BlueSMiRF found in credit card sniffer

Pt 2338
SparkFun BlueSMiRF found in credit card sniffer, interesting Sparkfun product placement. Nate writes –

That is an officer of the law holding up a device that was found within a ‘PIN pad’ in Waterloo, Ontario, Canada. I didn’t know what a PIN pad is, so here’s a wikipedia article and google images. From the article (November 5th, 2009), it looks like someone has found a couple serial pins on the hand-held credit card reader commonly used within Canadian retail stores. They’ve wired those pins to a BlueSMiRF. This allows a person sitting ~100 feet away to see all the serial traffic including all the credit card information and pin #s. Not hard – all it takes is a bit of time, and malicious intent… All things can be used for good or evil, including our products. You can build amazing things that encourage children to learn (checkout Gever Tulley’s amazing presentation at TED), or you can build things that steal. We believe that sharing knowledge and selling products that encourage innovation outweigh the inherent dangers. We believe that stifling innovation or suppressing knowledge lead to much more dangerous outcomes.

Thing about this scam is that the person(s) who modified the device needed a lot of access to the device(s) and then they need to hang around 100ft away all the time… inside job? Either way, the more this story gets out the more people will know about it.

22 thoughts on “BlueSMiRF found in credit card sniffer

  1. Bluetooth has been established at much further than 100feet!
    Even their own website says this:
    [quote]Description: The BlueSMiRF is the latest Bluetooth® wireless serial cable replacement from SparkFun Electronics! These modems work as a serial (RX/TX) pipe. Any serial stream from 9600 to 115200bps can be passed seamlessly from your computer to your target. We’ve tested these units successfully over open air at 350ft (106m)![/quote] and depending on how you set things up, there could have been a receiver close enough *inside* the store, that could have been wired to another transmitter at the edge of that store to re-broadcast further outward … very bad assumption to think someone was inside the store listening in … just needs the person more inside the store to get the device in place … but even that too could have been done if the clerk went into the back, etc.. and while gone the pin-pads were swapped out..

  2. The pin pads are easy to swipe. The only thing that connects them to the terminal is a standard phone jack/ethernet jack most of the time. Make a replacement, or acquire one from somewhere else, and it takes about 4 seconds to swap one out. I have no idea why they dont include a simple screw down plate to cover the phone jack line so someone cant snatch it quickly. They would have to take the time to unscew the plate to pull out the plug, increasing the odds they will get noticed and caught.

  3. Well I expect their stats are artificially inflated considering the link here doesn’t point to an article as you might expect just the Sales page for sparkfun.

  4. Strictly, the *attacker* didn’t need to be within range, either. He just needed to leave a logging device in range and come pick it up later. If he’s really paranoid, include a cell phone and wire the ringer to a toggle relay that cuts power to the phone and logger. Once he realizes the police are there, he could cut power to the device and eliminate RF emissions, thereby making it almost impossible to find. He’d just have to be sure to call it with another disposable mobile purchased with cash.

    This is something pretty much anybody with any electrical engineering experience could hack together in an afternoon.

  5. Here’s the original story:

    The Record often has photos in the online version; I’m not sure why this one didn’t.

    From the article, here’s how it works: “It’s believed the crimes are being carried out by several people in an organized group, Roe said. Surveillance video obtained by police shows one person taking the machine out and another putting it back.”

    I could imagine it being done at a grocery store or similar, where you have multiple checkouts, many of which will be closed at some point during the day. Nobody would notice if the pin pad went missing but was returned before a cashier started.

    For preventing this, the police suggest: “He also suggested merchants put tape across the pad so if it’s taken apart they’ll notice a split in the tape. They could also bolt the pad to their counter so it’s harder for the thief to get it.”

  6. There was a spate of thefts recently in Western Australia from a McDonalds. It turned out someone had come in and replaced all the PIN Pads with compromised units. Result – millons of dollars siphoned out of accounts, some of it to Canada.

Comments are closed.

current: @adafruit - previous: MAKE, popular science, hackaday, engadget, fallon, braincraft ... howtoons, 2600...

View more articles by Phillip Torrone