Smoking Gun reports
that a NYC man accused of participating in an ATM-skimming ring was raided by feds, and in an unusual attempt to destroy evidence, grabbed a flash drive and swallowed it whole while in the custody of Secret Service agents:
[I]n the view of investigators, [Florin] Necula "grabbed Subject Flash Drive 2, which had been on his person at the time of his arrest, and swallowed," Agent Joseph Borger noted in the below February 25 search warrant affidavit. When Necula was unable to pass the item after about four days, doctors--concerned that the drive was not compatible with the suspect's GI tract--concluded he "would be injured if they allowed the flash drive to remain inside of him," reported Borger. Necula eventually agreed to allow doctors at New York Downtown Hospital to remove the item, according to a source familiar with the incident.
A Kingston executive said it was unclear if stomach acid could damage a flash drive. "As you might imagine, we have no actual experience with someone swallowing a USB," Mike Sager wrote in an e-mail to TSG.
Mr. Necula is currently being held without bail at a jail in Queens, New York. Here are the court documents
Previously:ATM skimmer -- could you spot it in the wild?
ATM card skimmer in real life
ATM skimmers: man, these things are scary
HOWTO build an RFID skimmer
Read the rest
Noted security researcher Ross Anderson and colleagues have published a paper showing how "Chip-and-PIN" (the European system for verifying credit- and debit-card transactions) has been thoroughly broken and cannot be considered secure any longer. I remember hearing rumbles that this attack was possible even as Chip-and-PIN was being rolled out across Europe, but that didn't stop the banks from pushing ahead with it, spending a fortune in the process.
The flaw is that when you put a card into a terminal, a negotiation takes place about how the cardholder should be authenticated: using a PIN, using a signature or not at all. This particular subprotocol is not authenticated, so you can trick the card into thinking it's doing a chip-and-signature transaction while the terminal thinks it's chip-and-PIN. The upshot is that you can buy stuff using a stolen card and a PIN of 0000 (or anything you want). We did so, on camera, using various journalists' cards. The transactions went through fine and the receipts say "Verified by PIN".
Read the rest
It's no surprise to us or bankers that this attack works offline (when the merchant cannot contact the bank) -- in fact Steven blogged about it here last August.
But the real shocker is that it works online too: even when the bank authorisation system has all the transaction data sent back to it for verification. The reason why it works can be quite subtle and convoluted: bank authorisation systems are complex beasts, including cryptographic checks, account checks, database checks, and interfaces with fraud detection systems which might apply a points-scoring system to the output of all the above.