10

I have come across an article which states the following:

According to MWR InfoSecurity, cybercriminals can use fake cards containing a software code to gain access not only to a customer's PIN and primary account numbers shown on the front of a plastic card, but also to the merchant's IT network. Sophisticated attackers may even be able to gain access to PIN pad terminals without the terminal owner being aware that their security systems have been breached.

This can be done very simply. For example, a customer in a restaurant can pretend to make their payment using a Trojan card which allows them to gain access to the payment terminal. All PIN numbers and other cardholder information that passes through the terminal from that point onwards are then captured by the fraudulent card user using existing communication channels (e.g. WiFi, Bluetooth or a mobile cellular network). Alternatively, these criminals can simply return and re-insert the smart card to collect the recorded data from the payment device.

I am struggling to understand the authenticity of this. Can anybody shed some light on the possibility (or plausibility) of this as well as how a hacker would go about performing this type of attack? I don't imagine this is quite as trivial as they make it sound.

Update:

I think it's important to note the following research performed by Lucas Kauffman:

http://security.blogoverflow.com/2012/08/exploiting-atms-a-quick-overview-of-recent-hacks/

Community
  • 1
Kyle Rosendo
  • 3,965
  • 4
  • 18
  • 17
  • It doesn't sound trivial, but that doesn't make it impossible though. I'm just curious how this would work. – Lucas Kauffman Jul 21 '12 at 19:41
  • Does it mean that by using key on the card and the key on the intercepted connection, can make pos device execute the code? Is this correct? Is it like inserting smart card with a self-signed cert and requesting pirate URL with the same cert, and then while being authorized, the code is run? – Andrew Smith Jul 22 '12 at 17:35

1 Answers1

9

The backdoor that you are describing can be installed if you have code execution on the ATM. This research, as well as methods of obtaining code execution on an ATM where pioneered by Barnaby Jack and are detailed in his BlackHat (and defcon) 2010 Jackpotting ATMs talk.

rook
  • 46,916
  • 10
  • 92
  • 181