this is... (Score:5, Funny)
Re:The reality of this is... (Score:5, Insightful)
Parent
Re:The reality of this is... (Score:4, Insightful)
Having said that, I hope that even if they do know who you are, that they ask to see ID every time, like my teller colleagues and I did. A lot of people have this silly notion that the only time we ask for ID is if the person in front of us is not the person on the account. For some reason they didn't understand that we had no way of knowing that until we had seen ID. When we asked we actually had idiots say "Why? I'm the owner of the account," as if we would turn red in the face and say "Of course you are. How silly of me to ask. Certainly a criminal would have provided us with ID without being asked."
But if tellers ever get to the point that store clerks do (and I suspect many have) then any old schmoe will be able to take money out of your account. I can't tell you how many times I've had cashiers ring up a sale without ever even looking at either my ID or my signature on the back of the credit card. I've had times where I offered and was refused, as if they didn't want to have anything to do with security checks of any variety as that might bring upon them responsibility or something. I'm not talking about small purchases here either.
So my point is, if bank tellers get to the point of laziness as most cashiers, you're money isn't safe in the bank whether or not you have an ATM card. The best you can do is keep an eye on it and report anything as soon as it happens.
Parent
Re: (Score:3)
A little bit worrying if somebody could swipe my card and pull out cash right in front of the teller.
Re: (Score:3, Interesting)
You don't need ID (Score:3, Informative)
They're supposed to check your signature, but not your ID.
Remember those Visa Check Card commercials from a few years back, where some easily recognizable celebrity would walk into a store without his ID, try to pay for something with a check, and be frustrated when the clerk couldn't recognize him? The point was you don't need ID when you pay with Visa, y
Re: (Score:3, Funny)
Lucky You (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
You dad was right, though. Cash is, indeed, king. The problem is that you have to be willing to save until you can afford to buy without credit. This is something that most of us, not even your dad, is willing to do. Credit is an all or nothing deal. You either play the game with all the risks, or you are generally excluded from borrowing money from anywhere except the insti
Re:The reality of this is... (Score:4, Insightful)
Parent
Re: (Score:2, Insightful)
When I read the article, I couldn't believe that anyone would even consider building a "secure" system where third-party machines have to decrypt and re-encrypt such sensitive data... or any encrypted data for that matter... that's why it's encrypted in the first place.
What did they hope to accomplish by doing this?
Who knew the system was this broke? (Score:3, Interesting)
There must be some reason (I hope) but the security model that they're describing in TFA seems horribly flawed. It depends purely on the security of some black-box hardware modules embedded at different points in the system.
Basically, what they're saying is that there's no end-to-end encryption of your "PIN block" (PIN+Account number, don't ask me why they're transmitted together instead of separately with some random transaction identifier). Instead, the ATM encrypts it for the next mac
Intercepting Transmission (Score:5, Interesting)
He was able to get credit card numbers, pins, and all of the other information transmitted, and stole a lot of money before being caught. And he wasn't caught by bank security or software, he was caught because a clerk was paying attention, IIRC.
Re:Intercepting Transmission (Score:5, Informative)
Parent
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
The only one that had inflammatory hand wringing was the Mp3 player that Sound emitted from the line is then interpreted using a modem line tap, or passed through a Ukrainian computer software program which is illegal to purchase.
And yes, there is crypto, at least for US ATM networks, between the ATM and end unit HSM.
This isn't a comment regarding the original article, just this particular story.
Re: (Score:3, Interesting)
Also covered here [timesonline.co.uk].
And here. [com.com]
If there was crypto used, it absolutely sucked.
If all you need is a modem line tap or an illegal program to crack ATM's, there isn't much security is there?
I don't think there is crypto. I think the information is sent across the phone lines as plain text. The purpose of the modem line tap or illegal program is to convert the signal going over the line (the same signal you hear when you pick up the phone during a fax or internet connection) to text. From there, no men
Let's just get this clear right now... (Score:5, Funny)
Re: (Score:3, Funny)
What's the big deal? (Score:2, Insightful)
Re: (Score:2, Insightful)
Holding All the Cards (Score:5, Interesting)
The cost of chipcards that generate onetime passwords, to protect from replay attacks, is minimal. Especially compared with fraud and theft. What's taking them so long?
Re: (Score:2)
Try reading one of those cards when you've had your pupils dialated sometime.
Re: (Score:2)
Re:Wrong (Score:2)
The cost of chipcards that generate onetime passwords, to protect from replay attacks, is minimal.
Not even close. Everything about the change is gigantic considering they would need to somehow inte
Re: (Score:2)
Danger (Score:2)
It was as if the entire NCC had suddenly received the news, and the voices of NCC staffers across the country had cried out as one. We could only look at each other in stunned silence, afraid to speak, as if any utterance would risk making our greatest fear become real, and the terror would come out of the cold dark depths...t'would come for us - the KRACKEN!!!
Easier to manually do it (Score:4, Insightful)
Using the information directly at an ATM to get a couple of hundred dollars would be too much effort, too high risk, and too little return. More likely, the PIN would be used to obtain larger sums of cash via other methods - calling in a bank transfer or something to that effect.
While on the surface it seems unlikely that somebody would go through the hassle, if one gained access to the ATM network, and had means to unencrypt the traffic at least in part, there is a great deal more potential for crime than simply obtaining an ATM PIN number.
Banks shouldn't be reliant on security at the switches either - all it takes is one bad employee to reduce the effectiveness of on site security to nothing, and I imagine with the pay rates they are kicking out, there are more than a few employees vulnerable to trouble of one sort or another.
New Title to Earn? (Score:4, Funny)
Sorry, obvious pun joke. Had to make it. Any others?
Re:New Title to Earn? (Score:4, Insightful)
Parent
Re: (Score:2)
Re: (Score:3, Funny)
So just use it as a credit card? (Score:4, Interesting)
Re: (Score:3, Insightful)
Re: (Score:2)
I never quite understood the reason for using it like an ATM when it takes so fucking long. I use a card because I want it to be fast (no ID checks, no signature, no change).
Important holiday information (Score:2)
convergence! (Score:2)
Chicago (Score:2)
As long as the ATMs in Chicago are secure I'll be fine ;-)
No. Fcking. Way. (Score:2)
Holy crap! People with access to a network can attack it? Next you're going to tell me that the only secure computer is one that's turned off, locked in a safe, and dropped to the bottom of the Marianas Trench.
What a coincidence! (Score:3, Interesting)
FWIW, ARX was actually something of a leader and had some cool ideas... several years ago. I'm not sure whether it was because of financial trouble, incompetent management, neither, or both, but they were lapped by players like nCipher, Luna (now part of SafeNet), Utimaco, even Thales, which focuses on serving the credit card transaction market but doesn't have things like Diffie-Hellman key exchange because VISA and Mastercard don't require them, and yes, even the old low-cost option, Eracom (bought by Safenet in order to do away with a pesky competitor).
This is highly unlikely (Score:3, Informative)
Re: (Score:3, Funny)
Re: (Score:2)