Article

FBI: ATM skimming, third party payment processor breaches expected to grow

The assistant director of the Cyber Division delivered testimony to the House Financial Services Committee.

September 14, 2011

The following is an excerpt of the testimony of Gordon M. Snow, assistant director of the Cyber Division, Federal Bureau of Investigation. His statement was delivered Wednesday in Washington, D.C., before the House Financial Services Committee, Subcommittee on Financial Institutions and Consumer Credit.

Good afternoon Chairman Capito, Ranking Member Maloney and members of the subcommittee. I’m pleased to appear before you today to discuss the cyber threats facing our nation, and how the FBI and our partners are working together to protect the financial sector and American consumers.

Cyber criminals can significantly threaten the finances and reputations of United States businesses and financial institutions. Given the abundance of potential victims and profits, cyber criminals will likely continue to target these entities. The FBI is committed to addressing these threats through innovative and proactive means and making the Internet more secure for financial institutions and U.S. consumers alike.

As the subcommittee is aware, the number and sophistication of malicious incidents has increased dramatically over the past five years and is expected to continue to grow.

Third party payment processor breaches

Sophisticated cyber criminals are also targeting the computer networks of large payment processors, resulting in the loss of millions of dollars, and the compromise of personally identifiable information of millions of individuals.

In November 2008, a U.S. payment processor discovered that hackers had breached the company’s computer systems and compromised the personal data of over 1.5 million customers; roughly 1.1 million Social Security numbers were also exposed. The criminals used the stolen data to create fake debit cards and withdrew more than $9 million from automated teller machines worldwide.

In January 2009, it was discovered that cyber criminals compromised the computer network of a U.S. payment processor that completes approximately 100 million transactions monthly for more than 250,000 U.S. businesses. The criminals were able to obtain over 130 million customer records, which included credit card numbers, expiration dates and internal bank codes.

ATM skimming

ATM skimming is also a prevalent global cyber crime. A criminal affixes a skimmer to the outside or inside of an ATM to collect card numbers and personal identification number codes. The criminal then either sells the stolen data over the Internet or makes fake cards to withdraw money from the compromised accounts.

The technology of the skimmer devices continues to improve. This technique is also being used to steal credit and debit card information from customers at gas station pumps. Bluetooth-enabled wireless skimmers were found at a string of gas stations in the Denver area attached to the inside of the gas pump. The wireless capabilities of the skimmers allowed the criminal to download the information from the skimmers instantly, as long as they were in range of the wireless network.

Even as technology improves to protect against skimming, cyber criminals are creating devices to mimic the security features of legitimate ATM hardware. For example, ATM vendors have created new anti-skimming tools that include a backlit green or blue plastic casing around the card slot to prevent skimmers from being attached. In Ireland in early 2011, cyber criminals attached several skimmers that appeared identical to the new security devices.

Addressing the threat

The FBI plays a substantial role in the Comprehensive National Cybersecurity Initiative, the interagency strategy to protect our digital infrastructure as a national security priority. Through the CNCI, we and our partners collaborate to collect intelligence, gain visibility on our adversaries, and facilitate dissemination of critical information to decision makers.

The FBI has cyber squads in each of our 56 field offices, with more than 1,000 advanced cyber-trained FBI agents, analysts and forensic examiners. We have increased the capabilities of our employees by selectively seeking candidates with technical skills and enhancing our cyber training.

In addition, the FBI’s presence in legal attachés in 61 cities around the world assists in the critical exchange of case-related information and the situational awareness of current threats, helping to combat the global scale and scope of cyber breaches. The FBI is also changing to adapt to the ever-evolving technology and schemes used by cyber criminals. Intelligence now drives operations in the FBI. The Bureau is working in new ways with long-standing and new partners to address the cybersecurity threat.

In addition, as part of the FBI’s overall transformation to an intelligence-driven organization, the Cyber Division has implemented Threat Focus Cells, which bring together subject matter experts from various agencies to collaborate and address specific identified cyber threats.

Partnerships

However, one agency cannot combat the threat alone. Through the FBI-led National Cyber Investigative Joint Task Force, we coordinate our efforts with 20 law enforcement and intelligence community entities, including the Central Intelligence Agency, Department of Defense, Department of Homeland Security, and National Security Agency. The FBI also has embedded cyber staff in other IC agencies through joint duty and detailee assignments.

In addition, because of the frequent foreign nexus to cyber threats, we work closely with our international law enforcement and intelligence partners.

We currently have FBI agents embedded full-time in five foreign police agencies to assist with cyber investigations: Estonia, the Netherlands, Romania, Ukraine and Colombia. These cyber personnel have identified cyber organized crime groups targeting U.S. interests and supported other FBI investigations. We have trained foreign law enforcement officers from more than 40 nations in cyber investigative techniques over the past two years.

We have engaged our international allies, including Australia, New Zealand, Canada and the United Kingdom, in strategic discussions that have resulted in increased operational coordination on intrusion activity and cyber threat investigations.

The FBI has worked with a number of regulatory agencies to determine the scope of the financial cyber crime threat, develop mitigation strategies, and provide public service announcements where appropriate, to include the U.S. Department of Treasury - Financial Crimes Enforcement Network, Financial Services Information Sharing and Analysis Center, the Securities and Exchange Commission, the Office of Comptroller of Currency, the Federal Deposit Insurance Corporation, the Federal Reserve Board and the Federal Reserve Bank.

Additionally, the FBI works with a number of industry governing entities such as NACHA — the Electronic Payments Association — and the Financial Industry Regulatory Authority to understand and investigate cyber crime problems affecting a particular industry segment.

Conclusion

As the subcommittee knows, we face significant challenges in our efforts to combat cyber crime. In the current technological environment, there are growing avenues for cyber crimes against the U.S. financial infrastructure and consumers. Modifications to business and financial institution security and risk management practices will directly affect the future of these types of crimes, and the adoption of best practices may be negated by the lack of security-conscious behavior by customers.

To bolster the efforts of the FBI against these cyber criminals, we will continue to share information with government agencies and private industry consistent with applicable laws and policies. We will continue to engage in strategy discussions with other government agencies and the private sector to ensure that cyber threats are countered swiftly and efficiently.

We will also continue to explore innovation methods of mitigating the threats posed by cyber crime. We look forward to working with the subcommittee and Congress as a whole to determine a successful course forward.

To read the assistant director's full testimony, click here.

(Photo courtesy of DonkeyHotey)

For more information on this topic, visit our security research center.