15 ms·
Target's EasySweep – Simplifying Skimmer Detection
- starkparker 3y agoWhy not publicly distribute the design? Because skimmer-makers might adapt? It seems trivial to acquire one (getting a job at Target or spoofing a corp email account isn't a high barrier).
- groby_b 3y agoIt is, however, added friction, and that's 90% of the security game. Every additional layer helps. (And a corp email account adds a paper trail, at the very least)
- dawnerd 3y agoThey also patented it so I imagine that’s part of their reasoning.
- jerf 3y agoI would expect that the corporations will be asked to sign an indemnity agreement before they get the design. Target doesn't want to be held liable in case a skimmer is built that defeats this detection and the recipient needs to understand there are no guarantees. It's nice that someone got this through the default corporate deny policies.
- samtho 3y agoIt’s sad that this is likely the case. In general, an “As is/no warranty” shrinkwrap contract should be sufficient for legal protection but won’t prevent people from filing nuisance lawsuits, which I suspect they wish to avoid altogether.
- kyleyeats 3y agoThat's what the OP is. > Based on the success we saw with EasySweep, we decided to offer the design, for free, to other retailers.
- loeg 3y agoYou still have to request access from Target. GP is asking for it to just be published online somewhere.
- kyleyeats 3y agoAh good point. Target's one of the most serious companies in the world about this, with a forensics lab and everything. I'm surprised they're doing this much, even if the skimmers obviously have access to the same measurements.
- gorkish 3y agoIt's right here: https://patents.google.com/patent/US11507762B2/ https://patents.google.com/patent/US11507762B2/ Took me five seconds. You can make one if you feel like it.
- loeg 3y agoThat is not the "Step CAD file" available to retailers who contact Target and this thread is asking to be published.
- al2o3cr 3y agoit allows any Target team member to easily sweep a store for skimmers I'm unclear on how this is supposed to help - unless the skimmers are being installed by frickin ninjas it seems like they already needed insider cooperation.
- snapplebobapple 3y agoIf you make sure who is doing the skimming rotates so that there is a constant stream of new people checking it would be really hard to stop detection in a timely manner. It's also insanely fast to install a skimmer (like 2 seconds fast) so you don't necessarily need insider help. Until wireless skimmers with a decent range become available this tool could bring skimming down to effectively zero (and reduce it to just the customer who rang through the till before it was discovered when they are available). It's a pretty epic addition to the retail security landscape
- asadm 3y agoSkimmer can be installed in seconds, just glued-on when the skimmer-guy is at the check-out.
- ceejayoz 3y agoYup. Three seconds: https://www.youtube.com/watch?v=5b1axnNK-wI https://www.youtube.com/watch?v=5b1axnNK-wI A second guy distracting the clerk helps, too.
- tennisflyi 3y agoIt’s the former more or less - https://youtu.be/Sljmr8m88P8 https://youtu.be/Sljmr8m88P8. They could do it on a lane that isn’t open (read no attention) just before a rush hour and hope it gets chosen.
- bastardoperator 3y agoIf the target employee cannot see the skimmer detection tool, the terminal has been compromised. Most skimmers fit on top of the terminal which would obstruct sight of this tool/layer. There are videos online of these skimmers being "installed" and it takes about 1 to 2 seconds of work and it seems anyone can do it.
- deleted 3y ago[deleted]
- noodlesUK 3y agoHow do these skimmers work with chip&pin? I understand how magstripe skimmers work, but my understanding is that chip&pin is an active challenge response protocol. I’d love to hear more.
- CharlesW 3y ago> How do these skimmers work with chip&pin? My understanding is: They don’t. If you stick to contactless payments, you’re not at risk.
- noodlesUK 3y agoThe image shows the skimmer gadget sitting on top of the pin pad and the bottom card insertion slot (the one that takes a chip). On these card readers the magstripe reader is on the right hand side iirc. I’m wondering what you can do having connected to the EMV contacts and recorded the PIN. I suppose you could make a transaction, but it would have to presumably happen at the same time as the legit transaction (which would then immediately get flagged as fraudulent)
- throwaway42968 3y agoNot much. The chip doesn't transmit any credit card numbers. What's really happening in an EMV transaction is the amount due is transmitted along with some identifying information from the host to the card reader. The reader then authenticates with the chip card using asymmetric cryptography. Once this authentication is done, the reader sends an amount due and the chip card checks its authorization rules, and responds with some encrypted data that represents the transaction amount and that depends on a private key embedded in the card. You could replay the transaction at the exact same time as it is happening, but you'd have to use the same amount due. And there are other identifiers for EG the terminal that you'd have to know. If you're curious, EMVco makes the specification available online in documents titled Book 1, Book 2, Book 3, and so on: https://www.emvco.com/specifications/ https://www.emvco.com/specifications/
- chiph 3y ago
- dangerboysteve 3y agoDid I read this wrong? They are using the card chip slot to house the skimmer protection, so chip and pin will not work ?
- AYoung010 3y agoYes, you did I'm afraid -- this is a tool which is used to check for skimmers, not a preventative measure which is permanently installed. It only blocks the chip slot when an employee is ensuring a skimmer isn't installed on a particular terminal.
- jaywalk 3y agoThe device is for detection. The employees just insert it into the slot once per day and check to make sure it goes in fully. Then it's immediately removed.
- mrguyorama 3y agoIt's not "protection" but a testing tool. If the tool fits as expected then there probably isn't a skimmer. Then you remove the tool
- deleted 3y ago[deleted]
- HWR_14 3y agoYou read it wrong. It's not permanently attached. They stick a very precise 3D object in the chip slot, and if it doesn't fit, that means the slot isn't the exact same as how the reader was made from the manufacturer. So you get a cashier to do that at the start of their shift, and if anything is detected they call out a more trained repair man/security professional to figure out if there is a skimmer.
- NoMoreNicksLeft 3y agoSo the skimmer asshole pays some Target employee $100 to replace the very precise 3d object with one that hides the skimmer when no one's looking? I need a solution that lets me, the card holder, check these. This ain't it. Hell, some of the internal skimmers just solder jumper wires to pcb pins/testpoints don't they? There's nothing mechanical for a card to touch. Target's got so many telescreen cameras in the store, they could likely get the pin numbers straight from that, no need to intercept that.
- bredren 3y agoIt seems like this is the kind of thing Verifone aught to design, maintain and distribute.
- kotaKat 3y agoBelieve it or not, Verifone part KIT177-005-01-A is, in fact, a "Skimming Device Detection Tool". https://www.geminicomputersinc.com/kit177-005-01-a.html https://www.geminicomputersinc.com/kit177-005-01-a.html
- delfinom 3y agoI would imagine there's something wrong with it if Target isn't just buying it Though it could just be cost given that Target could just pay for a plastic injection mold overseas and then pay peanuts yearly to make a 60k batch for their yearly renewal they mention, compared to $20*60k each time
- loeg 3y agoYeah. $8-24 a unit vs "under $1." Although 60,000 x 8 still isn't a huge amount of money.
- gorkish 3y agoThis little micro-arms-race to develop and patent a plastic wedge that doesn't need to exist in the first place is ridiculous. The irony is that there is something of a perverse incentive not to solve the actual problem now that such a big industry has emerged to to combat it. If they wanted to build secure card payment terminals they would build them.
- thetwentyone 3y agoSince it's only implied how it works and there seems to be some confusion in the comments. It seems like the technique is to simply create a very form-fitting insert which won't fit properly if some device is overlaid onto the machine. The insert is not left in the device, but is just used for a quick in-and-out check.
- Dah00n 3y agoAnd it is patented..
- loeg 3y agoBut also, freely licensed.
- crote 3y agoOnly for large retailers, though. Why not directly offer the CAD file for download right on that page, or make the resulting product available for purchase?
- monkeymeister 3y agoLikely to avoid defeat attempts. The corporate email requirement acts as a first-line defense to at least try to stave-off would be skimmers / scammers grabbing the CAD file and working out the measurements needed to defeat it.
- nvaofdv3332 3y ago[flagged]
- hiatus 3y agoSparkfun put out an app to help detect skimmers primarily on gas pumps [1], though it no longer appears to be available on the google play store. [1]: https://github.com/sparkfunX/Skimmer_Scanner https://github.com/sparkfunX/Skimmer_Scanner
- whartung 3y agoIt annoys me that none of the gas stations I use have the "tap to pay" that actually works. They seem to have the sensor on the pumps, but they never work.
- axus 3y agoI wonder why. I had the same problem and assumed they'd just bought some premature technology and never upgraded since.
- selykg 3y agoMy preferred gas station got tap to pay during the pandemic and I make it a clear effort to use it every time I get gas to try to bump the numbers up so it doesn't go away or gets fixed if it breaks. Such a great feature.
- LorenPechtel 3y agoPreferred gas station here did something to the UI--you can "pay" by waving your phone at it, but then it will prompt for your zip code. When you enter the zip code there's a couple of prompts about ensuring you know you're paying credit price--oops, entering the zip code also answers no to the first question.
- selykg 3y agoThat's real dumb and totally defeats the point. That sucks.
- LorenPechtel 3y ago
- mkmk 3y ago“with inspections being done daily in all our store locations.” impressive.
- adrianmonk 3y agoCould payment terminals be made with built-in physical countermeasures for detection? Ideas: (1) Terminal has a scale built into its feet/mount. It periodically weighs itself, and if (ignoring fluctuations) it weighs too much, it shuts down. It's hard to build a skimmer that weighs 0 grams. (2) Proximity sensors in key locations on the housing. My smartphone can disable its touchscreen when I hold it against my face, so a payment terminal should be able to detect when something is covering a part that isn't supposed to be covered. (3) Light sensors. Put some in an area where skimmers need to cover (near card slot) and other where skimmers probably can't cover (the display), and detect whether they get roughly the same amount of light. (4) Microphones. Same idea as light sensors but with sound.
- briffle 3y agoOf course they can be made that way. The countermeasure built into gambling equipment like slot machines is incredible. But then it would cost more than their competitors. With much more maintenance for false positives, etc. And the vendor doesn't really pay the price for skimmer fraud..
- LorenPechtel 3y agoIf someone comes up with an anti-skimmer terminal the payment processors would benefit from having a lower transaction fee for transactions posted from such a terminal. That would in time push the market to use such terminals.
- jalk 3y agoSo the reason that gas, in LA area at least, have different prices for cash and card (typically ~$0.25/gal more for card) is not because of additional risk for the gas station, but just classic US exorbitant fees?
- despideme 3y agoThe price difference is a way to pass along credit card fees that otherwise would have to be paid by the station operator. It used to be against the credit card networks’ merchant agreements to have separate cash and credit prices — but a good number of LA gas stations rolled the dice and did it anyway. That rule changed a few years ago, and now most stations split their pricing. (I believe that’s also why ARCO gas now takes credit cards, after holding out for decades — they are now allowed to pass along the cost to the customer.)
- exabrial 3y agoWe wouldn't even need to worry about this dumb stuff if we had actual cryptographic PKI for payments. Honestly at some point fraud is 100% the card issuer's fault when the tech to prevent it is here and now. Why I still can't register a public key with my bank and say "do not under any circumstance honor a transaction unless it's signed with my private key" is beyond me.
- thelastparadise 3y ago> Why I still can't register a public key with my bank and say "do not under any circumstance honor a transaction unless it's signed with my private key" is beyond me. What you are describing is Bitcoin.
- throwaway42968 3y agoWhat you are describing is essentially EMV, except that your bank has gone to the trouble of picking your private key and embedding it in a card you carry around and insert into payment terminals.
- crote 3y agoThat's EMV, and it is still not 100% foolproof because the card itself doesn't have a display and Allow/Deny button.
- Nextgrid 3y ago> still not 100% foolproof because the card itself doesn't have a display and Allow/Deny button. I'm assuming you are thinking about an attack where a compromised terminal processes an attacker-issued transaction (relayed from elsewhere) instead of the genuine one. It seems like a solution to this would be for the card to issue a challenge to the reader and only provide a very short timeframe to answer, so that relaying it elsewhere is impossible due to speed of light and all that.
- adolph 3y agoThis is an interesting and simple physical measurement device to determine if the credit card slot is in a different orientation than expected. It uses the keypad as a reference location. I think the most obvious circumvention would be for the criminal enterprise to focus on altering the length of the verification devices, since an EasySweep does not appear to have a formal method to verify its own correctness. A shortened card tab on EasySweep would provide feedback that the terminal was ok since the keypad finger support presses against the terminal.
- Terr_ 3y agoAll this shape-based stuff makes me think of antigen/antibody immune-system analogies. The skimmer binds to the payment slot, some payment slots change shape to prevent skimmer binding, and now the tester-block binds to check that nothing is already bound...
- gumby 3y agoThis is quite clever.
- Animats 3y agoThis is only a small part of Target's loss prevention operation. Target is known for being both aggressive and sneaky about loss prevention. They use cameras and face recognition extensively, and they have an in-house forensic lab that can process fingerprints. Sometimes they will let a shoplifter get away with stealing for a while, until the total passes the felony threshold. Then they have them arrested. Sometimes followed, because they want to know where the stolen goods are going and catch the fence.[1] If they find a skimmer, they will probably go back over the video until they find who put it there. Former Target security guard: "All cameras are functional and can look in any direction. Many are 4K and can zoom." [1] https://www.paypath.com/Small-Business/why-target-is-the-worst-store-to-shoplift-from https://www.paypath.com/Small-Business/why-target-is-the-wor...
- throwaway2037 3y agoYour quoted first paragraph: You make it sounds like this is something bad. What is wrong with Target's actions? I am confused.
- aesh2Xa1 3y agoTarget has the opportunity to correct an individual whose punishment will be a misdemeanor but instead chooses to -escalate- the individual's behavior in order to punish them with a felony. Imagine that the misdemeanor — a fine and a few months in prison — would sufficiently deter an individual from ever stealing again, or at least from Target. Target's theft problem is resolved, and the individual goes on with a more abiding life. In the actual case, Target allows this person to believe the theft is easy and rewarding. When Target preps the legal case, this person serves years in prison. Target has lost additional inventory meanwhile, Target has paid for the case-building, the individual serves a long sentence, and the individual loses future job candidacy. Society also pays for the prison time and must support an individual with a difficult-to-employ problem. Everybody is worse off. I didn't read OP's paragraph and think that they intended to make Target sound bad, but I was able to make the case myself, I think.
- 3y ago