A recent article from Brian Krebs highlights a new trend in ATM skimmers: by using parts from cut-rate audio players and spy cams, criminals are able to construct something called an audio skimmer that records the data from the magnetic strip for later playback. Also included in the device is a miniature spy cam, which captures the user's PIN. The basic methodology behind the device is nothing new (for instance, it could be found in an issue of Phrack dating back to 1992) although the use of DAPs means that the whole thing is a lot more elegant than it was in the days of the portable cassette recorder. According to a recent report by the European ATM Security Team (EAST), devices of this type have been found in five countries, two of them "major ATM deployers" (with 40,000 active ATMs or more). Please guys, don't get any ideas. PR from EAST after the break.

Speaking at the Black Hat conference in Las Vegas, a fellow named Barnaby Jack (really!) used custom software to hack Windows CE-based ATMs on stage. After using an industry standard key to gain entry to the machines (apparently many ATM owners are too lazy to install new locks) Jack was able to load a rootkit on the device using a USB thumb drive. From that point, it was just a matter of running another program that caused all the cash therein to shoot out in a comical manner. The machines used in the presentation were manufactured by Trannax and Triton, both of which have have had a chance to send a security patch to customers prior to the demonstration. However, there are four different machines in common use that are still vulnerable. And no, he won't tell us which ones.

The hooligans in this case have a dry sense of humor or are extremely unlucky: Either way, we can't help but get a chuckle out of the fact that someone placed their smart card skimmin' faux ATM at the Riviera Hotel Casino in Las Vegas -- during DEFCON, the world's largest hacker convention. No one can say exactly how long the kiosk was there -- at least the kids were smart enough to place it right outside the security office, one of the few places in the conference center not under surveillance. It was picking up on this last fact that aroused the suspicion of Brian Markus, CEO of Aries Security. When shining a light through the glass panel that should house a camera, he instead found the PC that was set up to skim people's data. He then notified security, who removed the device and once again made the world safe for hackers and their bank accounts.