- Thursday, 8 January 2009
- INQ Mobile
- RSS Feed
The future is here. It's just not widely distributed yet - WIlliam Gibson
Citibank ATM thieves broke PIN security
NOW WE KNOW WHY early this year - in the midst of the banking liquidity crisis caused by mounting downgrades of toxic over-leveraged debt based on souring subprime mortgage loans - Citibank abruptly cut its daily limit on ATM withdrawal amounts in half.
At the time, some alternative news sources speculated that Citibank was running perilously short of cash, although the bank claimed that it imposed the reduced withdrawal limits in response to a spike in ATM fraud.
It's turned out that Citibank was telling the truth. A small gang of ATM thieves hooked up with Russian cyber-criminals had broken into its network of ATMs in 7-Eleven convenience stores, stolen its customers' account numbers and PIN codes, and made off with millions of dollars in illegitimate withdrawals.
The thefts came to light almost by accident, as police stumbled upon an individual with large amounts of cash along with dozens of counterfeit ATM cards and electronic debit card magstripe encoding gear.
In March, US federal prosecutors obtained indictments against three people for two counts each of conspiracy and fraud - Yuriy Rakushchynets, Ivan Biltse and Angelina Kitaeva - for ATM thefts that prosecutors say netted them at least $2 million in cash. The total losses to Citibank are likely higher, as the individuals charged had reportedly transmitted 70 per cent of their haul to Russian confederates who masterminded the lifting of bank account details.
What's most troubling is that, apparently, no one knows how the thieves managed to crack Citibank's ATM network, break into a server at a third-party transactions processor, and steal not only account numbers but also the unencrypted PIN codes that enabled them to successfully withdraw funds. If anyone knows how they did it, they're not saying publicly.
PIN codes are supposed to be encrypted from the moment they're entered at the ATM's keypad, but either that security isn't being maintained everywhere in the transaction chain or the PIN encryption algorithms being used are vulnerable and in fact have been broken.
Citibank hasn't revealed how many of its depositors were victims of the thefts, which took place from October 2007 to March 2008. It has almost 5,700 ATMs painted with the Citibank logo in 7-Eleven stores all across the US, but they are owned and operated by third parties.
Cardtronics owns all of the ATM machines and operates some of them, while Fiserv operates the rest. Cardtronics won't comment; Fiserv says its servers are secure.
A floor safe and a shotgun under the bed suddenly sounds a lot more attractive. µ
L'Inq
AP
Share this:
Business Intelligence Software
Customer Relationship Management (CRM)
Enterprise Accounting Software
Enterprise Resource Planning (ERP)
Enterprise Systems Management
You will be surprised (frightened) at how much data is logged to the disk of an ATM - and never deleted. It would not surprise me if they were stupid enough to also log the PIN
from what i read on the internet, its not too hard. theres a whitepaper that was published a while back about extracting the pin out of credit cards.
PINs are encrypted using either DES or Triple-DES. PCI compliance (and other things) asks for Triple-DES. http://www.bankersonline.com/vendor_guru/diebold/diebold-pin.html The PIN shouldn't be stored anywhere but the back end. The ATM is supposed to just send it off and forget it. It is possible that the back end was storing the PINs directly and not a hash. Or the hash could have been trivially brute forced. Until (when, if) they release the details, other financial institutions may be at risk the the same attack. Of course, it could be as simple as social engineering an insider and have nothing to do with the technology.
a "mole" so to speak mentioned to me that when these atm's are installed into a shop (the ones that typically rip you off for £2 a pop now), they have to setup the user account password etc locally. otherwise, anyone who knows the details for that atm can do alot stuff on it, such as get user details, previous withdraws etc etc. I actually had these details ages ago for getting into these things, thank god i never used them, looks like this may be the missing link? if i remember correctly, it could be done in a minute or two gaining access, and then after that i have no idea.
Most likely the crack was to do with non random initial pin generation for the cards. Most people do not change the pins that are supplied with the card and it is quite possible that the coders working on the pin generation code were not too careful about entropy etc. resulting in there being a small corpus of possible pin combinations. e.g. it could easily be that there was only 1 pin given out for all cards on a specific start date, highly unlikely, but the bank would not know and the customers would only know if they told each other their pins (there are only 10000 possible pins and in the US there were 984 million bank-issued Visa and MasterCard credit and debit card accounts created in 2006!). This is only a problem if someone figures it out. Then all it takes is to clone a few cards and even if you have a 1% sucess you will still net a great deal of money. I would have thought you would be able to withdraw about 500GBP per day per card (that works) and most people will not notice till their statment comes in / bank notices, so that would give you maybe a 3-5 day opporunity, so you are talking a minimum of say 1500GBP per card that works so about 15GBP per card that is skimmed, easy money!.
The solutions challenge is not in going faster than the world's new demands - it's in out-accelerating them. I urge every business person and IT person, management or staff, to get hold of a copy of "I.T. Wars: Managing the Business-Technology Weave in the New Millennium." Our CEO has read it. Our project managers are on their second reading. Our vendors are required to read it (they can borrow our copies if they don't want to purchase it). Any agencies that wish to partner with us: We ask that they read it. Do yourself a favor and read this book - then ask your boss to read it - then ask your staff and co-workers to read it. Some fresh and original thinking from the author of "I.T. Wars" - http://www.businessforum.com/DScott_02.html