{"id":4485,"date":"2015-01-21T10:00:14","date_gmt":"2015-01-21T15:00:14","guid":{"rendered":"http:\/\/me-en.kaspersky.com\/blog\/?p=4485"},"modified":"2017-09-24T18:37:36","modified_gmt":"2017-09-24T14:37:36","slug":"skimmers-part-one","status":"publish","type":"post","link":"https:\/\/me-en.kaspersky.com\/blog\/skimmers-part-one\/4485\/","title":{"rendered":"Juggling with cards: doing criminal business on ATMs"},"content":{"rendered":"

We all know to be aware of pickpockets. Even if <\/a> did not include tips on watching your pockets when outdoors, life itself provides opportunities to learn the simple rules. The same can be said with hackers. Today, widely publicized hacker activities on the Internet are known even to children.<\/p>\n

\"ATM\"<\/a><\/p>\n

But skimmers enjoy less popularity, which is too bad since you run a relevantly high risk of falling victim to their activity. These carders specialize in stealing card credentials with the help of miniature, stealth hardware <\/a> on ATMs. Even with the combined effort of police, banks, and payment systems, the amount of money stolen from card accounts <\/a> to grow.<\/p>\n

Skimmers are a little like pickpockets (they use similar palmistry skills) and, to a lesser degree, they\u2019re a little like hackers, too \u2013 what they do is not possible without employing some hi-tech and PC tricks.<\/p>\n

To become their target, you just need to use your debit card to <\/a> cash. If your card is not equipped with a chip, the situation is worse for you and better for them: non-chipped cards are stripped of money a lot easier. To increase your chances of falling victim to skimmers, just skip the option of SMS notifications from your bank, insert your card into any ATM you see on the street, and proudly show off the PIN you enter. You\u2019d make skimmers extremely grateful.<\/p>\n

\"atm_1\"<\/a><\/p>\n

On a serious note, this illicit business has grown and evolved over the years. Its principle remains the same: Use stealth techniques to read data from the magnetic strip on a card, look up the PIN code, clone the card and <\/a> the maximum amount of money from the corresponding bank account. However, the data theft techniques evolved greatly.<\/p>\n

Just<\/strong> business<\/strong><\/p>\n

There were times when skimmers used DIY card readers, installed clumsy hardware on ATM input trays, and risked getting caught in the act when extracting the data manually. Times have changed. The industry has moved on, and DIY skimmer enthusiasts are extinct. Today, skimming is a well-organized and highly automated process.<\/p>\n

The first link in the process chain is producers and sellers of ready-made hardware solutions made of massively available components. The deals are made online, and the goods are shipped via courier services \u2013 this is safest for the criminals.<\/p>\n

https:\/\/twitter.com\/GreyCastleSec\/status\/413645017987551232<\/p>\n

\u00a0<\/p>\n

To see the proof of how widely popular skimming hardware is, just type in a simple request in any search engine. Kits containing a stealth reader to extract data from a plastic card, a vanity panel to get PIN codes, and a cloning device bundled with corresponding <\/a> are sold for as much as $1500 \u2013 $2000. A couple of years ago such offers would go as high as $10,000, as estimated by Brian Krebbs, an infosec expert.<\/p>\n

Buyers of skimming bundles needn\u2019t be proficient hackers: They are offered detailed manuals, some even containing a \u2018best practices\u2019 section. The instructions are so detailed they go as far as including recommendations of proper first-time battery use to ensure a reader enjoys a long battery life.<\/p>\n

Tech<\/strong> wonders<\/strong><\/p>\n

Tech progress, coupled with massive demand, fueled evolution of electronic components used for illicit activities. Security specialists recommend examining any ATMs for peculiarities, but these recommendations are gradually becoming outdated.<\/p>\n

First, experienced criminal vendors sell hardware barely distinguishable from original ATM components. Even a conscientious user wouldn\u2019t be able to tell them apart: The foul input tray is made of the same sort of plastic and is of the same color as the legitimate one. And the shape of the fake is only slightly different.<\/p>\n

\"skimmer-2\"<\/a><\/p>\n

\u00a0<\/p>\n

This similarity is achieved through a deliberate adaptation of ATM elements in widely used models \u2013 any <\/a> has major banks serving a lot of clients. Of course, banks use anti-skimming techniques as a counter measure.<\/p>\n

Secondly, there are readers <\/a> by skimmers inside<\/em> ATMs through the input trays. This novelty was referenced in the recent report issued by European ATM Security Team, a non-profit organization. Even worse, some such devices do not bother to read the magnetic strip \u2014 they use ATM\u2019s own <\/a> resources to do that.<\/p>\n

\u00a0<\/p>\n

\n

This New Card Skimmer Is Almost As Thin As A Credit Card http:\/\/t.co\/rvXS3W5HVa<\/a> by @johnbiggs<\/a><\/p>\n

\u2014 TechCrunch (@TechCrunch) August 22, 2014<\/a><\/p><\/blockquote>\n