Cash machines

[Incognito]

http://news.bbc.co.uk/1/hi/technology/7584258.stm

The thieves claim to have comprehensive details of US credit and debit cards passed to them from an American gang who tapped phone lines between cash machines and banks.

Are they on about ATM's? Surely that's encrypted traffic.

[scooterscot]

ID cards are the answer....

[Incognito]

ID cards are the answer....

For that they're not.

[snaw]

For that they're not.

ATM's are everywhere in the US, in most stores etc. When I lived there a gang set up an ATM company, hired out 100's to various shops and collected details for months then cleaned everyone out - funnily enough my local Deli was one of the ones affected, but guess we'd cancelled those cards before they got round to doing us.

[Incognito]

Surely the transaction is encrypted though or could someone just tap in and sniff their traffic?

[ratewhore]

An IP-ATM is connected to the payment processor using a TCP/IP connection. However, while the PIN number is triple-DES encrypted, the messages themselves are not. In January 2008, an analysis of ATM network traffic by Network Box found that only the PIN number was encrypted and that a large portion of the traffic travelled in plain text, leaving card numbers, card expiry dates, transaction amounts and account balances clearly readable. Therefore, a hacker needs only to access some part of the IP network between the IP-ATM and the payment processor to be privy to the aforementioned details.

linky

[Incognito]

Flucking bell

[Incognito]

Even better

http://www.theinquirer.net/gb/inquir...eves-broke-pin

What's most troubling is that, apparently, no one knows how the thieves managed to crack Citibank's ATM network, break into a server at a third-party transactions processor, and steal not only account numbers but also the unencrypted PIN codes that enabled them to successfully withdraw funds. If anyone knows how they did it, they're not saying publicly.

I wonder if they all use their username as their password?

[AtW]

Pins are just 4 digits - encrypting just them is crazy because it is easy to check less than 10k combinations using plain text attack.

[ratewhore]

Remember this?

I never use the non-bank owned ATM's. Not for security mind you, because I'm too tight to pay £1.99 to withdraw £20...