{"id":35337,"date":"2019-10-31T22:03:44","date_gmt":"2019-10-31T19:03:44","guid":{"rendered":"https:\/\/prohoster.info\/blog\/karding-i-chyornye-yashhiki-kak-vzlamyvayut-bankomaty-segodnya\/"},"modified":"2019-10-31T22:03:44","modified_gmt":"2019-10-31T19:03:44","slug":"karding-i-chyornye-yashhiki-kak-vzlamyvayut-bankomaty-segodnya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/karding-i-chyornye-yashhiki-kak-vzlamyvayut-bankomaty-segodnya","title":{"rendered":"Karding a \u201e\u010dern\u00e9 sk\u0159\u00ed\u0148ky\u201c: jak se dnes hackuj\u00ed bankomaty","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u017delezn\u00e9 boxy pln\u00e9 pen\u011bz stoj\u00edc\u00ed na ulic\u00edch m\u011bsta nemohou nezaujmout pozornost milovn\u00edk\u016f rychl\u00e9ho zisku. A pokud se d\u0159\u00edve pro vykr\u00e1d\u00e1n\u00ed bankomat\u016f pou\u017e\u00edvaly \u010dist\u011b fyzick\u00e9 metody, nyn\u00ed se st\u00e1le \u010dast\u011bji uplat\u0148uj\u00ed sofistikovan\u011bj\u0161\u00ed triky spojen\u00e9 s po\u010d\u00edta\u010di. V sou\u010dasnosti je nejaktu\u00e1ln\u011bj\u0161\u00edm z nich \"\u010dern\u00fd box\" s jednodeskov\u00fdm po\u010d\u00edta\u010dem uvnit\u0159. O tom, jak funguje, si pov\u00edme v tomto \u010dl\u00e1nku.<\/p>\n

<\/p>\n

\u2013 Evoluce bankomatov\u00e9ho kardinusu<\/a><\/noindex>
\n\u2013 Prvn\u00ed sezn\u00e1men\u00ed s \"\u010dern\u00fdm boxem\"<\/a><\/noindex>
\n\u2013 Anal\u00fdza bankomatov\u00fdch komunikac\u00ed<\/a><\/noindex>
\n\u2013 Odkud se berou \"\u010dern\u00e9 boxy\"?<\/a><\/noindex>
\n\u2013 \"Posledn\u00ed m\u00edle\" a fale\u0161n\u00e9 zpracovatelsk\u00e9 centrum<\/a><\/noindex><\/p>\n

<\/p>\n

\"Karding<\/p>\n

<\/a><\/noindex><\/p>\n

\u0158editel mezin\u00e1rodn\u00ed asociace producent\u016f bankomat\u016f (ATMIA) vyzdvihl<\/a><\/noindex> \"\u010dern\u00e9 boxy\" jako nejnebezpe\u010dn\u011bj\u0161\u00ed hrozbu pro bankomaty.<\/em><\/p>\n

<\/p>\n

Typick\u00fd bankomat je soubor ji\u017e hotov\u00fdch elektromechanick\u00fdch komponent\u016f um\u00edst\u011bn\u00fdch v jednom pouzd\u0159e. V\u00fdrobci bankomat\u016f stav\u00ed sv\u00e9 \u017eelezn\u00e9 v\u00fdtvory z za\u0159\u00edzen\u00ed na v\u00fddej bankovek, \u010dte\u010dek karet a dal\u0161\u00edch komponent\u016f, kter\u00e9 ji\u017e byly vyvinuty extern\u00edmi dodavateli. Je to takov\u00fd LEGO set pro dosp\u011bl\u00e9. Hotov\u00e9 komponenty se umis\u0165uj\u00ed do pouzdra bankomatu, kter\u00e9 obvykle sest\u00e1v\u00e1 ze dvou sekc\u00ed: horn\u00ed sekce (\"kabinet\" nebo \"servisn\u00ed z\u00f3na\") a doln\u00ed sekce (trezor). V\u0161echny elektromechanick\u00e9 komponenty jsou p\u0159ipojeny pomoc\u00ed port\u016f USB a COM k syst\u00e9mov\u00e9 jednotce, kter\u00e1 v tomto p\u0159\u00edpad\u011b slou\u017e\u00ed jako hostitel. U star\u0161\u00edch model\u016f bankomat\u016f lze tak\u00e9 naj\u00edt p\u0159ipojen\u00ed prost\u0159ednictv\u00edm SDC sb\u011brnice.<\/p>\n

\n<\/a><\/noindex><\/p>\n

Evoluce bankomatov\u00e9ho kardinusu<\/h1>\n

<\/p>\n

Bankomaty s obrovsk\u00fdmi sumami uvnit\u0159 neust\u00e1le l\u00e1kaj\u00ed kardinury. Zpo\u010d\u00e1tku kardinury vyu\u017e\u00edvaly pouze hrub\u00e9 fyzick\u00e9 nedostatky ochrany bankomat\u016f \u2013 pou\u017e\u00edvaly skimmery a shimery k kr\u00e1de\u017ei dat z magnetick\u00fdch prou\u017ek\u016f; fale\u0161n\u00e9 PIN pady a kamery pro sledov\u00e1n\u00ed PIN k\u00f3d\u016f; a dokonce i fale\u0161n\u00e9 bankomaty.<\/p>\n

<\/p>\n

Pot\u00e9, co bankomaty za\u010daly b\u00fdt vybaveny unifikovan\u00fdm softwarem pracuj\u00edc\u00edm podle jednotn\u00fdch standard\u016f, jako je XFS (eXtensions for Financial Services), \u2013 za\u010dali kardinury \u00fato\u010dit na bankomaty po\u010d\u00edta\u010dov\u00fdmi viry.<\/p>\n

<\/p>\n

Mezi nimi Trojan.Skimmer, Backdoor.Win32.Skimer, Ploutus, ATMii a dal\u0161\u00ed \u010detn\u00e9 pojmenovan\u00e9 i nepojmenovan\u00e9 malware, kter\u00e9 kardinury instaluj\u00ed na host bankomatu bu\u010f prost\u0159ednictv\u00edm bootovac\u00ed flashky, nebo prost\u0159ednictv\u00edm TCP portu pro vzd\u00e1lenou spr\u00e1vu.<\/p>\n

<\/p>\n

\"Karding
\nProces nakazen\u00ed bankomatu<\/em><\/p>\n

<\/p>\n

Z\u00edsk\u00e1n\u00edm podsystemu XFS m\u016f\u017ee malware pos\u00edlat p\u0159\u00edkazy za\u0159\u00edzen\u00ed na v\u00fdb\u011br bankovek bez autorizace. M\u016f\u017ee tak\u00e9 pos\u00edlat p\u0159\u00edkazy \u010dtec\u00edmu za\u0159\u00edzen\u00ed: \u010d\u00edst\/zapisovat magnetick\u00fd prou\u017eek bankovn\u00ed karty a dokonce extrahovat historii transakc\u00ed ulo\u017eenou na \u010dipu EMV karty. Zvl\u00e1\u0161tn\u00ed pozornost si zaslou\u017e\u00ed EPP (Encrypting PIN Pad; \u0161ifrovan\u00e1 kl\u00e1vesnice pro PIN). P\u0159edpokl\u00e1d\u00e1 se, \u017ee zad\u00e1van\u00fd PIN k\u00f3d nelze odchytit. Nicm\u00e9n\u011b XFS umo\u017e\u0148uje pou\u017e\u00edvat EPP kl\u00e1vesnici ve dvou re\u017eimech: 1) otev\u0159en\u00fd re\u017eim (pro zad\u00e1v\u00e1n\u00ed r\u016fzn\u00fdch \u010d\u00edseln\u00fdch parametr\u016f, jako je \u010d\u00e1stka k v\u00fdb\u011bru); 2) bezpe\u010dn\u00fd re\u017eim (do kter\u00e9ho se EPP p\u0159ep\u00edn\u00e1, kdy\u017e je t\u0159eba zadat PIN k\u00f3d nebo \u0161ifrovac\u00ed kl\u00ed\u010d). Tato vlastnost XFS umo\u017e\u0148uje \u00fato\u010dn\u00edkovi prov\u00e1d\u011bt MiTM \u00fatok: odchytit p\u0159\u00edkaz k aktivaci bezpe\u010dn\u00e9ho re\u017eimu, kter\u00fd je odes\u00edl\u00e1n z hostitele na EPP, a pot\u00e9 informovat EPP kl\u00e1vesnici, \u017ee m\u00e1 pokra\u010dovat v otev\u0159en\u00e9m re\u017eimu. V reakci na tuto zpr\u00e1vu EPP pos\u00edl\u00e1 stisky kl\u00e1ves v otev\u0159en\u00e9m textu.<\/p>\n

<\/p>\n

\"Karding
\nPrincip \u010dinnosti \"\u010dern\u00e9 sk\u0159\u00ed\u0148ky\"<\/em><\/p>\n

<\/p>\n

V posledn\u00edch letech, podle \u00fadaj\u016f<\/a><\/noindex> Europol, \u0161kodliv\u00e9 programy pro bankomaty se v\u00fdrazn\u011b vyvinuly. K \u00fato\u010dn\u00edk\u016fm u\u017e nen\u00ed t\u0159eba m\u00edt fyzick\u00fd p\u0159\u00edstup k bankomatu, aby ho infikovali. Mohou infikovat bankomaty prost\u0159ednictv\u00edm vzd\u00e1len\u00fdch s\u00ed\u0165ov\u00fdch \u00fatok\u016f, p\u0159i\u010dem\u017e k tomu vyu\u017e\u00edvaj\u00ed podnikov\u00e1 s\u00ed\u0165 banky. Podle \u00fadaj\u016f<\/a><\/noindex> Skupina IB, v roce 2016, v v\u00edce ne\u017e 10 zem\u00edch Evropy, bankomaty byly vystaveny vzd\u00e1len\u00fdm \u00fatok\u016fm.<\/p>\n

<\/p>\n

\"Karding
\n\u00datok na bankomat p\u0159es vzd\u00e1len\u00fd p\u0159\u00edstup<\/em><\/p>\n

<\/p>\n

Antiviry, blokace aktualizac\u00ed firmwaru, blokace USB port\u016f a \u0161ifrov\u00e1n\u00ed pevn\u00fdch disk\u016f \u2013 do ur\u010dit\u00e9 m\u00edry chr\u00e1n\u00ed bankomat p\u0159ed viry \u00fato\u010dn\u00edk\u016f. Ale co kdy\u017e \u00fato\u010dn\u00edk nep\u0159ipojuje \u00fatok k hostitelsk\u00e9mu po\u010d\u00edta\u010di, ale se p\u0159\u00edmo p\u0159ipojuje k perif\u00e9rii (p\u0159es RS232 nebo USB) \u2013 k \u010dte\u010dce karet, PIN pad nebo za\u0159\u00edzen\u00ed na v\u00fdb\u011br hotovosti?<\/p>\n

\n<\/a><\/noindex><\/p>\n

Prvn\u00ed sezn\u00e1men\u00ed s \"\u010dernou sk\u0159\u00ed\u0148kou\"<\/h1>\n

<\/p>\n

Dnes technicky zdatn\u00ed \u00fato\u010dn\u00edci postupuj\u00ed pr\u00e1v\u011b takto<\/a><\/noindex>, s pou\u017eit\u00edm takzvan\u00fdch \u201e\u010dern\u00fdch sk\u0159\u00edn\u011bk\u201c k vykr\u00e1d\u00e1n\u00ed bankomat\u016f, co\u017e jsou specificky naprogramovan\u00e9 jednodeskov\u00e9 mikropo\u010d\u00edta\u010de, podobn\u00e9 Raspberry Pi. \u201e\u010cern\u00e9 sk\u0159\u00ed\u0148ky\u201c vypr\u00e1zdn\u00ed bankomaty do posledn\u00edho centu, zcela magick\u00fdm (z pohledu bank\u00e9\u0159\u016f) zp\u016fsobem. Kardi\u00e1\u0159i p\u0159ipojuj\u00ed sv\u00e9 kouzeln\u00e9 za\u0159\u00edzen\u00ed p\u0159\u00edmo k za\u0159\u00edzen\u00ed na v\u00fddej bankovek; aby vybrali v\u0161echny dostupn\u00e9 pen\u00edze. Tento typ \u00fatoku obch\u00e1z\u00ed v\u0161echny softwarov\u00e9 ochrany nasazen\u00e9 na hostiteli bankomatu (antiviry, kontrola integrity, \u00fapln\u00e9 \u0161ifrov\u00e1n\u00ed disku atd.).<\/p>\n

<\/p>\n

\"Karding
\n\u201e\u010cern\u00e1 sk\u0159\u00ed\u0148ka\u201c na b\u00e1zi Raspberry Pi<\/em><\/p>\n

<\/p>\n

Nejv\u011bt\u0161\u00ed v\u00fdrobci bankomat\u016f a vl\u00e1dn\u00ed tajn\u00e9 slu\u017eby, tv\u00e1\u0159\u00ed v tv\u00e1\u0159 n\u011bkolika realizac\u00edm \u201e\u010dern\u00e9 sk\u0159\u00edn\u011b\u201c, varuj\u00ed<\/a><\/noindex>, \u017ee tyto vynal\u00e9zav\u00e9 po\u010d\u00edta\u010de nut\u00ed bankomaty vyd\u00e1vat ve\u0161kerou dostupnou hotovost; 40 bankovek ka\u017ed\u00fdch 20 sekund. Tak\u00e9 tajn\u00e9 slu\u017eby varuj\u00ed, \u017ee kardi\u00e1\u0159i se nej\u010dast\u011bji zam\u011b\u0159uj\u00ed na bankomaty v l\u00e9k\u00e1rn\u00e1ch, obchodn\u00edch centrech; a tak\u00e9 na bankomaty, kter\u00e9 obsluhuj\u00ed \u0159idi\u010de \u201ena cest\u011b\u201c.<\/p>\n

<\/p>\n

D\u00e1le, aby se nezap\u00edchli p\u0159ed kamerami, nejopatrn\u011bj\u0161\u00ed kardi\u00e1\u0159i si vezmou na pomoc n\u011bjak\u00e9ho m\u00e1lo cen\u011bn\u00e9ho partnera, mu\u017ee. A aby se ten nemohl \u201e\u010dernou sk\u0159\u00ed\u0148ku\u201c p\u0159ivlastnit, pou\u017e\u00edvaj\u00ed n\u00e1sleduj\u00edc\u00ed sch\u00e9ma<\/a><\/noindex>. Odeb\u00edraj\u00ed z \u201e\u010dern\u00e9 sk\u0159\u00edn\u011b\u201c kl\u00ed\u010dovou funkcionalitu a p\u0159ipojuj\u00ed k n\u00ed smartphone, kter\u00fd pou\u017e\u00edvaj\u00ed jako kan\u00e1l pro d\u00e1lkov\u00fd p\u0159enos p\u0159\u00edkaz\u016f z\u00fa\u017een\u00e9 \u201e\u010dern\u00e9 sk\u0159\u00edn\u011b\u201c pomoc\u00ed IP protokolu.<\/p>\n

<\/p>\n

\"Karding
\nModifikace \u201e\u010dern\u00e9 sk\u0159\u00edn\u011b\u201c, s aktivac\u00ed p\u0159es vzd\u00e1len\u00fd p\u0159\u00edstup<\/em><\/p>\n

<\/p>\n

Jak to vypad\u00e1 z pohledu bank\u00e9\u0159\u016f? Na z\u00e1znamech z videokamer se odehr\u00e1v\u00e1 p\u0159ibli\u017en\u011b toto: jist\u00e1 osoba otev\u0159e horn\u00ed prostor (z\u00f3nu obsluhy), p\u0159ipoj\u00ed k bankomatu \u201ekouzelnou sk\u0159\u00ed\u0148ku\u201c, zav\u0159e horn\u00ed prostor a odch\u00e1z\u00ed. Za chv\u00edli p\u0159ich\u00e1z\u00ed n\u011bkolik lid\u00ed, na pohled b\u011b\u017en\u00ed klienti, k bankomatu a vyb\u00edraj\u00ed obrovsk\u00e9 sumy pen\u011bz. Pot\u00e9 se kardi\u00e1\u0159 vrac\u00ed a vyjme z bankomatu sv\u00e9 mal\u00e9 kouzeln\u00e9 za\u0159\u00edzen\u00ed. Obvykle je fakt \u00fatoku na bankomat \u201e\u010dernou sk\u0159\u00ed\u0148kou\u201c odhalen a\u017e po n\u011bkolika dnech: kdy\u017e se pr\u00e1zdn\u00fd trezor a protokol o v\u00fdb\u011bru hotovosti \u2013 neshoduj\u00ed. V d\u016fsledku toho zb\u00fdv\u00e1 bankovn\u00edm zam\u011bstnanc\u016fm pouze si mnout hlavu<\/a><\/noindex>.<\/p>\n

\n<\/a><\/noindex><\/p>\n

Anal\u00fdza komunikac\u00ed bankomat\u016f<\/h1>\n

<\/p>\n

Jak ji\u017e bylo zm\u00edn\u011bno, interakce mezi syst\u00e9movou jednotkou a perifern\u00edmi za\u0159\u00edzen\u00edmi prob\u00edh\u00e1 prost\u0159ednictv\u00edm USB, RS232 nebo SDC. Kardery se p\u0159ipojuj\u00ed p\u0159\u00edmo k portu perifern\u00edho za\u0159\u00edzen\u00ed a pos\u00edlaj\u00ed mu p\u0159\u00edkazy - obch\u00e1zej\u00ed hostitele. Je to pom\u011brn\u011b jednoduch\u00e9, proto\u017ee standardn\u00ed rozhran\u00ed nevy\u017eaduj\u00ed \u017e\u00e1dn\u00e9 specifick\u00e9 ovlada\u010de. A propriet\u00e1rn\u00ed protokoly, podle kter\u00fdch perif\u00e9rie a hostitel komunikuj\u00ed, nevy\u017eaduj\u00ed autorizaci (v\u017edy\u0165 za\u0159\u00edzen\u00ed se nach\u00e1z\u00ed uvnit\u0159 d\u016fv\u011bryhodn\u00e9 z\u00f3ny); a proto tyto nezabezpe\u010den\u00e9 protokoly, podle kter\u00fdch perif\u00e9rie a hostitel komunikuj\u00ed \u2013 jsou snadno odposlouch\u00e1vateln\u00e9 a snadno se podrobuj\u00ed replayov\u00fdm \u00fatok\u016fm.<\/p>\n

<\/p>\n

Tak mohou karder pou\u017e\u00edt softwarov\u00fd nebo hardwarov\u00fd analyz\u00e1tor provozu, p\u0159ipojuj\u00edc\u00ed ho p\u0159\u00edmo k portu konkr\u00e9tn\u00edho perifern\u00edho za\u0159\u00edzen\u00ed (nap\u0159\u00edklad k \u010dtec\u00edmu za\u0159\u00edzen\u00ed karet) \u2013 pro shroma\u017e\u010fov\u00e1n\u00ed p\u0159en\u00e1\u0161en\u00fdch dat. Pomoc\u00ed analyz\u00e1toru provozu se karder dozv\u00ed v\u0161echny technick\u00e9 detaily fungov\u00e1n\u00ed bankomatu, v\u010detn\u011b nedokumentovan\u00fdch funkc\u00ed jeho periferi\u00ed (nap\u0159\u00edklad funkce zm\u011bny firmwaru perifern\u00edho za\u0159\u00edzen\u00ed). V d\u016fsledku toho karder z\u00edsk\u00e1v\u00e1 plnou kontrolu nad bankomatem. P\u0159i\u010dem\u017e objevit p\u0159\u00edtomnost analyz\u00e1toru provozu je pom\u011brn\u011b obt\u00ed\u017en\u00e9. <\/p>\n

<\/p>\n

P\u0159\u00edm\u00e1 kontrola nad za\u0159\u00edzen\u00edm na v\u00fdb\u011br bankovek znamen\u00e1, \u017ee kazety bankomatu \u2013 mohou b\u00fdt vypr\u00e1zdn\u011bny bez jak\u00e9koliv registrace v logy, kter\u00e9 pravideln\u011b vytv\u00e1\u0159\u00ed software nasazen\u00fd na hostiteli. Pro ty, kte\u0159\u00ed nejsou obezn\u00e1meni s programov\u011b-hardware architekturou bankomatu, to skute\u010dn\u011b m\u016f\u017ee vypadat jako magie.<\/p>\n

\n<\/a><\/noindex><\/p>\n

Odkud se berou \u201e\u010dern\u00e9 sk\u0159\u00ed\u0148ky\u201c?<\/h1>\n

<\/p>\n

Dodavatel\u00e9 bankomat\u016f a subdodavatel\u00e9 vyv\u00edjej\u00ed ladic\u00ed n\u00e1stroje pro diagnostiku hardwarov\u00e9 \u010d\u00e1sti bankomatu, \u2013 v\u010detn\u011b elektromechaniky odpov\u011bdn\u00e9 za v\u00fdb\u011br hotovosti. Mezi takov\u00e9 n\u00e1stroje pat\u0159\u00ed: ATMDesk<\/a><\/noindex>, RapidFire ATM XFS<\/a><\/noindex>. Na obr\u00e1zku n\u00ed\u017ee je zn\u00e1zorn\u011bno je\u0161t\u011b n\u011bkolik takov\u00fdch diagnostick\u00fdch n\u00e1stroj\u016f.<\/p>\n

<\/p>\n

\"Karding
\nOvl\u00e1dac\u00ed panel ATMDesk<\/em><\/p>\n

<\/p>\n

\"Karding
\nOvl\u00e1dac\u00ed panel RapidFire ATM XFS<\/em><\/p>\n

<\/p>\n

\"Karding
\nSrovn\u00e1vac\u00ed charakteristiky n\u011bkolika diagnostick\u00fdch n\u00e1stroj\u016f<\/em><\/p>\n

<\/p>\n

P\u0159\u00edstup k takov\u00fdm n\u00e1stroj\u016fm je obvykle omezen personalizovan\u00fdmi tokeny; a funguj\u00ed pouze p\u0159i otev\u0159en\u00fdch dve\u0159\u00edch bankomatov\u00e9ho trezoru. Av\u0161ak jednodu\u0161e nahrazen\u00edm n\u011bkolika bajt\u016f v bin\u00e1rn\u00edm k\u00f3du n\u00e1stroje, karder mohou<\/a><\/noindex> Testov\u00e1n\u00ed v\u00fdb\u011bru hotovosti - obch\u00e1zen\u00ed kontrol stanoven\u00fdch v\u00fdrobcem n\u00e1stroje. Kardi jsou nainstalov\u00e1ny takov\u00e9 upraven\u00e9 n\u00e1stroje na sv\u016fj notebook nebo jednodeskov\u00fd po\u010d\u00edta\u010d, kter\u00e9 pot\u00e9 p\u0159ipojuj\u00ed p\u0159\u00edmo k za\u0159\u00edzen\u00ed vyd\u00e1vaj\u00edc\u00edmu bankovky, aby neautorizovan\u011b vyjmuly hotovost.<\/p>\n

\n<\/a><\/noindex><\/p>\n

Posledn\u00ed m\u00edle a fale\u0161n\u00e9 zpracovatelsk\u00e9 centrum<\/h1>\n

<\/p>\n

P\u0159\u00edm\u00e1 interakce s periferi\u00ed, bez komunikace s hostiteli - to je jen jeden z efektivn\u00edch trik\u016f kardin. Dal\u0161\u00ed triky se spol\u00e9haj\u00ed na to, \u017ee m\u00e1me \u0161irokou \u0161k\u00e1lu s\u00ed\u0165ov\u00fdch rozhran\u00ed, skrze kter\u00e9 bankomat komunikuje se sv\u011btem. Od X.25 po Ethernet a mobiln\u00ed s\u00edt\u011b. Mnoho bankomat\u016f lze identifikovat a lokalizovat prost\u0159ednictv\u00edm slu\u017eby Shodan (nejstru\u010dn\u011bj\u0161\u00ed pokyny k jej\u00edmu pou\u017eit\u00ed jsou uvedeny zde<\/a><\/noindex>), - s n\u00e1sledn\u00fdm \u00fatokem, parazituj\u00edc\u00edm na zraniteln\u00e9 konfigura\u010dn\u00ed bezpe\u010dnosti, lenosti administr\u00e1tora a zraniteln\u00fdch komunikac\u00edch mezi r\u016fzn\u00fdmi odd\u011blen\u00edmi banky.<\/p>\n

<\/p>\n

Posledn\u00ed m\u00edle komunikace mezi bankomatem a zpracovatelsk\u00fdm centrem je bohat\u00e1 na nejr\u016fzn\u011bj\u0161\u00ed technologie, kter\u00e9 mohou slou\u017eit jako vstupn\u00ed bod pro kardi. Interakce m\u016f\u017ee prob\u00edhat prost\u0159ednictv\u00edm dr\u00e1tov\u00e9ho (telefonn\u00ed linka nebo Ethernet) nebo bezdr\u00e1tov\u00e9ho (Wi-Fi, mobiln\u00ed s\u00edt\u011b: CDMA, GSM, UMTS, LTE) zp\u016fsobu komunikace. Bezpe\u010dnostn\u00ed mechanismy mohou zahrnovat: 1) hardwarov\u00e1 nebo softwarov\u00e1 \u0159e\u0161en\u00ed pro podporu VPN (jak standardn\u00ed, vestav\u011bn\u00e9 v opera\u010dn\u00edm syst\u00e9mu, tak od t\u0159et\u00edch stran); 2) SSL\/TLS (jak specifick\u00e9 pro konkr\u00e9tn\u00ed model bankomatu, tak od t\u0159et\u00edch stran); 3) \u0161ifrov\u00e1n\u00ed; 4) autentifikaci zpr\u00e1v.<\/p>\n

<\/p>\n

Nicm\u00e9n\u011b vypad\u00e1<\/a><\/noindex>, \u017ee pro banky p\u0159edstavuj\u00ed uveden\u00e9 technologie velmi slo\u017eit\u00e9 a proto se neobt\u011b\u017euj\u00ed se speci\u00e1ln\u00ed s\u00ed\u0165ovou ochranou; nebo ji realizuj\u00ed s chybami. V nejlep\u0161\u00edm p\u0159\u00edpad\u011b se bankomat propoj\u00ed s VPN serverem a uvnit\u0159 priv\u00e1tn\u00ed s\u00edt\u011b se p\u0159ipoj\u00ed k zpracovatelsk\u00e9mu centru. Krom\u011b toho, i kdy\u017e se bank\u00e1m poda\u0159\u00ed realizovat v\u00fd\u0161e uveden\u00e9 ochrann\u00e9 mechanismy, - kardi maj\u00ed ji\u017e efektivn\u00ed \u00fatoky proti nim. Tak i kdy\u017e bezpe\u010dnost spl\u0148uje standard PCI DSS, bankomaty z\u016fst\u00e1vaj\u00ed i nad\u00e1le zraniteln\u00e9.<\/p>\n

<\/p>\n

Jedn\u00edm z hlavn\u00edch po\u017eadavk\u016f PCI DSS je, \u017ee v\u0161echna d\u016fv\u011brn\u00e1 data mus\u00ed b\u00fdt p\u0159i p\u0159enosu p\u0159es ve\u0159ejnou s\u00ed\u0165 \u0161ifrov\u00e1na. A skute\u010dn\u011b m\u00e1me s\u00edt\u011b, kter\u00e9 byly p\u016fvodn\u011b navr\u017eeny tak, aby v nich byla data pln\u011b \u0161ifrov\u00e1na! Proto existuje poku\u0161en\u00ed \u0159\u00edct: \u201eNa\u0161e data jsou \u0161ifrov\u00e1na, proto\u017ee pou\u017e\u00edv\u00e1me Wi-Fi a GSM\u201c. Mnoho z t\u011bchto s\u00edt\u00ed v\u0161ak neposkytuje dostate\u010dnou ochranu. Mobiln\u00ed s\u00edt\u011b v\u0161ech generac\u00ed byly d\u00e1vno prolomeny. Nevratn\u011b. Existuj\u00ed dokonce poskytovatel\u00e9, kte\u0159\u00ed nab\u00edzej\u00ed za\u0159\u00edzen\u00ed pro odposlech dat p\u0159en\u00e1\u0161en\u00fdch t\u011bmito s\u00edt\u011bmi.<\/p>\n

<\/p>\n

Proto m\u016f\u017ee b\u00fdt v nebezpe\u010dn\u00e9 komunikaci nebo v \u201epriv\u00e1tn\u00ed\u201c s\u00edti, kde ka\u017ed\u00fd bankomat \u0161iroce informuje ostatn\u00ed bankomaty o sob\u011b, iniciov\u00e1no \u00fatokem typu MiTM \u201efale\u0161n\u00e9 zpracovatelsk\u00e9 centrum\u201c, co\u017e povede k tomu, \u017ee \u00fato\u010dn\u00edk p\u0159evezme kontrolu nad datov\u00fdmi toky p\u0159en\u00e1\u0161en\u00fdmi mezi bankomatem a zpracovatelsk\u00fdm centrem.<\/p>\n

<\/p>\n

Takov\u00fdm \u00fatok\u016fm MiTM<\/a><\/noindex> potenci\u00e1ln\u011b \u010del\u00ed tis\u00edce bankomat\u016f. Na cest\u011b k prav\u00e9mu zpracovatelsk\u00e9mu centru \u00fato\u010dn\u00edk vkl\u00e1d\u00e1 sv\u00e9 fale\u0161n\u00e9. Toto fale\u0161n\u00e9 zpracovatelsk\u00e9 centrum d\u00e1v\u00e1 bankomatu p\u0159\u00edkazy k vyd\u00e1v\u00e1n\u00ed bankovek. P\u0159itom \u00fato\u010dn\u00edk nastavuje sv\u00e9 zpracovatelsk\u00e9 centrum tak, aby vyd\u00e1v\u00e1n\u00ed hotovosti prob\u00edhalo bez ohledu na to, jak\u00e1 karta je vlo\u017eena do bankomatu \u2013 i kdy\u017e jej\u00ed platnost vypr\u0161ela nebo m\u00e1 nulov\u00fd z\u016fstatek. Hlavn\u00ed je, aby fale\u0161n\u00e9 zpracovatelsk\u00e9 centrum \u201epoznalo\u201c tuto kartu. Fale\u0161n\u00e9 zpracovatelsk\u00e9 centrum m\u016f\u017ee b\u00fdt bu\u010f dom\u00e1c\u00ed v\u00fdrobek, nebo simul\u00e1tor zpracovatelsk\u00e9ho centra, p\u016fvodn\u011b navr\u017een\u00fd pro lad\u011bn\u00ed s\u00ed\u0165ov\u00fdch nastaven\u00ed (dal\u0161\u00ed d\u00e1rek \u201ev\u00fdrobce\u201c \u00fato\u010dn\u00edk\u016fm).<\/p>\n

<\/p>\n

Na n\u00e1sleduj\u00edc\u00edm obr\u00e1zku je uveden<\/a><\/noindex> dump p\u0159\u00edkaz\u016f pro vyd\u00e1n\u00ed 40 bankovek ze \u010dtvrt\u00e9ho z\u00e1sobn\u00edku, kter\u00e9 byly zasl\u00e1ny z fale\u0161n\u00e9ho zpracovatelsk\u00e9ho centra a ulo\u017een\u00e9 v den\u00edc\u00edch ATM softwaru. Vypadaj\u00ed t\u00e9m\u011b\u0159 jako skute\u010dn\u00e9.<\/p>\n

<\/p>\n

\"Karding
\nDump p\u0159\u00edkaz\u016f fale\u0161n\u00e9ho zpracovatelsk\u00e9ho centra<\/em><\/p>\n

Zdroj: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0421\u0442\u043e\u044f\u0449\u0438\u0435 \u043d\u0430 \u0443\u043b\u0438\u0446\u0430\u0445 \u0433\u043e\u0440\u043e\u0434\u0430 \u0436\u0435\u043b\u0435\u0437\u043d\u044b\u0435 \u043a\u043e\u0440\u043e\u0431\u043a\u0438 \u0441 \u0434\u0435\u043d\u044c\u0433\u0430\u043c\u0438 \u043d\u0435 \u043c\u043e\u0433\u0443\u0442 \u043d\u0435 \u043f\u0440\u0438\u0432\u043b\u0435\u043a\u0430\u0442\u044c \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u043b\u044e\u0431\u0438\u0442\u0435\u043b\u0435\u0439 \u0431\u044b\u0441\u0442\u0440\u043e\u0439 \u043d\u0430\u0436\u0438\u0432\u044b. \u0418 \u0435\u0441\u043b\u0438 \u0440\u0430\u043d\u044c\u0448\u0435 \u0434\u043b\u044f \u043e\u043f\u0443\u0441\u0442\u043e\u0448\u0435\u043d\u0438\u044f \u0431\u0430\u043d\u043a\u043e\u043c\u0430\u0442\u043e\u0432 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u043b\u0438 \u0447\u0438\u0441\u0442\u043e \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043c\u0435\u0442\u043e\u0434\u044b, \u0442\u043e \u0442\u0435\u043f\u0435\u0440\u044c \u0432 \u0445\u043e\u0434 \u0438\u0434\u0443\u0442 \u0432\u0441\u0435 \u0431\u043e\u043b\u0435\u0435 \u0438\u0441\u043a\u0443\u0441\u043d\u044b\u0435 \u0442\u0440\u044e\u043a\u0438, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430\u043c\u0438. \u0421\u0435\u0439\u0447\u0430\u0441 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0439 \u0438\u0437 \u043d\u0438\u0445 \u2014 \u044d\u0442\u043e \u00ab\u0447\u0435\u0440\u043d\u044b\u0439 \u044f\u0449\u0438\u043a\u00bb \u0441 \u043e\u0434\u043d\u043e\u043f\u043b\u0430\u0442\u043d\u044b\u043c \u043c\u0438\u043a\u0440\u043e\u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043e\u043c \u0432\u043d\u0443\u0442\u0440\u0438. \u041e \u0442\u043e\u043c, \u043a\u0430\u043a \u043e\u043d […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-35337","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Carding a \u201e\u010dern\u00e9 sk\u0159\u00ed\u0148ky\u201c: Jak se dnes hackuj\u00ed bankomaty | ProHoster","description":"\u017delezn\u00e9 schr\u00e1nky s pen\u011bzi stoj\u00edc\u00ed na ulic\u00edch m\u011bsta nemohou ne\u017e p\u0159itahovat pozornost milovn\u00edk\u016f rychl\u00e9ho zisku.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/karding-i-chyornye-yashhiki-kak-vzlamyvayut-bankomaty-segodnya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u0440\u0434\u0438\u043d\u0433 \u0438 \u00ab\u0447\u0451\u0440\u043d\u044b\u0435 \u044f\u0449\u0438\u043a\u0438\u00bb: \u043a\u0430\u043a \u0432\u0437\u043b\u0430\u043c\u044b\u0432\u0430\u044e\u0442 \u0431\u0430\u043d\u043a\u043e\u043c\u0430\u0442\u044b \u0441\u0435\u0433\u043e\u0434\u043d\u044f | ProHoster","og:description":"\u0421\u0442\u043e\u044f\u0449\u0438\u0435 \u043d\u0430 \u0443\u043b\u0438\u0446\u0430\u0445 \u0433\u043e\u0440\u043e\u0434\u0430 \u0436\u0435\u043b\u0435\u0437\u043d\u044b\u0435 \u043a\u043e\u0440\u043e\u0431\u043a\u0438 \u0441 \u0434\u0435\u043d\u044c\u0433\u0430\u043c\u0438 \u043d\u0435 \u043c\u043e\u0433\u0443\u0442 \u043d\u0435 \u043f\u0440\u0438\u0432\u043b\u0435\u043a\u0430\u0442\u044c \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u043b\u044e\u0431\u0438\u0442\u0435\u043b\u0435\u0439 \u0431\u044b\u0441\u0442\u0440\u043e\u0439 \u043d\u0430\u0436\u0438\u0432\u044b.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/karding-i-chyornye-yashhiki-kak-vzlamyvayut-bankomaty-segodnya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:03:44+00:00","article:modified_time":"2019-10-31T19:03:44+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"35337","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 22:50:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 14:22:35","updated":"2026-01-21 22:50:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/35337","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=35337"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/35337\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=35337"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=35337"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=35337"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}