I was reading a blog post about ATM skimming and the following quote (at the end of the article) caught my eye:

Ivanov allegedly used two devices — a router to steal the bank data of customers using Wi-Fi and ...

Isn't the network connection supposed to be secure? I've always believed that HTTPS (if they use https) would prevent MITM attacks. Also, at the very least, shouldn't the data be encrypted in some way to prevent or at least slow down eavesdroppers?

  • Skimmers normally add extra hardware to the machine they are skimming from. Since this is the case they can use any protocol they wish to send the information they are stealing. – coffeethulhu May 16 '16 at 13:46
  • I do not ask about how the skimmer communicates, but how the attacker did steal the card data through the router. The skimming device described in the post consist only of a camera to steal the PINs of credit cards, but does not scan the card itself. – Svetlin Zarev May 16 '16 at 14:21
  • I would assume then that the router was either unsecured or left in a place where the hacker could gain access. If they have access to the router there is nothing keeping them from setting up some sort of proxy to strip the encryption. Also keep in mind that most ATMs run some form of windows and could therefore have malware introduced that would allow for this. – coffeethulhu May 16 '16 at 14:57
  • The original post is pretty slim on facts. I'm not sure that we can do more than speculate. – Neil Smithline May 16 '16 at 17:23

The quote is short, but I think the author is trying to say that the router wasn't about ATM skimming, and not even about the ATM itself. It was a MITM for customers who used WiFi (personal devices).

In this case, it was just a rogue AP that presented a fake certificate to users, and the users (or their poorly written apps) had to accept the fake certificate.


Sorry for posting on a super old thread. I'm the author of the referenced article. Anyone can own an ATM, so we can't really presume everything will be encrypted on the wire for all ATMs. We can assume that most major banks in the US would be smart enough to encrypt data in transit. But I wouldn't be so sure about private ATMs in gas stations and such. The skimmer I discovered was in Bali Indonesia, where the infrastructure is not quite as advanced as US. I have never tapped into the lines of an ATM to view the traffic so I do not know many details, but I do know that this is a tactic used at least according to Brian Krebs (https://krebsonsecurity.com/2016/02/skimmers-hijack-atm-network-cables/).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.