Reply to: Cash machines

[Paddy]

Pins are just 4 digits - encrypting just them is crazy because it is easy to check less than 10k combinations using plain text attack.

The banks had a choice of 4 or 6 digits, they opted for 4

Your pin number is here... http://www.positiveatheism.org/crt/pin.htm

[Paddy]

Surely the transaction is encrypted though or could someone just tap in and sniff their traffic?

No, it's not encrypted. Nor is the Visa and Mastercard interbank system.

[bored]

How would that work? 3 incorrect attempts and strike-out, surely?

AtW's idea is to try and encrypt each of 4 digit numbers until the encrypted text matches the intercept. However, if the ATM adds some random data before encrypting the PIN (it should), then such attack won't work.

/geek_mode off

[Peoplesoft bloke]

Same to you. I hope your next poo's a hedgehog.

Charmed I'm sure

[Bob Dalek]

Pins are just 4 digits - encrypting just them is crazy because it is easy to check less than 10k combinations using plain text attack.

How would that work? 3 incorrect attempts and strike-out, surely?

[Incognito]

No - have a nice weekend.

Same to you. I hope your next poo's a hedgehog.

[Peoplesoft bloke]

Are you not dead yet?

No - have a nice weekend.

[Incognito]

Only people with no brain think they are the answer to anything

Are you not dead yet?

[Peoplesoft bloke]

For that they're not.

Only people with no brain think they are the answer to anything

[Incognito]

Pins are just 4 digits - encrypting just them is crazy because it is easy to check less than 10k combinations using plain text attack.

What are you on about? The article is on about the Server back in the datacentre where you'd think they'd encrypt the PINs so that nosy admin type doesn't have a quick browse through them.

[ratewhore]

Remember this?

I never use the non-bank owned ATM's. Not for security mind you, because I'm too tight to pay £1.99 to withdraw £20...

[AtW]

Pins are just 4 digits - encrypting just them is crazy because it is easy to check less than 10k combinations using plain text attack.

[Incognito]

Even better

http://www.theinquirer.net/gb/inquir...eves-broke-pin

What's most troubling is that, apparently, no one knows how the thieves managed to crack Citibank's ATM network, break into a server at a third-party transactions processor, and steal not only account numbers but also the unencrypted PIN codes that enabled them to successfully withdraw funds. If anyone knows how they did it, they're not saying publicly.

I wonder if they all use their username as their password?

[Incognito]

Flucking bell

[ratewhore]

An IP-ATM is connected to the payment processor using a TCP/IP connection. However, while the PIN number is triple-DES encrypted, the messages themselves are not. In January 2008, an analysis of ATM network traffic by Network Box found that only the PIN number was encrypted and that a large portion of the traffic travelled in plain text, leaving card numbers, card expiry dates, transaction amounts and account balances clearly readable. Therefore, a hacker needs only to access some part of the IP network between the IP-ATM and the payment processor to be privy to the aforementioned details.

linky