This is page 2 of:
Cyberthieves Using Bluetooth To Steal Gas Station Credit Card Data
Pages: 1 2
March 4th, 2010
When cyberthieves plant skimming devices inside POS PIN pads, they typically have one of two headaches. First, they have to return to the scene of the crime to retrieve the device and its stolen data, which is dangerous. If the thieves use the device to wirelessly phone the data to one of their own, it's safer initially. But if that data is detected and examined, it could lead law enforcement right to the culprits—a.k.a., problem number two.
But one group of cyberthieves in Utah—as yet uncaught—has hit about 200 gas stations in that state with a toothy tweak: Bluetooth-y, to be precise. By arming their skimmer with a Bluetooth transmitter, the stolen card data was beamed out indiscriminately to anyone nearby—make that very nearby—who happened to choose to listen for it. When such a device is found by law enforcement, it reveals nothing to point to the thieves' location—past or present—and nothing to even indicate how long it's been there. The devices in the Utah case had no local storage whatsoever, police said; they simply grabbed the data and instantly beamed it away.
This Story Is Only Available For Premium Subscribers. Click Or Login In Below To Read The Rest Of This Story.
Already a Subscriber? Login Here
Pages: 1 2
3 Comments | Read Cyberthieves Using Bluetooth To Steal Gas Station Credit Card Data
Leave a Reply
Readers, specifically those who want to comment on a story:
Our Comment SPAM system is getting very aggressive these days and has been blocking legitimate comments. If you post a comment and don't see it appear within 2 hours or so, can you please send a heads-up to customer-service@storefrontbacktalk.com? Ideally, please include the time you posted the comment. That will allow us to try and hunt for it. Thanks! P.S. We're working on fixing the system, but we don't want to lose any valuable comments in the meantime.
Our Comment SPAM system is getting very aggressive these days and has been blocking legitimate comments. If you post a comment and don't see it appear within 2 hours or so, can you please send a heads-up to customer-service@storefrontbacktalk.com? Ideally, please include the time you posted the comment. That will allow us to try and hunt for it. Thanks! P.S. We're working on fixing the system, but we don't want to lose any valuable comments in the meantime.
-Christine
March 4th, 2010 at 11:44 am
Accoding to the story, the thieves need to be very close to the pump to read the data, but I believe that with a throw-away wireless phone collecting and relaying the data, basically just a little more technology, they could collect the card numbers and pins from anywhere in the world.
This sounds like too much effort, expense and project management skills for a common criminal, this is likely a small group, probably with someone inside one of the companies that make, deliver or service the pumps.
What is scarey is that this technology can translate to other card readers and if the perpetrators add local storage, the problem is even harder to uncover as they could drive up once a week purchase gas and download the data. If they managed to get access to other POS terminals this could be a bigger problem, just walk through with a smart phone and collect the data…
The publicly known better surveillance will likely keep this technology from ATM’s and cash drawer termnals, but who knows with criminals?
The technological answer is to put a specrum analyser at the locations to monitor all wireless signals to see if there is a device translating the data an pushing it to another network.
If I had a C-store, I would have my pumps checked out by a third party to protect my customers, this could be a much bigger problem if it came from the pump distribution chain.
March 4th, 2010 at 1:14 pm
The story also pointed out that a cell connection is dangerous because it can point to the thieves, while Bluetooth, in theory, wouldn’t.
March 4th, 2010 at 1:32 pm
My question is, how did the thieves manage to implement the system in the first place? That sounds like quite an elaborate install. Did these locations run outdoor cameras at night?
I would also agree that if this elaborate of a setup was created, I find it highly unlikely there would not be some type of localized storage on the device. It seems foolish for there not to be one.
It seems interesting that the police investigating this have not used an opportunity to go “fishing for the theives” by taking out one of these devices and setting up one that is still transmitting, just bogus data. I’m not a bluetooth expert, but there is a pairing process that happens, I would think that they could at least see if the device was paired (and when) and glean some information that way.