Feeds

Teensy card skimmers found in gullets of ATMs

Hi-tech fraudsters treading more softly, but gas still yielding bang for buck

Protecting users from Firesheep and other Sidejacking attacks with SSL

A series of tiny and sometimes transparent card-skimming devices have been detected in ATMs across Europe, researchers say.

Boffins with the European ATM Security Team (EAST) have plucked out and displayed some clever thumb-sized skimmers that hide from victims' view by fitting in cash terminals' gullets.

The devices paraded in the EAST report European Fraud Update for 2014 (subscription required) were designed for NCR machines and contained pinhole spy cameras which together with the skimmer would provide felons with the magnetic stripe data and PINs required to replicate the cards.

One of the internal skimmers ditched the typical green fascade opting for a translucent colour, making it more difficult to spot.

Developers of ATM skimmers were at times ingenious in their bid to evade detection. KrebsonSecurity reported one style of skimmer that used audio waves to transmit captured card details which could then be decoded.

Use of mobile communications capabilities is also becoming more popular with skimmers, as it liberates fraudsters from the need to return to hijacked ATMs in order to retrieve fleeced cards or the data they bear.

Cruder cash claws, or cash trapping, still remained popular with thieves who inserted the devices to jam cash dispensers so that money can be picked up later.

The report reflected findings gathered at a meeting at the European Cybercrime Centre (EC3) in the Hague last month. The mini-skimmers were reported in one unnamed European country while others said skimmers were being left in ATMs for longer, between four to five days on average.

Chip and PIN credit cards were deployed in most G20 countries including Australia and the UK which made skimming more complex and expensive for fraudsters. However ATMs still supported outdated and vulnerable magnetic stripe reader cards due to slow adoption in the US where losses were highest, according to the report.

Eight countries reported attacks against unattended payment terminals at petrol stations and six had attacks targeting point-of-sale devices. Fraudsters had even removed ATMs returning it only after modifying the machine.

Brutish ram raids and ATM burglary were down in 10 countries with three large gangs busted by law enforcement. Explosive attacks however were on the rise with eight countries reporting the use of gas attacks and two having cash machines blown up with solid explosives.

The EC3 played a role in four large cross-border busts on criminal fraud gangs targeting online transactions, airlines, ATMs and document fraud. "In many cases the criminals transferred stolen funds to unregistered pre-paid cards for cash withdrawal at ATMs," the organisation said. ®

The next step in data security

More from The Register

next story
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
'Speargun' program is fantasy, says cable operator
We just might notice if you cut our cables
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
Greater dev access to iOS 8 will put us AT RISK from HACKERS
Knocking holes in Apple's walled garden could backfire, says securo-chap
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.