Support NeoGAF

[Diprosalic]

i always cover the buttons with both of my hands, my right hand covering all the numbers and then press them all at once and then i press delete and then i press my buttons (still my whole hand on top) by moving my hand slightly. not that i'm afraid someone gonna steel my money i just like to use a good method.

 

[marrec]

Hundreds of people use ATMs in the run of a day. The article very specifically says it's not urgent to get every PIN, just enough of them to be profitable. Are you really saying that 60+ cards skimmed with PINs per day per ATM would not be a profitable venture for launderers.

Wait, why would someone typing in a withdrawal amount make them fucked?

I assumed if someone typed in a withdrawal amount it would make it harder to determine the original PIN number, especially if the withdrawal amount used the same numbers as the PIN number.

In an ideal criminal world where all of this is automated and you can get a 60% success rate on this every time the margins are great and you have no problems. But that is a very narrow criminal world where each transaction gives you the information that you need. 60% leads very quickly to way less than that.

I'm not saying it can't happen, just saying that is isn't very practicle when compared to other methods used. Okay, more what I'm trying to say is that I'm not going to be fearing a thermal camera poking out of the pamphlet holder at my local PNC bank as much as the Cogos employee across the street.

Edit:
No offense to Cogos employees, but that's a shady store.

 

[Indrid Cold1]

Whats with you guys taking upwards of 1-2 minutes at the cash machine... Nothing worse than being stuck behind some ass who is taking that long you would swear they are using the cashie to balance the national budget, only to see them walk away clutching their card and a paltry tenner.

 

[JGS]

This is only relevant if they physically have your card. There's not much point in stealing PIN's unless you have access to the card unless you also have fancy gadgetry to work with. It's better just to swipe the card and use it for credit, then sell merchandise to local crooked pawn shop. There is a much higher dollar limit and much lower risk.

The primary downside is PIN based fraud is very tricky to verify so provisional credit is much tougher to get.

EDIT: Even if paranoia kicks in, it looks like you just go to the ones with metal buttons.

 

[marrec]

I'm really not trying to poo-poo the reaserch or the need to be careful, but this vector of attack would account for a very small precentage of actual attacks even if it were being used in the wild.

Also, you can just use your 3DS stylus to depress the buttons. TAKE THAT CRIMINALS.

 

[Stumpokapow]

I assumed if someone typed in a withdrawal amount it would make it harder to determine the original Pin number, especially if the withdrawal amount used the same numbers as the Pin number.

In an ideal criminal world where all of this is automated and you can get a 60% success rate on this every time the margins are great and you have no problems. But that is a very narrow criminal world where each transaction gives you the information that you need. 60% leads very quickly to way less than that.

I'm not saying it can't happen, just saying that is isn't very practicle when compared to other methods used. Okay, more what I'm trying to say is that I'm not going to be fearing a thermal camera poking out of the pamphlet holder at my local PNC bank as much as the Cogos employee across the street.

The Cogos employee across the street can also use this technique. As I pointed out to you already, the article also proposes using it to steal gate/door combinations.

And again, this article describes the process of automating the attack. And again, the article purposefully handicaps their own success rate in order to prove their point; their real-world success rate would almost certainly be much higher.

I'm really not trying to poo-poo the reaserch or the need to be careful, but this vector of attack would account for a very small precentage of actual attacks even if it were being used in the wild.

yes or no: card skimmers exist and are a major vector of debit fraud. whether those skimmers are on an ATM or at a convenience store or a guy comes to your door and sells you a whoopee cushion and uses a skimmer.

yes or no: without using this technique, card skimmers still need to steal your PIN and generally use a conventional camera and manual verification (guy outside in card wirelessly connected to camera feed, for example, or stored video feeds that are processed later) to do so.

the answers are yes and yes.

now, what do you think this article's conclusion suggests? the answer:

Spoiler

this is a strictly superior technique to using a conventional camera, because it allows for PIN theft both during and after entry. it is better than the technique they already have, they're already using, and that is already a major fraud scheme.

This is only relevant if they physically have your card. There's not much point in stealing PIN's unless you have access to the card unless you also have fancy gadgetry to work with.

that's the point of the article. you use the thermal camera to get the pin. you use a skimmer to get the card.

 

[Battersea Power Station]

If you can get my card number AND my PIN, more power to you. I'll spend the 10 minutes on the phone with the bank to report it and get my money back with absolutely no consequences to me. You deserve it.

 

[Stumpokapow]

If you can get my card number AND my PIN, more power to you. I'll spend the 10 minutes on the phone with the bank to report it and get my money back with absolutely no consequences to me. You deserve it.

I assume you're in the US. Credit card liability is limited to $50 and generally 0. Debit card liability is limited to $50 if you report within 2 days, $500 if you report within 60, and unlimited if you miss it for two months. Your bank may choose to cap your debit card liability beyond this, but they are not obligated to do so.

if someone steals your debit card today using an attack like this, when do you think you'd figure out they've stolen it?

 

[Meier]

Does it even matter? Don't you need access to that person's card?

Unfortunately no. They are very easy to counterfeit I'm guessing because I somehow had someone withdraw over $2k from my checking account over a 9 day period in a different state (thanks credit union for being on top of things...VISA actually stopped the account before they did) all while my card was in my wallet.

I use an ATM maybe 3-5 times a year now and never use my debit card. I was able to get my money back but it took over 2 months and I had to file a police report.

 

[Lostconfused]

Actually I am an idiot. Why is this specificaly an issue for ATMs and not interac machines? Besides ease of access and volume of traffic.

 

[Battersea Power Station]

I assume you're in the US. Credit card liability is limited to $50 and generally 0. Debit card liability is limited to $50 if you report within 2 days, $500 if you report within 60, and unlimited if you miss it for two months. Your bank may choose to cap your debit card liability beyond this, but they are not obligated to do so.

if someone steals your debit card today using an attack like this, when do you think you'd figure out they've stolen it?

I'm not gonna read the article you linked to at the moment since I'm walking to work.

A year ago I had some fraudulent charges on my card adding up to about $460. They said it was physically swiped at a couple of Target stores. I don't know how it happened -- maybe an employee there got the number and emulated a swipe?

I caught it 2 weeks later and they reversed it all without any problems or hang-ups. And my experience isn't atypical, based on friends' similar incidents.

 

[JGS]

that's the point of the article. you use the thermal camera to get the pin. you use a skimmer to get the card.

I know & I realize there is a risk involved in it happening. Every crook has they favortie method or particular opportunity. I'm just saying that skimming is an effective form a theft without the need for a PIN. That's why signature based transactions are far more common.

ATM's dispense no more than 400 at a time in a 24 hour period unless you are special. Skimming for use as a credit card nets between 2500-3000 a day. Selling product at half that (Plus paying for gas in the getaway car) amount leads to a bigger haul in one day.

Plus you can have a dozen cards on you at one time if you're a professional skimmer meaning 10's of thousands of dollars. PIN theft is small potatoes in comparison and harder to accomplish.

I understand this would be more lucrative in bigger cities than where I live, but the only PIN based fraud I've encountered always involved someone who knows the victim and had access to the card.

 

[i_am_ben]

What if you have fat fingers?

http://www.youtube.com/watch?v=8DtbPOXFk00

 

[GodofWine]

If paranoia is strong, just hit some extra buttons as you walk away...

 

[Woody Invincible]

My PIN is 3814

Come at me bro!

 

[Escape Goat]

My Pin is 1234

 

[marrec]

yes or no: card skimmers exist and are a major vector of debit fraud. whether those skimmers are on an ATM or at a convenience store or a guy comes to your door and sells you a whoopee cushion and uses a skimmer.

yes or no: without using this technique, card skimmers still need to steal your PIN and generally use a conventional camera and manual verification (guy outside in card wirelessly connected to camera feed, for example, or stored video feeds that are processed later) to do so.

the answers are yes and yes.

now, what do you think this article's conclusion suggests? the answer:

Spoiler

this is a strictly superior technique to using a conventional camera, because it allows for PIN theft both during and after entry. it is better than the technique they already have, they're already using, and that is already a major fraud scheme.

Current techniques can be automated the same way the thermal technique can be. In my opinion the one thing the Thermal technique gives you is a way to catch the crafty fellows who cover up their pin entering. So you now have a time of up to 60 seconds to capture the PIN number instead of doing it while it's happening. But the capture isn't 100% yes or no because of the nature of the thermal transfer. The camera is expensive and the software hasn't even been built yet.

So yes, its possible and given the proper set up theoretically captures more information than current techniques.

 

[Stumpokapow]

I understand this would be more lucrative in bigger cities than where I live, but the only PIN based fraud I've encountered always involved someone who knows the victim and had access to the card.

I live in a city with ~100,000 people, an exceptionally low crime rate (province with lowest crime rate per capita in Canada, a country that has a significantly lower crime rate per capita than the US), and debit skimming occurs here.

Moreover, as credit cards do move towards chips (all three of mine have them as of this year) and CVV2 or signature based transactions are phased out over the next few years, this attack will rise in prominence.

*shrugs*

The camera is expensive and the software hasn't even been built yet.

In order, no it's not (the price is listed in the article and is not expensive), and yes it has--by the article's authors, in a trivially short amount of time with no prior experience with thermal cameras

 

[JGS]

I live in a city with ~100,000 people, an exceptionally low crime rate (province with lowest crime rate per capita in Canada, a country that has a significantly lower crime rate per capita than the US), and debit skimming occurs here.

Moreover, as credit cards do move towards chips (all three of mine have them as of this year) and CVV2 or signature based transactions are phased out over the next few years, this attack will rise in prominence.

*shrugs*



In order, no it's not (the price is listed in the article and is not expensive), and yes it has--by the article's authors, in a trivially short amount of time with no prior experience with thermal cameras

It's probably different everywhere depending on the flavor which I keep forgetting. We get fraud constantly (Lexington is off a major highway and the fraud runs from Florida to Chicago) and it's near 100% signature based or check forgeries. Again, it's nicer because it's much clearer. Debit skimming is so infrequent as not to be trusted lol.

 

[marrec]

In order, no it's not (the price is listed in the article and is not expensive), and yes it has--by the article's authors, in a trivially short amount of time with no prior experience with thermal cameras

Expense is relative I suppose, but on the low end you're looking at 1700 dollars for a cheapo camera. Not to mention the size of it... is there an example set up in the PDF?

I realized as soon as I hit Reply that the articles authors built a program, what I mean to say was that the program hasn't been built yet in the wild and given the variations with which someone types in their PIN number I believe the success rate would be lower, not higher as you claim, then in their testing.

I live in a city with ~100,000 people, an exceptionally low crime rate (province with lowest crime rate per capita in Canada, a country that has a significantly lower crime rate per capita than the US), and debit skimming occurs here.

Moreover, as credit cards do move towards chips (all three of mine have them as of this year) and CVV2 or signature based transactions are phased out over the next few years, this attack will rise in prominence.

This I can agree with.

 

[Stumpokapow]

I realized as soon as I hit Reply that the articles authors built a program, what I mean to say was that the program hasn't been built yet in the wild

They used this software as a starting point. So, yes, there is a program in the wild.

and given the variations with which someone types in their PIN I believe the success rate would be lower, not higher as you claim, then in their testing.

"Next, we considered the role of individual differences between people using the keypads, such as variations in body heat and keypress “technique.”"

"As mentioned in the introduction, we found in earlier trials that people reacted with the keypad in very different ways: some had a light touch while others were almost forceful in pressing the keys; similarly, some people were very warm-blooded while others transferred barely any heat to the keypad. We therefore chose to use such a wide variety of testers as a way of eliminating any of these potential human biases"

so they already thought of this--again, I'm just going to say, is it really likely that the research team have not considered the very basic five second reactions lay posters on GAF are having to a three paragraph Gizmodo summary of their attack?

The reason why I feel that their success rate would be higher than is reported in the article is because they point out that their success rate would be higher than is reported in the article:

" we treat each run as if the user properly shielded his code entry from view, thus
embodying the advantages of thermal camera-based attacks (as we simply ignore any footage taken during the code entry itself)"

So their success rate is 50-80% assuming conventional during-the-PIN-entry methods fail.

 

[The Lamonster]

I press with my knuckle. Probably less heat transfer that way. I do it because of germs though :|

 

[Jme]

What's your debit card's PIN? After all, none of us will ever have access to your card.

1337

 

[criesofthepast]

We have those newer microchipped ATM cards in Canada now. Have those even been cracked yet?

 

[sixteen-bit]

I'm terrified of using ATMs

 

[marrec]

They used this software as a starting point. So, yes, there is a program in the wild.

"Next, we considered the role of individual differences between people using the keypads, such as variations in body heat and keypress “technique.”"

"As mentioned in the introduction, we found in earlier trials that people reacted with the keypad in very different ways: some had a light touch while others were almost forceful in pressing the keys; similarly, some people were very warm-blooded while others transferred barely any heat to the keypad. We therefore chose to use such a wide variety of testers as a way of eliminating any of these potential human biases"

so they already thought of this--again, I'm just going to say, is it really likely that the research team have not considered the very basic five second reactions lay posters on GAF are having to a three paragraph Gizmodo summary of their attack?

The reason why I feel that their success rate would be higher than is reported in the article is because they point out that their success rate would be higher than is reported in the article:

" we treat each run as if the user properly shielded his code entry from view, thus
embodying the advantages of thermal camera-based attacks (as we simply ignore any footage taken during the code entry itself)"

So their success rate is 50-80% assuming conventional during-the-PIN-entry methods fail.

Again, I cannot access the PDF so thanks for bringing up those points. It sounds like their testing tried to insert as much of the human element as possible into it. There are still two reasons I have left to continue aruging the point.

I'm quoting from the Naked Security article here so forgive me if this is address elsewhere, but...

The researchers gathered 21 volunteers and had them test 27 randomly selected PIN numbers using both a plastic PIN pad and a brushed metal PIN pad.

That is not really a large volume of test results. It's a great place to start and to show that there is probably something worth figureing out here, but a sample size of 21 is very small.

Secondly, I really want to see the set up that they used, the size of the camera and the make and model of the camera. Are the pictures posted earlier in the thread relavant? Sure, both of my points are not calling into question the testing procedure, but when you have a study saying there is a 60-80% success rate of grabbing your PIN number after 15-45 seconds then I think it's reasonable to question it as much as possible.

Also, whats wrong with lay GAF-men?

Let me rephrase, Whats wrong with lay GAF-man questioning an article written based on a PDF showing that under lab experiments of 21 people entering PIN numbers, their setup could capture 60-80% of the numbers? Maybe it's because I'm an engineer (electrical engineer), but those numbers wouldn't get me to development of a project. These criminals work in vast quantities... like Wal-Mart! So 60-80% in a perfect world might translate to 30-50% in the real world which would probably still meet their profit goals.

 

[Stumpokapow]

That is not really a large volume of test results. It's a great place to start and to show that there is probably something worth figureing out here, but a sample size of 21 is very small.

If you say so. They say they isolated for the variety of techniques used to enter PINs. I yield that it's possible that they're lying, they didn't isolate, and that those 21 people all enter PINs identically, and everyone else on earth uses a secret strategy that their technique doesn't work for.

But again your initial reaction that you're now defending was made sight unseen, so I think your response is more "This is a plausible way that I could still not be totally wrong" rather than "This is what I sincerely believe to be a methodological error with the study".

Secondly, I really want to see the set up that they used, the size of the camera and the make and model of the camera.

Make and model are posted in the PDF, as well as cost. The size is not described, although you can feel free to look it up, and I don't think "I'd notice the camera" is a very good defence given the rapid iteration of skimming scams including virtually undetectable ones as posted above in the thread and given that skimming cameras are already used and given that banks already have security cameras so the presence of an additional camera, even in plain site, would not necessarily trigger suspicion fast enough.

Where they placed the camera is also mentioned, and they do a limited amount of analysis to suggest that the camera's distance from the PINpad does not significantly impede the results (they doubled the distance with no loss of precision). But in the gate-crashing example, they also speculate about portable non-permanent devices and other applications of the technique, so it's a bit moot.

Are the pictures posted earlier in the thread relavant?

The right image in the OP is from the survey. Nothing else in the thread relates to the survey.

but when you have a study saying there is a 60-80% success rate of grabbing your PIN number after 15-45 seconds then I think it's reasonable to question it as much as possible.

I would say that launching a ton of separate objections to a study, most of which are addressed in the study, without having read the study, is not reasonable.

Your objections so far:
1) Not fast enough <-- and yet it is, even when they kneecap it in the survey, and they address it.
2) 50-80% accuracy is not good enough <-- and yet it is, given that you're trying to steal as many accounts as possible rather than one account with 100% accuracy, and they address it.
3) Thermal cameras are too expensive <-- and yet they're not, and they provide the price in the survey.
4) For this to work they'd need an automated program <-- they have one, which they provide in the survey
5) Yeah, but the average criminal doesn't have one <-- they easily could, which they deal with in the survey and in fact cause in the survey but explicitly describing their techniques.
6) There are varying techniques for entering PINs <-- they deal with this in the survey
7) Debit fraud is too much work, credit fraud is easier <-- and yet debit fraud still exists and this technique is a strict improvement on existing techniques.
8) I'm more worried about employees using skimmers <-- employees can just as easily do this.
9) Debit fraud isn't worth enough to make it economically viable <-- " In large-scale attacks involving many unique codes, such as on ATM PINs, our success rate indicates that an adversary can correctly recover enough codes to make such an attack economically viable"
10) Their sample size isn't large enough

I mean, is there some point where you're eventually going to say "Maybe I was a little premature, and maybe now I'm just trying to rationalize my initial reaction"?

Let me rephrase, Whats wrong with lay GAF-man questioning an article written based on a PDF showing that under lab experiments of 21 people entering PIN numbers, their setup could capture 60-80% of the numbers? Maybe it's because I'm an engineer (electrical engineer), but those numbers wouldn't get me to development of a project. These criminals work in vast quantities... like Wal-Mart! So 60-80% in a perfect world might translate to 30-50% in the real world which would probably still meet their profit goals.

1) Almost all of what you just included was information you found out after I called you out for having clearly not read the article, 2) I see you've settled on the sample size argument, 3) their study is not the perfect world and I've already provided you with the major specific way in which they handicap their own results which you've chosen to, I guess, ignore, 4) and you even yield the point that it's probably profitable in the end.

 

[CrankyJay]

Just carry a pencil around and put in your number with an eraser. Problem solved.

 

[marrec]

Sorry for the delay in the crow feast, had to do some testing. Thermal testing, What!

Maybe I was a little premature, and maybe now I'm just trying to rationalize my initial reaction.

No really, I recant. Given the information you've provided (and I have not tried to hide the fact that I cannot access the original PDF) it seems that thermal cameras are a viable vector in getting a PIN number from someone. I've never tried to say that the research wasn't valuable or interesting. I've only tried to say that it is unlikely we will see criminals using Thermal cameras to steal PIN numbers.

Yes, I lost the thread of my original point somehwere along my second post.

Yes, you are correct in pointing out that the researchers know more about the subject than me. (Although I am very familier with thermal imaging and software used to analyze it.) And have taken into account everything I have brought up.

This isn't me moving the goal-post now. I concede.

Edit:

But! Just like with any testing, I'd love to see more results so that we can analyze a larger group before definatively saying that yes, Thermal Cameras are the next big thing.

I egarly await our new thermal imaging overlords.

 

[Jamesfrom818]

I press all the buttons before I leave an ATM.

 

[milanbaros]

ITS JUST PIN NOT PIN NUMBER FFS!! GRR GRR

 

[milanbaros]

Use the thermal camera within 60 seconds to have a 50% chance of getting it right.



At 90 seconds they can pretty reliably capture 3 of your 4 digits according to their article, which in a 3-fail-lock system gives them a 30% chance of getting your PIN.

Does it tell you what order you pressed the 3 digits?

 

[marrec]

ITS JUST PIN NOT PIN NUMBER FFS!! GRR GRR

I'm going to go back and edit all my previous posts to include Number after PIN just to make you more angry.

 

[StudioTan]

Isn't saying PIN Numbers redundant

I'm always careful entering my PIN number when using the ATM machine.

 

[Stumpokapow]

I egarly await our new thermal imaging overlords.

Honestly, eventually they'll switch to some exponentially more complex authentication protocol (for example, biometric thumbprinting in lieu of PINs, or both, or two-factor authentication) at which case debit/credit fraud becomes a strict subset of mugging / armed robbery, right?

Does it tell you what order you pressed the 3 digits?

Yes, the premise of the article is that more recent heat signatures look visually distinct from less recent heat signatures. There is some margin for error and the article's statistics allow for limited subsets of transposition.

 

[Ashes]

ITS JUST PIN NOT PIN NUMBER FFS!! GRR GRR

Pin Number.

 

[mt1200]

So thats why almost everyone presses random keys when they finish their ATM transaction

 

[marrec]

Honestly, eventually they'll switch to some exponentially more complex authentication protocol (for example, biometric thumbprinting in lieu of PINs, or both, or two-factor authentication) at which case debit/credit fraud becomes a strict subset of mugging / armed robbery, right?

Those poor criminals have no chance of keeping up with current technological advances in security.

 

[Aeonin]

Well then we better post these findings to the internet ASAP to make sure this information doesn't get into the wrong hands.

OMG. Made me bust out laughing - its exactly what I was thinking.

 

[equap]

gizmodo is best at scaring dumb internet users.

why would you use your finger to enter the pin anyway? how many dirty hands touch that pad in a day??

 

[gcubed]

instead of pushing a button for the money you want to get out, hit other, and type in the money manually. Problem solved, criminals foiled

 

[AbsoluteZero]

Yet another I reason I don't use debit cards or ATMs.

 

[mt1200]

gizmodo is best at scaring dumb internet users.

why would you use your finger to enter the pin anyway? how many dirty hands touch that pad in a day??

do you use gloves or a stick?.

Well, yes, thousands of peoples touches an ATM every day, but remember that they will record them with a camera.

 

[Evlar]

So this must be what those people are doing when they take 5 minutes to conduct a simple ATM transaction: Waiting for the thermal signature to dissipate. Smart.

 

[gcubed]

So this must be what those people are doing when they take 5 minutes to conduct a simple ATM transaction: Waiting for the thermal signature to dissipate. Smart.

this is one of those times slow ass inefficient people benefit

 

[Rapstah]

this is one of those times slow ass inefficient people benefit

Because the camera only works when no one's there or what?

 

[shaowebb]

Won't they still need to have your card?

 

[Particle Physicist]

.

 

[SUPREME1]

I actually touch multiple numbers, just not quite as hard. Lol.

Me too, lol.

I guess once my transaction is finished I'll simply hit all the buttons once over.

Thermal cams, come at me bros.

 

[Speedymanic]

What about the new chip machines/cards?

Sure they can clone a card, but surely they'll hit a brick wall when it comes to the chip.