"Pak" it in... Was chip & pin ever safe?!?!
"Pak" it in... Was chip & pin ever safe?!?!
Author
Discussion

Frederick

Original Poster:

5,894 posts

250 months

Sunday 12th October 2008
quotequote all
http://www.timesonline.co.uk/tol/news/uk/crime/art...

If the powers that be had simply invested a few more quid in making the C&P systems use random encryption, this could have been avoided.

One has to wonder though, how someone at the factory could tamper with the units or be unaware of a tampered unit. Apparently a chip takes the details and transmits them to Lahore...

Ok, couple of problems with this... 1: if it's a transmitter using the mobile network - there will be a SIM card of some description, plus antenna hardware, GSM hardware etc - each unit will be traceable even if it's using foreign SIM cards as they'd still have to sign onto the UK network.

2: This amount of hardware would be detectable to anyone with half a brain who decides to look at the insides of the unit (in a manner of "oh, what's that SIM card doing there?".

A non story or just utterly shoddy reporting? C&P needs an overhaul though, random encryption is needed sooner rather than later.

V8mate

45,899 posts

219 months

Sunday 12th October 2008
quotequote all
Short range wireless or bluetooth? Local 'agents' nip along to shops where the suspicious terminals are known to be installed and hang around 'playing with their pda' for a while?

Just a thought. I read the article in the paper this morning and was as puzzled as you.

tinman0

18,231 posts

270 months

Sunday 12th October 2008
quotequote all
Depends who is getting burned in the fraud to be honest.

If you draw the money out of a foreign cash machine, its that bank that gets walloped with the loss as it was their machine that was deceived.

Always said C&P was not the solution, but this fraud isn't much to do with C&P as its just another capture device.

elster

17,517 posts

240 months

Sunday 12th October 2008
quotequote all
Frederick said:
http://www.timesonline.co.uk/tol/news/uk/crime/art...

If the powers that be had simply invested a few more quid in making the C&P systems use random encryption, this could have been avoided.

One has to wonder though, how someone at the factory could tamper with the units or be unaware of a tampered unit. Apparently a chip takes the details and transmits them to Lahore...

Ok, couple of problems with this... 1: if it's a transmitter using the mobile network - there will be a SIM card of some description, plus antenna hardware, GSM hardware etc - each unit will be traceable even if it's using foreign SIM cards as they'd still have to sign onto the UK network.

2: This amount of hardware would be detectable to anyone with half a brain who decides to look at the insides of the unit (in a manner of "oh, what's that SIM card doing there?".

A non story or just utterly shoddy reporting? C&P needs an overhaul though, random encryption is needed sooner rather than later.
Couldn't you just get it to connect to a different number through the landline?

steve_amv8

1,918 posts

240 months

Sunday 12th October 2008
quotequote all
At least one very large UK retailer is now warning staff to beware when C&P readers are changed as the result of incidents where C&P readers have been swaped by engineers who claim to be visiting to fix a reported fault in a unit ...

JWH

512 posts

294 months

Sunday 12th October 2008
quotequote all
steve_amv8 said:
At least one very large UK retailer is now warning staff to beware when C&P readers are changed as the result of incidents where C&P readers have been swaped by engineers who claim to be visiting to fix a reported fault in a unit ...
The one I work for hasn't yet been targetted but is briefing all employees to be on guard for the above scenario.#

marshalla

15,902 posts

231 months

Sunday 12th October 2008
quotequote all
steve_amv8 said:
At least one very large UK retailer is now warning staff to beware when C&P readers are changed as the result of incidents where C&P readers have been swaped by engineers who claim to be visiting to fix a reported fault in a unit ...
How on earth can an "engineer" swap a unit without the retailer's staff checking that a fault has really been reported ? Sloppy, shoddy, inadequate processes.

steve_amv8

1,918 posts

240 months

Monday 13th October 2008
quotequote all
marshalla said:
steve_amv8 said:
At least one very large UK retailer is now warning staff to beware when C&P readers are changed as the result of incidents where C&P readers have been swaped by engineers who claim to be visiting to fix a reported fault in a unit ...
Sloppy, shoddy, inadequate processes.
... and that surprises you why? .... whistle

marshalla

15,902 posts

231 months

Monday 13th October 2008
quotequote all
steve_amv8 said:
marshalla said:
steve_amv8 said:
At least one very large UK retailer is now warning staff to beware when C&P readers are changed as the result of incidents where C&P readers have been swaped by engineers who claim to be visiting to fix a reported fault in a unit ...
Sloppy, shoddy, inadequate processes.
... and that surprises you why? .... whistle
Fair point. I shall now be enquiring, of all retailers, when their C&P unit was last subject to "maintenance" and whether it was properly planned or not before disclosing any details to them.

Ah feck it - I'm going to start bartering - anyone want 2 hours of car washing in return for two dozen eggs ?

anonymous-user

84 months

Monday 13th October 2008
quotequote all
Sounds like a good deal to me. Do you travell?

Stigmundfreud

22,454 posts

240 months

Monday 13th October 2008
quotequote all
the major issue with that report claims that 100m has been lost in America. Well America never issued chip and pin so its a non-item in that sense