Bluetana App Quickly Detects Hidden Bluetooth Card Skimmers at Gas Pumps

The media has also reported several recent crimes surrounding
credit card skimmers, including:

• Gas pump skimmer found at a 7-Eleven in Pinellas County
• Credit card skimmer found at West Palm Beach gas station
• Credit Card Skimmer Found at Gas Station in Sunnyvale
• Several Gas Pump Credit Card Skimmers Found at Bay Area
  Stations
• Gas pump credit card skimmers found at Boerne stations
• Credit card skimmers target Anthem Circle K

For those unaware, Bluetooth credit card skimmer is a tiny sneaky
device designed to stealthily capture payment card information,
like credit card holder’s card number, expiration date and the full
name, which nearby thieves then retrieve wirelessly over a
Bluetooth connection.
Since these devices have been designed to blend in seamlessly with
the machine they’re placed on, sometimes it can’t be spotted—even
if you’re using your eyes, fingers and your common sense.

Skimmers are often found discreetly placed on bank ATMs,
however, in recent years crooks have started targeting gas
stations, where card readers for customers are far easier to
tamper with than ATMs, making it easier to pull off the crime.
^[2][3]

A team of cybersecurity researchers at the University of
California San Diego and the University of Illinois has developed a
new mobile app that can wirelessly and accurately detect card
skimmers installed by criminals on gas stations or bank ATMs.

Dubbed Bluetana, the smartphone app works by scanning all
nearby Bluetooth devices—both Classic and Bluetooth Low Energy
(BLE)—every 5 seconds using Android’s Bluetooth API and when it
detects a potential skimmer, the app indicates it to the user by
highlighting the device record in Red.

That’s possible because Bluetana uses an
algorithm to differentiate credit card skimmers from other common
Bluetooth devices, such as sensors, smartphones, or vehicle
tracking hardware, that appear in Bluetooth scans at gas stations.

How Does Bluetana Detect Card Skimmers?

• If “Class-of-Device” is uncategorized, Bluetana saves its data
  for later analysis.
• It then matches the device’s MAC prefix against a list of
  prefixes used in skimming devices recovered by law
  enforcement.
• If the device has a MAC that is not on the list, it is unlikely
  to be a skimmer, and the app highlights the record
  Yellow.
• If the device MAC is on the list, but the “Device Name” matches
  a common product, it is unlikely to be a skimmer and the record
  highlights in Orange.
• If a device’s MAC prefix matches, Class-of-Device is
  categorized, and Device Name is not common, it indicates the device
  is likely to be a skimmer, and Bluetana highlights the record in
  Red.

Researchers said they were surprised that their Bluetana app was
able to detect so many skimmers that had not been discovered by
regular manual inspections or other detection methods.

Their app even detected two skimmers that were installed in gas
pumps and had evaded detection for six months.

Bluetana researchers worked closely with the United States
Secret Service. For the time being, the app is only available to
official gas pump inspectors in several U.S. states and is not
expected to go mainstream for consumers anytime soon, the
researchers noted.

^[1][4]