Kiss from a Rogue: Evaluating Detectability of Pay-at-the-Pump Card Skimmers
Kiss from a Rogue: Evaluating Detectability of Pay-at-the-Pump Card Skimmers
复制标题
盗贼之吻：评估抽水机刷卡器的可检测性
DOI：
--
复制
发表时间：
2019
期刊：
影响因子：
--
通讯作者：
Lisa Anthony
中科院分区：
文献类型：
--
作者：
Nolen Scaife;Jasmine Bowers;Christian Peeters;Grant Hernandez;Imani N. Sherman;Patrick Traynor;Lisa Anthony
信用卡和借记卡使金融交易在无人值守的“在泵”加油站终端在北美。攻击者谨慎地打开这些泵并安装撇取器，这些撇取器复制敏感的卡数据。虽然EMV（“芯片和PIN”）已经在传统零售商中取得了实质性进展，但是由于成本显著提高和物流/监管限制，这种系统几乎没有在加油站支付终端部署，使得消费者在这些情况下容易受到伤害。为了提高安全性，加油站所有者部署了安全指示器，如低成本的防篡改封条，技术人员为移动的手机开发了撇油器检测应用程序。这些解决方案不仅使消费者有责任注意到泵的安全问题并作出反应，而且这些解决方案的有效性尚未得到衡量。在本文中，我们评估了消费者检测撇油器的指标。我们对iOS和Android设备上所有已知的撇油器检测应用程序进行全面拆解，然后对多个执法机构恢复的真实气泵撇油器硬件进行取证分析。最后，我们分析了反撇油器的泵业主/运营商部署的机制，并增加了撇油器的报告和附带的安全措施收集的佛罗里达农业和消费者服务部在四年的分析调查，使这类设备的最全面的长期研究。我们的研究结果表明，常见的气泵安全指标不仅不能有效地使消费者检测篡改，但可能会提供一种虚假的安全感。因此，必须制定更强有力、可靠、廉价的措施，保护消费者和商家免受欺诈。
Credit and debit cards enable financial transactions at unattended "pay-at-the-pump" gas station terminals across North America. Attackers discreetly open these pumps and install skimmers, which copy sensitive card data. While EMV (“chip-and-PIN”) has made substantial inroads in traditional retailers, such systems have virtually no deployment at pay-at-the-pump terminals due to dramatically higher costs and logistical/regulatory constraints, leaving consumers vulnerable in these contexts. In an effort to improve security, station owners have deployed security indicators such as low-cost tamper-evident seals, and technologists have developed skimmer detection apps for mobile phones. Not only do these solutions put the onus on consumers to notice and react to security concerns at the pump, but the efficacy of these solutions has not been measured. In this paper, we evaluate the indicators available to consumers to detect skimmers. We perform a comprehensive teardown of all known skimmer detection apps for iOS and Android devices, and then conduct a forensic analysis of real-world gas pump skimmer hardware recovered by multiple law enforcement agencies. Finally, we analyze anti-skimmer mechanisms deployed by pump owners/operators, and augment this investigation with an analysis of skimmer reports and accompanying security measures collected by the Florida Department of Agriculture and Consumer Services over four years, making this the most comprehensive long-term study of such devices. Our results show that common gas pump security indicators are not only ineffective at empowering consumers to detect tampering, but may be providing a false sense of security. Accordingly, stronger, reliable, inexpensive measures must be developed to protect consumers and merchants from fraud.
Chameleon WiFi接入点病毒的检测与分析
影响因子：
3.6
作者：
Milliken J
通讯作者：
Milliken J