Schneier on Security

Clive Robinson • December 10, 2012 8:32 AM

@ Bruce,

I have no idea if this is real

The electronics in a MagStripe skimmer are releativly cheap you only need a “barber pole” MR sensor and a trivial op-amp CCTV to generate a waveform you could put into a PIC or similer microcontroler.

However you can by from a Company called Swann in Australia a 2.4GHz micro CCTV camera (either colour or low light / near IR) for less than 50USD which also has a sound channel.

So rather than use an OP-Amp circuit with MR sensor use something like an NE555 timer in an audiio oscillator mode where the frequency is controled by the resistance of the MR sensor and just put that into the 2.4GHz camera audio input.

That takes care of the ATM end electronics at the other end you use a 2.4GHz video receiver one of which comes withthe camera in the 50USD price. You then need some kind of solid state video recorder which you can pick up for 100USD with a good record time (some SD cards are doing upwards of an hour/GByte for nearly static video image.

However the electronics is the easy bit, the hard bit is making the appropriate realistic case and squeasing batteries with sufficient capacity into it.

Now there are a number of ways you can do this, one is to use “dental impression” gum (used for making “moulds” for crowns and dentures) which you can buy in most arts and crafts shops to make a cast in five or ten minutes tops. Making either drawings or another mold is then fairly trivial for somebody with “modelling” skills for “model railways OO/OH/N guages” or thoose “War craft” and other action figures. And there are plenty of people who will take appropriate cad drawings and pop them through a 3d printer no questions asked for fairly trivial amounts of money (50USD or less). I also know of several companies who will etch or laser cut thin brass sheet or cast Whites metal or acrylic again for fairly trivial amounts. I’ve used such organisations frequently when making custom housings for surveillance equipment using near IR cameras and two or four channel audio.

So 3000USD is definatly on the high side, if you consider the usual manufacturing 10:1 mark up.

That said I was usually charging in excess of 7500USD for short turn around custom cased surveillance equipment.

Clive Robinson • December 11, 2012 1:40 PM

@ Spellucci,

Especially the spellings: it reminds me that my spellchecker is quietly watching everything I type

You have just given me a horrible idea…

The way most spell checkers work is to compare what you are typing to what is in effect a file of words.

Now it would seem appropriate for the spell checker to work at a low level and also be privileged to see the raw key strokes.

However the actuall file would not ordinarily be privileged in any way, it would be a general file open to most processes for reading.

This means that unless carefully written (which it almost certainly won’t be) the spell checker could leak information about what is being typed by the user through it’s access to the common file.

All that is needed for a covert channel to exist is for another unprivileged process to be somehow capable (say via the cache or other shared memory) of determaning what words are being looked up…

I’ll have a think on it for a few days.