Is your money at risk between ATMs and banks?

Stephen Withers
Friday, 17 April 2009 11:43

Business IT - Technology

You've probably become used to checking the card slot on ATMs for any sign that a 'skimmer' has been installed, and if you're like me you've also got into the habit of shielding the keypad when you key in the PIN. Now there are reports that criminals have found a way of capturing PINs in transit.

There has been a general assumption that the weak point in banking security is at the customer end. Phishing and sophisticated keystroke loggers that also capture screen activity are just two of the ways criminal elements can get hold of banking and credit card details.

You may have thought that the biggest risk when using an ATM was the potential mugger waiting a few doors down the street, but it seems that criminals have found ways of getting into the ATM network.

According to Wired there are at least two approaches that are being actively used to steal PINs and account details from inside.

One method is to trick a hardware security module (HSM) into revealing the encryption key used to protect data in transit. The problem is that a transaction passes through multiple HSMs on its journey from the originating ATM or POS terminal to the customer's bank, and they aren't all as secure as they should be.

Another is that there are known cases of special-purpose malware finding its way onto banks' central systems. Such software takes advantage of the fact that it is necessary to decrypt the PIN and account number so that the transaction can be processed.

It just sits there quietly and 'scrapes' the contents of memory in order to record the information necessary to generate a fraudulent transaction.

Why should customers be more concerned about ATM/EFTPOS breaches than credit card exploits? And what does the Australian banking industry have to say about the problem? See page 2.