How To Steal ATM PINs With a Thermal Camera 157
An anonymous reader writes "Researchers from UCSD have demonstrated how thermal imagery cameras can be used to
steal customers' PINs (PDF) when you withdraw cash from ATMs. Their paper, entitled 'Heat of the Moment: Characterizing the Efficacy of Thermal Camera-Based Attacks', (PDF) discovered that plastic PIN pads were the best for retaining heat signatures showing which numbers (and in which order) were used by bank customers. Fortunately the methodology does not appear to have been used by criminals yet, but a third of people surveyed admit that they do not check ATMs for tampering before withdrawing cash."
Oh Sure, Academia Accepts THAT Paper (Score:1, Offtopic)
Their paper, entitled 'Heat of the Moment: Characterizing the Efcacy of Thermal Camera-Based Attacks' ...
Oh sure everybody wants to show how easy it is to steal everyone else's PIN but when you release a paper detailing how to do it with X-rays and guarantee the target develops cancer and dies within a month leaving their account ripe for unnoticed pilfering then you've "gone too far"!
Re:Oh Sure, Academia Accepts THAT Paper (Score:4, Funny)
And don't ever use Gamma Rays, you don't want the Hulk chasing you after you've pilfered his bank account.
Re: (Score:3)
Fortunately the methodology does not appear to have been used by criminals ye
But they'll be sure to get on it right away now that they have been clued in.
Re: (Score:2)
Even if you go fleabaying, a thermal imaging system up to the task will easily be north of $1,000, and the cheap seats are often rather bulky and don't exactly sip power. If you go with something handheld, the fact that many of them look very much unlike normal digital cameras will make you stand out a goo
Re: (Score:1)
Re: (Score:2)
Re: (Score:3)
Where do you live, Mogadishu?
Touch typing defense (Score:5, Funny)
Hmm, I knew there was a reason that I rested all of my fingers uniformly across the keypad, gently caressing their every ridge and facet as I discreetly pumped out my digits into their PIN pad. Well, another reason, at least.
Also I try to think about a completely different song than the one that corresponds to the letters that correspond to the numbers of my PIN, just to thwart any brainwave phreaking attacks as well.
But still hoping we score some decent security measures out of this, like maybe a bank-issued gold card or something.
Re:Touch typing defense (Score:5, Funny)
I rested all of my fingers uniformly across the keypad, gently caressing their every ridge and facet as I discreetly pumped out my digits
Have you considered a career writing Harlequin novels?
Re: (Score:3)
Re:Touch typing defense (Score:5, Funny)
Just set the keypad on fire.
Re: (Score:2)
-- Security Engineering Officer Ellen Ripley
Re: (Score:2)
Makes sense. Even though I cover my typing hand with my other hand, I always add a few more fake keypresses so that any camera can't make a rough guess, judging by the quadrant of the image showing slight movement, which key was actually pressed. So now I have to do this for infra red coverage also. Great.
Re: (Score:3)
I picked up this habit after working in a classified area with a cipher lock.
After I'd enter the cipher, I'd swipe my fingers over all the buttons to make it harder for a potential bad guy to analyze the wear/fingerprint patterns on the lock.
Re: (Score:3)
I'm not sure whether I just read a method to obscure your PIN number from thermal cameras, or a description of one of your sexual exploits.
Re: (Score:2)
Re:Touch typing defense (Score:4, Insightful)
It looks likely you were mostly joking (so, that makes me feel equally bad about admitting this).
But, when putting in my PIN, I typically rest several fingers on different numbers, move my hand around, and punch my PIN in that way, obscuring what I'm doing (not the typical one finger, one press approach).
For me, it was about making it tough for someone with a video camera set up to watch the ATM to figure out what my PIN is based on finger movement alone.
I suppose to that end, would getting the heat signature really be that superior to having a video camera set up with a telephoto lens?
And if we were ever worried about heat signature, wouldn't simply wearing gloves defeat this "potential attack?"
Seems someone has figured out a complex way of collecting PINs.
Why not set up a loop of wire and, based on the different lengths of connection between electricity that flows from pressed keys to the processor, infer which key is pressed?
Right... it would cost more in time, money, and effort than one could make simply waiting for someone to walk up and rob with a gun.
Re: (Score:2)
But, when putting in my PIN, I typically rest several fingers on different numbers, move my hand around, and punch my PIN in that way, obscuring what I'm doing (not the typical one finger, one press approach).
I do it too -- I start at the top row, one finger per button, and then slide my hand down the keypad making contact with every button but only putting pressure on the one button that needs pushing. I repeat the process for each digit but make sure to slide my hand across the entire keypad each time. It didn't take much practice to get good at it, it still takes a little bit longer than just punching the numbers in directly, but not enough to matter.
Re: (Score:3)
Right... it would cost more in time, money, and effort than one could make simply waiting for someone to walk up and rob with a gun.
Never forget that any sort of ATM attack is anonymous and impersonal, whereas holding up someone with a gun means you personally are standing there in front of someone with a gun in your hand.
What the Internet has proven beyond a shadow of a doubt is that ordinary people who wouldn't think of shoplifting will go to incredible lengths to steal stuff on the Internet where they are anonymous and the action is impersonal. Someone who would never break into a house in person will break into a computer with impu
Re: (Score:2)
Seems like a risky thing to do. If you use a cloned card in a shop you will probably be on CCTV. If you use it on the internet then I suppose you can pay for some services (hiding behind a proxy or Tor) but any physical goods need to be delivered to an address. Most people don't have an address they can use to receive their ill-gotten gains.
Re: (Score:2)
I think the idea is that after you leave the machine, four[1] of the keys will be glowing. The brightest one is the number you pressed last, and the dimmest is the one you pressed first.
[1] Assuming your PIN is made up of four unique numbers. If your pin contains repeated numbers, I guess it makes it more difficult to determine the order of them.
Re: (Score:2)
48 permutations, assuming 4 known, unique digits. 36 permutations, assuming 3 digits, not knowing which is unique.
Re: (Score:2)
What about all the other number keys you end up pressing when you define how much money you're depositing or withdrawing?
All this is making the simple task of stealing so complicated. Gypsy kids just hang around the ATM, wait for the withdraw screen to show up, run in, quickly press the auto denomination of the highest value and wait for the money to start spitting out before they grab and dash. Thermal cameras have got nothing on those kids.
Re: (Score:2)
My ATM makes me use the touchscreen after entering the PIN on the number pad; so I guess I'm screwed.
Best way to prevent observers of any type (Score:2)
Re: (Score:2)
Hmm, I knew there was a reason that I rested all of my fingers uniformly across the keypad, gently caressing their every ridge and facet as I discreetly pumped out my digits into their PIN pad.
Do you do so while wearing a robe and wizard hat?
Re: (Score:2)
I usually keep hitting the keypad randomly when it's preparing the cash, for fun. Now that's a reason for me to keep doing it!
Re: (Score:2)
Naaah,
1,2,3,4(5,6,7,8,9,10,11,Twe-ee-e-ee-e-elve!)
Now get back in line. (Score:4, Insightful)
but a third of people surveyed admit that they do not check ATMs for tampering before withdrawing cash.
A person checking an ATM for tampering may look like they are tampering with an ATM. Now get back in line.
Re: (Score:3)
Word. Not to mention that most ATM skimmers are very difficult to detect, and are often indistinguishable from some of the regular "bling" that an ATM might have adorning their card slot.
But I guess it's worthwhile to attempt to rip it out anyway and see what happens :-P
http://images.google.com/search?q=ATM+skimmer&hl=en&prmd=ivns&tbm=isch&tbo=u&source=univ&sa=X&biw=1270&bih=810 [google.com]
Re:Now get back in line. (Score:5, Insightful)
Re: (Score:2, Insightful)
Re:Now get back in line. (Score:5, Interesting)
Re: (Score:3)
Re: (Score:2)
I spotted only half the skimmers, and missed the cameras. Cunning little monsters. Glad I don't use ATMs often. Thanks for the link.
Re: (Score:2)
Am I alone in not using ATMs? I prolly wouldn't know if a skimmer had been installed because I almost never visit ATMs. I mean, in any given year I can count on one hand the number of ATM withfrawals and checks written on one, maybe two hands. I stopped carrying cash years ago and if I truly need some, most of the time a POS cashout is closer than the bank, and doesn't charge a fee.
To be fair, I *do* use the ATM whenever I need to deposit checks, which is rarely enough. All that said, if I saw mysteriou
Re:Now get back in line. (Score:5, Interesting)
but a third of people surveyed admit that they do not check ATMs for tampering before withdrawing cash.
Two thirds of them do? I find that very hard to believe.
Re: (Score:2)
The key word being "admit." I would suspect at least 90% of people don't actually look for ATM tampering, but in having it brought up are too embarrassed to admit to it.
Nothing is safe (Score:1)
There is no level of applied security that can thwart applied freedom.
Wallet corner defense (Score:3, Insightful)
I use the corner of my wallet to to press the keys, let's see them work with that.
Re: (Score:2)
Good idea. Also, stylo of your mobile. Mod the coward up.
Re: (Score:2)
I am a proud owner of Samsung i730
http://en.wikipedia.org/wiki/Samsung_SCH-i730 [wikipedia.org]
It is hard to overestimate ubiquitous practicality of a stylus. It's uses vary from direct use and clearing wax from one's ear.
Re: (Score:2)
Re: (Score:2)
Except you already had your wallet out anyway to get to your cash card. And now your card is in the machine and you probably have no cash in it if you're at the ATM, so now they've got a wallet with things the average thief can't make use of, except maybe a condom or two. And given that this guy is posting on /. that condom has probably been there for 5+ years and is no longer effective. In nine months justice will be served. Take that, thief!
Slashdot is advertising thermal imaging cameras... (Score:3)
when I viewed this story. Conflict of interest here?
Re: (Score:2)
Google context sensitive advertising at work.
They probably also advertise ski masks on stories about bank robbery.
Splinter Cell... (Score:3)
They did this in Splinter Cell YEARS ago.
Re: (Score:2)
That's the first thing I thought of too. I remember using my Thermal Imaging goggles in Splinter Cell to steal door codes after watching someone else use the keypad.
Did the guys at UCSD play Splinter Cell? Did they thank Ubisoft in their paper? ;)
Re: (Score:1)
They did this in Splinter Cell YEARS ago.
After doing that in game, I remember thinking that there was no way this would really work. I was hoping that Mythbusters would tackle it but it looks like academia beat them to it.
Re: (Score:1)
This was done on (Score:2)
Re: (Score:2)
I don't know if that is where I saw that, but yes the technique has appeared in movies (years ago) This is life imitating art.
Easy to Avoid (Score:5, Funny)
Re: (Score:3)
When I'm typing in my PIN I do a fancy jig with my fingers, and I use my fingernails - admittedly to avoid getting the ick from the ATM on my fingers - but that should help keep the thermal signatures down as well.
Re:Easy to Avoid (Score:4, Insightful)
Urine is likely cleaner than what you normally find on ATMs. So you're doing a public service by "rinsing off" the keypad.
Re: (Score:2)
You joke, but there is a scene in American Treasure II where they fingerprint a keyboard and deduce the password using letters hit and a dictionary attack. One shift or caps-lock key use and it blows the solution space exponentially high.
I am waiting for ATMs to have NFC support. That way, my card and/or phone is needed so that I don't have to even touch that machine.
Re: (Score:1)
Reminds me of the apocryphal story of the D&D munchkin running a dwarven thief whose dungeon lockpicking strategy is to piss in the lock and then come back in a year or two after the mechanism had corroded...
Re: (Score:2)
Re: (Score:2)
Thermal imaging? That stuff is fun and expensive.. (Score:4, Funny)
Even as a usually law-abiding citizen, I might be tempted to steal that camera thingy if i find it. The fact that it was put there by criminals would greatly reduce my pangs of conscience ;-)
Re: (Score:2)
The camera wouldn't be near the ATM. Someone behind you in line would take the camera out of their pocket, and take a picture of the keypad you just touched.
So as far as i understood. (Score:2)
Tampering is not needed for taking a thermal photo as the next in line.
secure NFC transactions NOW! (Score:3)
this is an even better reason we need secure NFC transactions (with your mobile) asap. it's absurd to be typing a by-definition-weak password into an unauditable terminal. why hasn't some bank hasn't noticed that at least early adopters would pay for the privilege of paying securely?
then again, if banks simply secured their terminals, much of the hacked-ATM problem would disappear. yes, toilet-like stalls for each ATM...
Re: (Score:3)
this is an even better reason we need secure NFC transactions (with your mobile) asap.
Near field communication is only as secure as the size and sensitivity of the nearest antenna.
Just because your mobile phone has a weak antenna doesn't mean a malicious actor has to limit himself.
Re: (Score:2)
Near field communication is only as secure as the size and sensitivity of the nearest antenna.
Just because your mobile phone has a weak antenna doesn't mean a malicious actor has to limit himself.
Yes, screw NFC - we would be a lot better off with 2D barcodes [wikimedia.org] displayed on the phone and a camera on the POS terminal. If you need 2-way communication (which I doubt is really necessary) then just use the camera on the phone and a small (e-ink?) display on the POS terminal. Bonus in that no new tech on the consumer end is needed, every smart phone currently on the market has all you need to pull it off.
Re: (Score:2)
True, but accepting card payments is far more risky than simply buying stuff on a stolen card. To get any return you have to provide a bank account for them to pay the money into, and an address to send billing information to.
People have tried this sort of thing in the past with premium rate phone lines. They stole mobile and then set up a rig to dial their premium rate number over and over again. Naturally they were caught pretty quickly once the phone company started getting complaints.
Re: (Score:3)
Re: (Score:2)
This is partly why even though my credit card has a chip, it does not have a PIN. The other reason is my issuing bank didn't have the infrastructure set up to handle CC PINs when they started shipping chipped replacement cards out, but considering at least one guy's already been denied a disputed charge because his CC company claims the system is secure and it MUST have been him entering the PIN, I'll just keep signing my CC-paid bills for as long as I can.
Re: (Score:2)
A hacked terminal isn't enough to break card security, obviously, the whole point is that you need both the card and the PIN. Merely having the PIN isn't enough. Modern cards can't be cloned unless you live somewhere still in the stone age, like the USA ;)
train my cold blooded pet snake (Score:1)
this is why i need to train my cold blooded pet snack to enter my pin for me!
Re: (Score:2)
this is why i need to train my cold blooded pet snack to enter my pin for me!
I would say something about the amount of time wasted by repeatedly training something that's going to be consumed in short order, but i'm more squicked out by the idea of keeping your snacks as pets.
The Efficient Method (Score:4, Informative)
Isn't it cheaper to simply mug the ATM user after they are done and take cash while out of sight of the ATM machine's own camera? You'd have to do that anyway to get the card from them. Why get all technical?
Re: (Score:2)
The common method is using an ATM skimmer to copy the card, and a camera to record typing in of the code. No mugging necessary. Sometimes the keypad is faked too.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
1) You're limited to the 20$ the tightwad took out.
2) You would have to be able to mug them over and over again until caught
3) Likely the charge is less if you don't actually have to threaten anyone with a knife or gun.
4) You just need the number not the card, but even if you do need it, you can secretly steal it, make a copy and even return it.
5) Its way cooler.
Touch more than 4 digits. Probelm solved. (Score:1)
Re: (Score:2)
Or you could have just used the tip of the pen or stylo from your mobile.
What good is the pin? (Score:2)
If I'm the only one with the card?
Re: (Score:2)
Well now that we have your PIN we can just knock you over the head and take your card. Before we had to kidnap and torture you to get you to reveal the PIN. This is so much easier. Who says that technology isn't improving our lives?
Re: (Score:2)
Because shortly you will not be the only one with the card. As others mentioned there is a skimmer attached somewhere on the ATM. This reads the data contained on the magnetic stripe of your card and records. It may transmit this data via bluteooth to a local attacker, or store it locally. Skimmers usually can contain anywhere from 7-10,000 cards on them roughly.
Once this is accomplished the attacker will then either sell the data online, or begin creating his own fake credit cards. This process involves pu
Was on The Real Hustle a few weeks ago (Score:1)
Equipment cooling (Score:2)
I'd never heard of this method of attack until now. But it might explain why some of my bank's ATMs seem to have a high volume of cooling air blasting through any cracks and openings in the machine. Metal keys as well.
There was an article in a recent electronics magazine about building a code entry keypad that scrambles the digit positions between each entry attempt. This would make filming the keyboard difficult if one were to make the digit displays hard to see other than straight on. It would cause prob
Re: (Score:2)
Re: (Score:2)
It also makes it impossible for blind people to enter the PIN, so probably violates Disability Discrimination legislation. Keypads usually have a dimple on the No 5 button, and a blind person can figure out where the other buttons are from that.
Re: (Score:2)
Take a page from the iPhone's touchscreen accessibility mode. When you move a finger over an element, it reads it out. Obviously you don't want it read aloud so others can hear, but this would be a good use of most of my bank's ATMs audio-out jack.
Okay yes, then the criminals hack or replace the audio jack with their own. I assume Disability Discrimination laws don't allow fully-abled people to use features disabled ones can't (translation: blind people must be able to access new, more secure features, othe
What about ambient temperature? (Score:2)
Right now in Texas, we're hitting over 104F in the afternoons, several degrees higher than body temperature. Would the buttons be cooled by people touching them?
Re: (Score:1)
You really have ATMs operating in 104F environments? More likely there's an AC unit right above the thing blasting cold air on it.
Why aren't these things obselete? (Score:2)
Is it just me, or does anyone else tire over stories of ATM skimming/tampering? I guess my main point here is who the hell still uses an ATM anymore?
It's probably been at least 6 months since I've stepped in front of one. I can withdraw up to $100 at just about any store I go into when I use my debit card(multiple times a day too), and since there seems to be a rather large void of evidence regarding tampering of debit terminals inside stores and banks, the most obvious solution seems to be the answer her
Re: (Score:2)
I think your experience is probably in the US? Being able to get cash back from the store is not unheard of in other countries, but it's a lot less common than in the US. Also card payments are less common in other countries, usually cash is preferred. (On average it's a lot quicker, plus many people prefer not to leave a record of every little purchase they make.)
As for withdrawal fees - my German bank (DKB) lets me withdraw money anywhere in the world using my visa card, and they swallow the withdrawal
Re: (Score:2)
Re: (Score:2)
you must be single. Married with children, I can pull $400 out of an ATM and have it gone in days.
Score one for moderate OCD (Score:2)
Worse yet, the chip cards (Score:2)
Max Headroom (Score:2)
Re: (Score:2)
And two thirds of people are liars. (Score:1)
"but a third of people surveyed admit that they do not check ATMs for tampering before withdrawing cash"
Yeah, I get it, some of you are typical Internet paranoid freaks who do this, but 99% of people don't. Why? I've never heard of anyone having their pin stolen. Ever. I've never known anyone who had money stolen from a bank account. We know the vast majority of cases of this are identity theft (which isn't pin theft). If someone did steal my PIN, they'd also need my wallet. My wallet was only stolen
If i see (Score:2)
If i see someone hunched over the ATM i just finished using, with this thermal camera, guess what I will be doing....
smashing that camera to pieces in front of him.....
Seriously though, I think whether you dust for prints or heat or etc..... there is always a way to find the pin, which is why i subscribe to the new sms identification method gmail/facebook/hotmail uses, they should use that for banks and for credit cards
I type with the back of my nails (Score:1)
I typically type two of the four numbers with the back of my fingernails. It won't help videocameras unless I would try to obfuscate it further, but for any type of fingerprinting, thermal, oil, or other attempts to duplicate my PIN that I've seen on Hollywood movies or CSI, it's hard enough to figure out that the imaginary criminal would probably just jack the next guy instead. Plus it gives my wife something to make fun of if she ever catches it.
But honestly, if you manage to steal a card and get the PIN,
work around (Score:2)
After you are finished with the ATM just press all the buttons on the keypad in random order leaving your finger on each key for a long hard press to really soak up your body heat. Kinda like scrambling the combination on a lock.