Watch out for this ATM Fraud in India in 2023!
@rokusense | RokuSense
Created a year ago (Last Update: a year ago)
💚 Less than 10 views
Keywords
security news
A new type of fraud using the fingerprint heat signature attack, has come into light in the ATMs, keypad lock machines, POS etc in India. In this fraud, the attacker cracks the password/pin by examining the heat signatures that the fingerprints leave after entering the pin/password on the keypad. Whenever we press certain keys on the keypad, those keys have more heat as compared to ones which are not pressed. This difference in heat between the keys leads to an attacker guessing the password/pin.
FHS attacks are carried out using thermal imaging and Artificial Intelligence(AI). Thermal imaging is simply a process of converting heat into visible images that depicts the spatial distribution of temperature difference in a scene captured by a thermal camera [1]. Figure 1 shows the thermal image of a keypad lock, the red bigger and darker red circles shows that those buttons have been pressed recently. From the thermal imaging, it can be easily guessed that the pin of this keypad lock is either 8514 or 5814. Since the largest red circles on number 5 and 8 seems to appear similar followed by the circle on 1 which is smaller but darker in color and then lastly the number 4 which is same as 1 in size but lighter.
The attacker first places a hidden thermal camera such that the keypad is clearly visible. When a user finishes using the machine, the thermal camera clicks a picture of the keypad. The attacker then accesses these thermal pictures and then these images are then processed by AI algorithms to accurately predict the passwords. These AI algorithms check for the brighter areas in the thermal image because the brighter the area on the thermal image the more recently it would have been touched. This information in turn allows the fraudsters to determine the possible pin combinations.
FHS attack is generally carried out in conjunction with other attacks such as card skimming, hacking unsecured Wi-Fi Networks which are being used for payments, phishing links, data breaches, malware etc.
Avoid using ATMs that are unguarded or do not have a surveillance camera.Press multiple random number keys on the keypad lock before leaving the ATM machines/POS/smart locks etc to generate non-meaningful heat signatures.Always check if there are any attachments to the ATM or if there are any attachments on the walls of the ATM and report it to the concerned authorities if any such attachments are spotted.
Every now and then new attacks are emerging in the industry and to best guard yourself it is highly suggested to stay vigil about your environment and always follow security best practices.
References
