Re: RFID Flap Silences Security Researchers

["Robert Green" <ROBERT_GREEN1963@xxxxxxxxx>]

"Petem" <petem001@xxxxxxxxx> wrote in message
news:fh2Mh.42494$Zb.922463@xxxxxxxxxxxxxxxxxxxxxx
>
> "Robert L Bass" <no-sales-spam@bassburglaralarms> a écrit dans le message
de
> news: E7idnTifRPewoJ3bnZ2dnUVZ_ruknZ2d@xxxxxxxxxxxxxx
> > Skimming devices have one flaw that so far
> > makes them useless for RFID scanning.
> > They don't interface with the real reader.
> > Therefor the person who inserts a card into
> > the false front does not get any money out
> > of the ATM.
>
> False both the skimmer and normal reader see the card..

Precisely.  The card's magnetic stripe passes through 2 heads, not one.  The
second reading head is contained in the false shroud and "skims" the data
from the card. Perhaps that's why they are called skimmers!  (-:  Here's a
more detailed description of the well-known scam as practiced in Scotland:

http://news.scotsman.com/scotland.cfm?id=810802006

<<A GANG who targeted bank customers with a card-cloning scam were caught
out when a sharp-eyed engineer discovered their "skimming" device on a
faulty
cash machine.  The device was fixed to the front of the Royal Bank of
Scotland ATM outside the Tesco supermarket at Ferrymuir on the outskirts of
South Queensferry.

Detectives from the Specialist Fraud Unit are investigating possible links
with Eastern European *crime gangs known* to have carried out similar frauds
*across the UK.* Two men and a woman seen in a Peugeot 206 are being hunted
after they were spotted loitering around the machine on different occasions.
Customers who used the machine between 10.30pm on Friday and 5pm on Saturday
had their card details read by the device. A tiny camera aimed at the keypad
also recorded customers entering their secret PIN numbers.>>

*Emphasis mine

> > If applied to an RFID access
> > control reader the person using a card
> > would not get in to work.
>
> false again what in god name can prevent an RF receiver of receiving a
> signal sent by the RFID device,if close enough...and the device
triggered,it
> will recieve the data,and like in any RF system the data will be received
by
> the legitimate receiver too,RF is not sucked up by the skimmer receiver..

Exactly right, once again.  The same technique of a second reader concealed
in the same type of shroud would produce the same results.  The skimmer gets
a copy of any data the legit reader gets.

> > This would result in a
> > slew of complaints from valid users that
> > they can't open the door.  This in turn would
> > result in someone checking and discovering
> > the device.  Any RFID cards "skimmed"
> > would be taken out of service right away.
>
> wrong again...you dont seem to grasp the whole concept here...

Obviously.  The shroud sits there and extracts the stripe data on the card
before it slides past and into the real reader and the little pinhole
videocam gets the PIN.  The machine works *completely* normally, handing out
money and receipts, accepting deposits and giving out bank balances.  The
crooks want the account numbers and PINS, not the cash.  Not that way,
anyway.  The information is typically used to make large purchases, since
ATM have such low daily cash limits.

Other variations have included a skimming keyboard that is designed to pass
the keystrokes to the real keypad below while recording them for the
skimmer.  The cameras apparently superceded the readers because they were
able to provide much more information about the customers than a simple
series of keystrokes did.  There are even low tech variations I won't
discuss here that allow crooks to capture the PIN and the card itself rather
easily, making the user think the machine ate the card, which they retrieve
after the customer gives up and leaves the ATM.

--
Bobby G.