4

Reading a security blog I found an article about an EMV skimmer designed to be inserted into the ATM's chip card slot.

EMV skimmer

What info was this device actually capture? As far as I know there's definitely not enough info on an EMV card to perform an offline transaction (the CVV2 used by online transactions isn't even known by the chip), and EMV cards can't be copied so it's not possible for them to clone a card either.

Any ideas?

  • I believe the EMV chip contains the track 1 and 2 data, so it could read cardholder name, PAN and expiry dates. probably enough to encode the mag strips on a clone card. – iainpb Jun 8 '17 at 15:15
4

The article itself addresses this:

Banks can run a simple check to see if any card inserted into an ATM is a counterfeit magnetic stripe card that is encoded with data stolen from a chip card. But there may be some instances in which banks are doing this checking incorrectly or not at all during some periods, and experts say the thieves have figured out which ATMs will accept magnetic stripe cards that are cloned from chip cards.

“This suggests to me that the thieves plan to target an issuer where they know the CVV is not going to be checked,” said Charlie Harrow, solutions manager for global security at NCR, an ATM manufacturer.

My guess is that they're specifically capturing tag 57 (Track 2 equivalent data). As the article says, this is not the same data that's encoded on the magstripe, but it does have the same account number. If they have managed to figure out when an ATM is operating in offline mode (where it doesn't immediately check with the bank), this information is good enough to make a withdrawal - although it'll be detected as soon as the ATM goes back online and reports it.

0

It's very similar to "man in the middle" device. Probably they tried to copy data from old SDA only card or relied on some errors of bank they known. On the other hand, a more complex "pre-play attack" is possible.

http://ieeexplore.ieee.org/document/6956556/?reload=true

-2

One of the verification methods supported by chip cards is "Offline with PIN", in which the PIN is transmitted to the card, potentially in plaintext. Thus, a skimmer like this can not only read the cardholder data from the chip, but it can also intercept the PIN in that particular situation.

This is enough data to encode a new magstripe card without the magstripe CCV,and for some reason some issuers do not check this CCV. Once you've captured the user's PIN you can then use this new card and the user's PIN in a terminal which does not support chip authentication and which does not check the magstripe CCV.

What's the point? With older magstripe cards the PIN is never transmitted to the card, so skimming a user's PIN requires a magstripe skimmer in addition to a hidden camera to watch users enter their PIN numbers. This actually seems like an easier way to skim PIN numbers than the previous approach.

https://krebsonsecurity.com/2017/01/atm-shimmers-target-chip-based-cards/

https://en.wikipedia.org/wiki/EMV#Vulnerabilities

Slightly more technical references: (CTRL-F for "Offline PIN")

http://www.emv-connection.com/emv-faq/

http://tsys.com/Assets/TSYS/downloads/br_faq-on-pins-and-signature-in-the-context-of-chip.pdf

  • 2
    As far as I know ATM uses Online Pin only. – Alexander Vgn Jun 9 '17 at 9:10
  • The Track 2 data stored in the chip is different from that which gets encoded on the magstripe. So you can't make a swipeable clone from chip data. – Bobson Jun 9 '17 at 11:27
  • @Bobson There is enough data to create a swipeable clone, especially in the presence of other software flaws that allow you to circumvent security features. krebsonsecurity.com/2017/01/… – David Jun 9 '17 at 15:59
  • No sane security will transfer PIN over the card. – mootmoot Jun 9 '17 at 16:23
  • @David - From the article you linked: "The only way for this attack to be successful is if a [bank card] issuer neglects to check the CVV when authorizing a transaction," which is something outside the control of the attacker. So the clone will only work against a bank that allows itself to be hacked, or in an offline scenario... and in the latter, it doesn't matter whether the track data is valid to begin with. – Bobson Jun 9 '17 at 16:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.