Reading a security blog I found an article about an EMV skimmer designed to be inserted into the ATM's chip card slot.
What info was this device actually capture? As far as I know there's definitely not enough info on an EMV card to perform an offline transaction (the CVV2 used by online transactions isn't even known by the chip), and EMV cards can't be copied so it's not possible for them to clone a card either.
Any ideas?
The article itself addresses this:
Banks can run a simple check to see if any card inserted into an ATM is a counterfeit magnetic stripe card that is encoded with data stolen from a chip card. But there may be some instances in which banks are doing this checking incorrectly or not at all during some periods, and experts say the thieves have figured out which ATMs will accept magnetic stripe cards that are cloned from chip cards.
“This suggests to me that the thieves plan to target an issuer where they know the CVV is not going to be checked,” said Charlie Harrow, solutions manager for global security at NCR, an ATM manufacturer.
My guess is that they're specifically capturing tag 57 (Track 2 equivalent data). As the article says, this is not the same data that's encoded on the magstripe, but it does have the same account number. If they have managed to figure out when an ATM is operating in offline mode (where it doesn't immediately check with the bank), this information is good enough to make a withdrawal - although it'll be detected as soon as the ATM goes back online and reports it.
It's very similar to "man in the middle" device. Probably they tried to copy data from old SDA only card or relied on some errors of bank they known. On the other hand, a more complex "pre-play attack" is possible.
One of the verification methods supported by chip cards is "Offline with PIN", in which the PIN is transmitted to the card, potentially in plaintext. Thus, a skimmer like this can not only read the cardholder data from the chip, but it can also intercept the PIN in that particular situation.
This is enough data to encode a new magstripe card without the magstripe CCV,and for some reason some issuers do not check this CCV. Once you've captured the user's PIN you can then use this new card and the user's PIN in a terminal which does not support chip authentication and which does not check the magstripe CCV.
What's the point? With older magstripe cards the PIN is never transmitted to the card, so skimming a user's PIN requires a magstripe skimmer in addition to a hidden camera to watch users enter their PIN numbers. This actually seems like an easier way to skim PIN numbers than the previous approach.
https://krebsonsecurity.com/2017/01/atm-shimmers-target-chip-based-cards/
https://en.wikipedia.org/wiki/EMV#Vulnerabilities
Slightly more technical references: (CTRL-F for "Offline PIN")
http://www.emv-connection.com/emv-faq/
http://tsys.com/Assets/TSYS/downloads/br_faq-on-pins-and-signature-in-the-context-of-chip.pdf
