Cambridge university refuses to censor student's thesis on chip-and-PIN vulnerabilities

After the UK banking trade association wrote to Cambridge university to have a student's master's thesis censored because it documented a well-known flaw in the chip-and-PIN system, Cambridge's Ross Anderson sent an extremely stiff note in reply:

Second, you seem to think that we might censor a student's thesis, which is lawful and already in the
public domain, simply because a powerful interest finds it inconvenient.

Read the rest

Sales pitch from an ATM-skimmer vendor

Brian Krebs tracked down a black-market retailer of mobile-phone-based ATM skimmers that capture your PIN and transmit it to fraudsters over the GSM network. The vendor gave him the whole sales-pitch for the efficiency and safety (for the criminals) of GSM-based skimmers. — Read the rest

Accused ATM-skimmer swallows USB drive in custody, doctors remove from his gut

Smoking Gun reports that a NYC man accused of participating in an ATM-skimming ring was raided by feds, and in an unusual attempt to destroy evidence, grabbed a flash drive and swallowed it whole while in the custody of Secret Service agents:

kingston.jpg[I]n the view of investigators, [Florin] Necula "grabbed Subject Flash Drive 2, which had been on his person at the time of his arrest, and swallowed," Agent Joseph Borger noted in the below February 25 search warrant affidavit.

Read the rest

Chip-and-PIN is broken

Noted security researcher Ross Anderson and colleagues have published a paper showing how "Chip-and-PIN" (the European system for verifying credit- and debit-card transactions) has been thoroughly broken and cannot be considered secure any longer. I remember hearing rumbles that this attack was possible even as Chip-and-PIN was being rolled out across Europe, but that didn't stop the banks from pushing ahead with it, spending a fortune in the process. — Read the rest