PIN compromise using thermal imagery unlikely at metal ATM PIN pads

Since my last post I have come across more information on the thermal camera threat relating to PIN compromise.  Having read the research paper it seems that most ATMs are not at risk from this threat as, at the moment, the possibility of PIN compromise from thermal imaging technology really only exists for PIN entry at plastic PIN pads, and even then the success rate is not high - although the researchers claim that it is economically viable.  As most ATMs seem to have metal key pads, this is a relief for the industry.  The possibility of using thermal imaging for PIN compromise was first demonstrated by Michael Zalewski in 2005.

At the Woot '11 5th USENIX Workshop on Offensive Technologies held on 8th August 2011 in San Francisco, a presentation entitled Heat of the Moment: Characterizing the Efficacy of Thermal Camera-Based Attacks was delivered.  This was based on research and analysis carried out by Keaton Mowery, Sarah Meiklejohn, and Stefan Savage from the University of California, San Diego.  If you want to read more you can visit the website of the USENIX Workshop and download the slide presentation made by Mowery et al and/or the full research paper.

Covering your PIN may not protect it from cameras?

The industry is already aware that covering a PIN when entering it may not be 100% effective as, if the criminals use a PIN pad overlay, the PIN will be compromised regardless.  It is still recommended as cardholder 'best practice', however, as the risk of visual compromise is significantly mitigated.  For cardholder security tips, and a criminal video showing actual PIN compromise, visit the website of the European ATM Security Team.

Now, according to Security News on msnbc.com, new research in the U.S. has indicated that thermal cameras can be used for PIN compromise, even if the cardholder covers their hand when the PIN is entered.  How?  Apparently the keys touched by a human hand still retain some residual heat and this can be detected be a thermal camera once the hand has been removed.  Researchers from the University of California have carried out a series of proof-of-concept attacks using a thermal camera mounted above a traditional ATM pinpad.