Saturday, April 19, 2025
HomeInfosec- ResourcesUndetectable ATM "Shimmers" Hacker's Latest Tool for Steal your Chip Based...

Undetectable ATM “Shimmers” Hacker’s Latest Tool for Steal your Chip Based Card Details from POS Terminal

Published on

SIEM as a Service

Follow Us on Google News

Latest warning coming out from Canada about sophisticated ATM skimming called “Shimmers”  targeted chip-based credit and Debit cards to steal your entire card information form POS(Point-of-sale) terminal.

Basically many skimming devices record your card information in plain text on the magnetic stripe on the backs of cards.

Last Year November ATM based Skimmer has been detected a threat on ATM fraud devices known as “insert skimmers,”these thin data theft tools made to be completely hidden inside of a cash’s machine’s card acceptance slot.

- Advertisement - Google News

In this case a chip-based device called shimmer has used in POS Machine which is used in Retailed store and other public areas for customer to make payment.

Earlier of this Const. Alex Bojic of the Coquitlam RCMP economic crime unit Published an Article said, Shimmers have rendered the bigger and bulkier skimmers virtually obsolete,

” A shimmer, on the other hand, is so named because it acts a shim that sits between the chip on the card and the chip reader in the ATM — recording the data on the chip as it is read by the ATM.”

They’ve already started popping up earlier of this Year in Canada and now police are warning ATM users around the world to be alert who all are using POS(Point-of-sale) Terminals.

Shimmers could be used to clone a magnetic stripe card.but its cannot used be used to fabricate a chip-based card.

The shimmers work by fitting inside a card reader. Once installed, the microchips on the shimmer record information from chip cards, including the PIN.

Also Read :  Advanced ATM penetration testing methods

What is  iCVV ?

iCVV Refers integrated circuit card verification value or “iCVV” for short — also known as a “dynamic CVV.”

The iCVV differs from the card verification value (CVV) stored on the physical magnetic stripe, and protects against the copying of magnetic-stripe data from the chip and using that data to create counterfeit magnetic stripe cards.

some banks have apparently not correctly implemented the chip card standard, known as EMV (short for Europay, Mastercard and Visa). so shimmers takes place and performing these attack.

Possible way to successful this Attack

ATM giant NCR Corp wrote in a 2016 alert ,The only way for this attack to be successful is if a [bank card] issuer neglects to check the CVV when authorizing a transaction.

“All issuers MUST make these basic checks to prevent this category of fraud. Card Shimming is not a vulnerability with a chip card, nor with an ATM, and therefore it is not necessary to add protection mechanisms against this form of attack to the ATM.”

That information is later extracted when the criminal inserts a special card — also during a purchase or cash withdrawal — which downloads the data. The information is then used to make fake cards.

“You can’t see a shimmer from the outside like the old skimmer version,” Bojic said in a statement .Businesses and consumers should immediately report anything abnormal about the way their card is acting … especially if the card is sticking inside the machine.”

Customers using the tap function of a chip card is one way to avoid being “shimmed.”It’s actually very secure. Each tap transfers very limited banking information, which can’t be used to clone your card.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

How To Detect Obfuscated Malware That Evades Static Analysis Tools

Obfuscated malware presents one of the most challenging threats in cybersecurity today. As static...

How Security Analysts Detect and Prevent DNS Tunneling Attack In Enterprise Networks

DNS tunneling represents one of the most sophisticated attack vectors targeting enterprise networks today,...

How to Conduct a Cloud Security Assessment

Cloud adoption has transformed organizations' operations but introduces complex security challenges that demand proactive...

U.S DOGE Allegedly Breached – Whistleblower Leaked Most Sensitive Documents

A federal whistleblower has accused the Department of Government Efficiency (DOGE) of orchestrating a...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Kaspersky Shares 12 Essential Tips for Messaging App Security and Privacy

In an era where instant messaging apps like WhatsApp, Telegram, Signal, iMessage, Viber, and...

Top 10 Best Penetration Testing Companies in 2025

Penetration testing companies play a vital role in strengthening the cybersecurity defenses of organizations...

WinRAR 7.10 Latest Version Released – What’s New!

The popular file compression and archiving tool, WinRAR 7.10, has released with new features,...