Tracking a Bluetooth Skimmer Gang in Mexico (Part I)
krebsonsecurity.com
krebsonsecurity.com
Is this just my US-centric view of the world saying this or is it really a questionable move if one values their personal safety?
Anyway this is very much the topic of more than one novel I'm sure and given he has survived to blog the tale I guess I can be less concerned about his welfare.
The only way I would have written a factual - as in, not blatantly made up - blog post like we just read (absent basically any mention whatsoever of personal danger) is if the whole thing really took place in Southeast China, oh, and in 1996, oh and it wasn't ATM machines it was vending machines - and it wasn't bluetooth it was FM radio. With literally every detail changed. Throw in a picture of a hotel in Mexico and you're good to go.
The alternative, that he is just making all of this up, seems just so much more plausible.
I've now also watched the video. I don't know - would bluetooth signals from deep inside a machine - as you can see, in the video, the bluetooth transmitter is occluded by an entire printed circuit board - go all the way across the lobby to reach him? (as in the video)
Secondly, since it is SO innocuous to take out a cell phone in front of an ATM (I would have zero qualms doing this) to check, wouldn't this post have generated literally hundreds of comments from people checking an ATM and finding said signal? Nobody would mind doing that.
(By the way, I don't have an issue with the "laziness" of the solution he purportedly uncovered, i.e. transmitting a bluetooth device signal with the default name, as it is not obvious how to make a transmitter turn on only in response to a signal from a commodity cell phone that has nothing incriminating on it. So technologically it seems to be okay for me.)
But the whole story doesn't really add up. Someone else here mentions that supposedly he regularly reads some spammer forum where they coordinated sending him cocaine in the mail and then SWATting his house. This just seems so incredibly unlikely to me - i.e. a fabrication. How many forums can one person read?
It just seems to be made up. (Unless he changed huge amounts of details to other, similar details). But that seems unlikely.
In the video, do you really expect him to be able to read the ATM from across the lobby (given your experience with bluetooth, and as you can see, earlier in the video he shows the chip snuggled under a PCB, deep inside a metal enclosure?) I mean signal drops with square of distance. Bluetooth has a basic range of "typically less than 10m" (32 feet) or quite a bit less than those machines seem to be, even though those machines were not designed to be good transmission enclosures. Take a look:
https://www.youtube.com/watch?v=Pi6y2soOp8Y&t=4m45s
What's more likely:
1. That:
- That that phone is picking up a commodity bluetooth signal from that distance that we see, and
- The iPhone doesn't pick up said signal even if the iphone is next to it.
Or:
2: That
- He has two bluetooth transmitters near the phone he is using
- He mentioned that an iPhone doesn't work so that people aren't surprised when they can't reproduce anywhere.
Also, notice that the original text includes NO reference to what is in Part 2, which makes me think he is writing it in such a way that he leaves part 2 open to addressing any concerns incredulous people might raise.
Most of the video is just still shots from sources you can see online. There's no recording of a meeting taking place. It just looks like some guy, with an over-the-top story and zero concern, whatsoever, for his safety.
If others here think my analysis is unwarranted, could you address the specific issues I raise?
EDIT: Please stop downvoting me without a response. If you address my specific concerns I'm happy to delete this comment.
Regarding your issue with metal enclosures, there’s plenty of non-metal or thin-metal windows: the screen for one.
Why does he feel immune from Mexican violence? (i.e. please give me a plausible answer.) It seems absolutely rampant there, people are literally - no exaggeration - murdered there.
(Obviously the reason for a throwaway account is because I don't want to associate even two steps removed with violence in Mexico as well as, for example, the knee-jerk downvoting.)
Secondly, did you click the video? (I link a specific spot.) It's hard to judge due to the distance and the fisheye distortion, but how far do you think those two ATM's are? Why do you think an iPhone won't connect with them? (Even from much closer)? If the signal is weak, as opposed to being in the gadgetry next to him, then why do both bluetooth connections show up instantly, as opposed to one after the other, given the huge distance?
I now realize he has a large established reputation - though I don't have time to review all of his past writing. It's too much to review it all.
I would like to know why he can pick up a weak bluetooth transmitter from deep inside an ATM and under a massively attenuating circuit board, from far outside the nominal bluetooth range - which are figures for a purpose-built transmission enclosure, not being hidden under a circuit board, and then put inside an ATM. It simply does not seem plausible to me, and I would like an answer. I've worked a little bit with wireless equipment (not much) and the video does not seem realistic to me.
Further: bBlatantly exposing a well-funded mexican crime syndicate also does not seem in-character for anyone. What makes this guy so immune? Why are there no steps whatsoever to protect his identity, even while in Mexico? He reports a meeting with 6 employee (no photos included, including after blurring their faces) any one of whom could have reported his meddling to an associated syndicate, before his stay was even over. Wasn't he scared?
These are specific objections I have, and I'm sorry I don't have time to review his entire reputation and history; Lance Armstrong had never once tested positive for PED's while winning 7 Tour De France titles and having a good claim to being possibly the most-tested athlete on Earth; Bernie Madoff had been the Chairman - literally the Chairman - of the NASDAQ. Yes, the whole stock exchange. He also had an operation going back 30 years, was a preeminent community member and managed the endowments of several charities.
So please don't appeal to authority, and instead answer my two specific questions. Also, since his exposure, anyone found such a transmitter themselves?
I find the technical facts he proposes to be entirely plausible.
There are no steps to protect his identity simply because the reputation he's built up for many years as an infosec journalist is that of a badass. You said you don't have time to review all his work, maybe if you did you'd be able to answer your own question on his motives to not hide in the shadows or behind a mask (its because this is his livelihood and reputation).
No appeal to authority, just the facts as I see them. Not sure what Lance has to do with this, but you seem to be reaching for straws.
For the former, read his book Spam Nation. It is a wonderful book from the beginning of his adventures into infosec journalism. I finished it in three days.
krebsonsecurity.com/tag/spam-nation/
Mexico is a very dangerous place for journalists and becoming more dangerous every year, but even when we hear about Mexican journalists getting murdered, it's usually for pointing fingers much higher up than "ATM hackers" (the most famous recent case has to do with an investigation into a Governor's activities). One has to assume the threshold for causing an international incident is even higher. The people being busted here are "just" scammers, even if embedded within a larger criminal network.
p.s. My only qualification for answering this is having lived in Mexico. I claim no knowledge of criminal structures there other than what is known from general news and culture. I would not bet my own life on this analysis.
He is depriving a criminal gang of a source of income. That feels risky!
So yeah, you are pretty much risking a grusome ending.
US is paying a price for building up China overseas instead of next door neighbors instead.
If it were me, I would have either:
1. Require a secret pin to be entered in order to activate the bluetooth. 2. Don't use bluetooth. For example the nRF51822 chip (e.g. in this module [1] allows you to implement your own radio protocols. You could make it impossible to detect - it could only respond when send a secret code of some sort.
[1] http://www.seeedstudio.com/depot/Seeed-Micro-BLE-Module-w-Co...
In a sense, hackers are really good MVP creators. Make something that works and optimize on cash flow.
And once more I consider scraping the mag-stripe off my debit card.
I would think chip and pin should mitigate this kind of card skimming though...