Biometric skimmers are here

October 2016 News, Cyber Security

Kaspersky Lab experts have investigated how cybercriminals could exploit new ATM authentication technologies planned by banks. While many financial organisations consider biometric-based solutions to be one of the most promising additions to current authentication methods, if not a complete replacement for them, cybercriminals see biometrics as a new opportunity to steal sensitive information.

ATMs have for years been in the sights of fraudsters hunting card data. It all started with primitive skimmers – homemade devices attached to an ATM, capable of stealing information from the card’s magnetic strip and PIN code with help of a fake ATM PIN pad or a web camera. Over time, the design of such devices was improved to make them less visible.

With the implementation of much harder, but not impossible to clone chip-and-PIN payment cards the devices evolved into so-called ‘shimmers’: largely the same, but able to gather information from the card’s chip, giving sufficient information to conduct an online relay attack. The banking industry is responding with new authentication solutions, some of which are based on biometrics.

According to a Kaspersky Lab investigation into underground cybercrime, there are already at least 12 sellers offering skimmers capable of stealing victims’ fingerprints. And at least three underground sellers are already researching devices that could illegally obtain data from palm vein and iris recognition systems.

The first wave of biometric skimmers was observed in 'presale testing' in September 2015. Evidence collected by Kaspersky Lab researchers reveals that during the initial testing, developers discovered several bugs. However, the main problem was the use of GSM modules for biometric data transfer – they were too slow to transfer the large volume of data obtained. As a result, new versions of skimmers will use other, faster data transfer technologies.

There are also signs of ongoing discussions in underground communities regarding the development of mobile applications based on placing masks over a human face. With such an app, attackers can take a person’s photo posted on social media and use it to fool a facial recognition system.

”The problem with biometrics is that, unlike passwords or PIN codes which can be easily modified in the event of compromise, it is impossible to change your fingerprint or iris image. Thus if your data is compromised once, it won’t be safe to use that authentication method again. That is why it is extremely important to keep such data secure and transmit it in a secure way. Biometric data is also recorded in modern passports – called e-passports – and visas. So, if an attacker steals an e-passport, they don’t just possess the document, but also that person’s biometric data. They have stolen a person’s identity,” said Olga Kochetova, security expert at Kaspersky Lab.

The use of tools capable of compromising biometric data is not the only potential cyberthreat facing ATMs, according to the Kaspersky Lab researchers. Hackers will continue to conduct malware-based attacks, blackbox attacks and network attacks to seize data that can later be used to steal money from banks and its customers.


Credit(s)




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

TAPA: The role of an effective treasury function in business risk management
June 2019, Technews Publishing , News
Neil Le Roux, the Founder of Diligent Advisors will speak at the TAPA SA (Transported Asset Protection Association) annual conference on 26 July 2019.

Read more...
From the editor's desk: Of sore feet and new websites
June 2019, Technews Publishing , News
I hope everyone has recovered from the hustle and bustle of Securex. This year was once again an exhausting event and now we’re left with following up. For Hi-Tech Security Solutions it was a good show ...

Read more...
Where are your crown jewels?
June 2019, Wolfpack Information Risk , Commercial (Industry), Cyber Security, Security Services & Risk Management
Understanding what data they store and analyse is gaining increasing urgency for organisations that are now accountable to new(ish) privacy regulations such as the GDPR and our PoPIA.

Read more...
Axis 7th generation ARTPEC chip
June 2019, Axis Communications SA , Editor's Choice, CCTV, Surveillance & Remote Monitoring, Cyber Security
Axis has launched its 7th generation ARTPEC chip, optimised for network video, to improve all the signature Axis technologies created to address difficult light conditions.

Read more...
Does green cost more?
June 2019 , News, Commercial (Industry)
GBCA, ASAQS and UP launch the 2019 edition of Green Building in South Africa: Guide to Costs & Trends.

Read more...
Partnership to reduce farm violence and agricultural crime
June 2019, Fidelity ADT Security , News, Security Services & Risk Management, Agriculture (Industry)
Agri SA has partnered with Fidelity ADT, a subsidiary of the Fidelity Services Group, to offer a range of services and products to its members and the rural community.

Read more...
Centurion announces new board of directors
June 2019, Centurion Systems , News, Access Control & Identity Management
After more than 30 years at the helm of access automation manufacturer, Centurion, co-founder Pat Dickens stepped down as the company’s MD at the end of March, with current sales and marketing director Richard Rohman being named as his successor.

Read more...
Password awareness critical
June 2019, Kaspersky Lab , Cyber Security, Security Services & Risk Management
A recent study revealed that digital identity data and information holds significant value to cybercriminals – who craft ways of gaining this data and exploit it on the dark Web for as little as $50.

Read more...
Kaspersky Lab to open office in Kigali, Rwanda
June 2019, Kaspersky Lab , News, Cyber Security
Kaspersky Lab has announced plans to open a new office in Kigali, Rwanda, to support the rapid growth of its business in East Africa.

Read more...
Fully automated cash logistics
June 2019 , News, Security Services & Risk Management
Cash management company, Izicash, announced its adoption of Transtrack, a software solution, supported by a South African company, AllCash, which streamlines the cash logistics process.

Read more...