Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have come across an article which states the following:

According to MWR InfoSecurity, cybercriminals can use fake cards containing a software code to gain access not only to a customer's PIN and primary account numbers shown on the front of a plastic card, but also to the merchant's IT network. Sophisticated attackers may even be able to gain access to PIN pad terminals without the terminal owner being aware that their security systems have been breached.

This can be done very simply. For example, a customer in a restaurant can pretend to make their payment using a Trojan card which allows them to gain access to the payment terminal. All PIN numbers and other cardholder information that passes through the terminal from that point onwards are then captured by the fraudulent card user using existing communication channels (e.g. WiFi, Bluetooth or a mobile cellular network). Alternatively, these criminals can simply return and re-insert the smart card to collect the recorded data from the payment device.

I am struggling to understand the authenticity of this. Can anybody shed some light on the possibility (or plausibility) of this as well as how a hacker would go about performing this type of attack? I don't imagine this is quite as trivial as they make it sound.


I think it's important to note the following research performed by Lucas Kauffman:

share|improve this question
It doesn't sound trivial, but that doesn't make it impossible though. I'm just curious how this would work. – Lucas Kauffman Jul 21 '12 at 19:41
Does it mean that by using key on the card and the key on the intercepted connection, can make pos device execute the code? Is this correct? Is it like inserting smart card with a self-signed cert and requesting pirate URL with the same cert, and then while being authorized, the code is run? – Andrew Smith Jul 22 '12 at 17:35
up vote 9 down vote accepted

The backdoor that you are describing can be installed if you have code execution on the ATM. This research, as well as methods of obtaining code execution on an ATM where pioneered by Barnaby Jack and are detailed in his BlackHat (and defcon) 2010 Jackpotting ATMs talk.

share|improve this answer
Really interesting video. – Lucas Kauffman Jul 21 '12 at 19:55
+1 just for that video. – Terry Chia Jul 22 '12 at 1:02
Lucky number 7... JACKPOT! – Polynomial Jul 23 '12 at 10:16

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.