Impact of video surveillance system on ATM PIN security

Abstract

Abstract In Sri Lanka, it is a common practice to install wall mounted surveillance cameras in ATM cubicles. Surveillance cameras are installed to detect and/or monitor the situation and people inside the ATM cubicle for safety reasons and as a precautionary measure against the disputes regarding the dispense of cash. However, the researcher show that ad-hoc implementation of surveillance cameras inside an ATM cubicle has a potential threat to ATM PIN security. In the course of the background study the researchers identi ed that, in some cases, the PIN entering process is clearly visible through the surveillance camera footage. Researchers also show that it is possible to infer the ATM PIN simply by observing the forearm movement pattern even when the PIN pad is not visible on the video footage. In most banks, the surveillance camera footage are available to the personnel who are not cleared to access the banking system. In addition, banks operate under the premise that the PIN number is known only to the customer. Elaborate systems, such as HSMs and PIN Mailers, are in place to ensure that even the banking sta is not privy to the PIN number of a customer. Therefore, the potential exposure of the PIN number of a customer to a third party through the CCTV camera footage can be considered as a severe security violation in the electronic banking system. For this PIN inference process researchers have developed a programme using OpenCV and Python. Furthermore researchers have have propose a novel method to identify the key press events using the gradient of forearm movements.