Schneier on Security

Seiran • September 28, 2011 11:41 AM

Many ATM manufacturers, stores and financial institutions have implemented features that have been highly successful in deterring card skimming. The natural progression is to see these more widely used, and eventually standard.

I think I’ve said before that I am very partial to NCR’s ATMs. The card readers have a very distinct shape that would make designing a plausible skimmer very challenging. Both the dip and motorized reader have a transparent body illuminated by a pulsing backlight. The motorized reader also has a lenticular hologram (a “smiley lock”) and implements jitter. The ATM can owner can choose to have a video demonstrating usage of the card reader displayed on the idle screen.

There are also some sensors (electrostatic proximity?) that ATM owners can purchase as an option which purport to detect foreign object attachment.

Since security seals were mentioned:

Sam’s Club also has a blue sticker on their fuel pumps similar in size to the red sticker from Shell that someone linked to here. They put it over a keyhole. The sticker has a releasing layer that reveals “void” if it is peeled up normally; these are used on many aircraft to seal the lavatory smoke detectors.

The problem with using seals to reassure the general public is that people don’t notice if they’re completely missing, and won’t miss them even if they have seen them before. If told to look for a seal, users also do not remember what the seals look like and how to authenticate them, if authentication is possible at all. The fuel pump and aircraft lavatory stickers are fairly tamper resistant, but can be forged with some paper having the right texture with the result that no tampering is obvious until someone tries to remove the sticker and notices that the void message doesn’t activate.

I don’t trust these stickers to protect my credit card all by themselves. Fortunately in the country I live in, the United States, skimming is rare and zero-liability fraud protection for consumer credit products is standard.

What is likely to be a more effective indicator is a tamper button is held down by the service door, since a tamper alarm can respond very quickly and disable the pump to prevent skimming and fuel theft – much more common than skimming.

Inside the stores, Costco Wholesale has both a locking swivel dock for their MX readers and a tamper detect sticker (a generic 1″ rayburst hologram with the Costco logo and a serial number printed in black) on the reader itself. It faces the cash register side so clearly, the cashiers know it’s there.

Look under the colo(u)r Verifone terminals used by many stores here, and you’ll see a white frangible sticker with silver accent placed over the screw hole by Verifone. It may serve to reveal malicious tampering, or merely a warranty seal since most card readers are in sonically sealed plastic shells. Later PCI-compliant readers zeroize the master key when it’s opened, and I would presume the POS will not recognize it anymore when this has happened.

It may be worth noting that Michaels craft stores, which suffered from a customer payment card/PIN breach resulting from a doppelganger terminal attack, did not have any security seals or locking mechanisms in place. They also use very old Everest readers that just might not be as tamper-resistant as newer models.