A major Australian bank has discovered a telephone bug [pictured below] installed inside a branch, being used to siphon the credit and debit card information of unwitting consumers.
The meticulously handcrafted device, smaller than the palm of a hand, was pinned carefully to telephone cable that ran along the carpet floor of the bank's metropolitan branch office.
Two inconspicuous cuts were made in the wire to attach the bug. It would listen for keypad tones as unsuspecting customers keyed in their PIN numbers at the automatic teller.
Each tone woke the device from slumber, which it diligently broadcast over a handpicked radio frequency.
The attacker waited in the bank’s carpark and recorded the tones on a laptop. Each tone was then matched to a number, revealing the customer’s PIN.
Corresponding card information was also being copied and stored. The brazen attacker had swapped the terminal on the teller's desk with a skimming device that was capturing enough bank data for replica cards to be manufactured.
The thief needed only match the time signatures at which the card and PIN number were swiped to have unfettered access to potentially hundreds of accounts.
Navid Sobbi, the phone interception expert who busted the scam, held a professional respect for the effort put into the bug.
“It was a work of art,” Sobbi said. “It is one of the best made and tidy bugs I have come across.”
The device was fully sealed save for an exposed screw head which was used to tune the radio frequency over which the PIN numbers were broadcast.
A cleaner was found to have installed both the bug and the skimming device.
“It’s almost always the cleaners,” Sobbi said, speaking of the dozens of interception cases he has foiled this year. “They have the access and are the most vulnerable – they often stand to make a lot of cash and that’s tempting considering they might not be paid a lot.”
However, the bug wasn’t the most sophisticated Sobbi had encountered.
He had recently stumbled on a government military-grade interception device installed in the bedroom of a residential property. The device transmitted captured audio via microwave links and was instantly recognisable as a government plant.
It was deactivated, but Sobbi’s bug hunting kit was able to identify particular metallic components inside the device.
In another case, Sobbi took a call from a client concerned that an office had been wiretapped.
During the drive to the property, Sobbi was called by police to cease and desist: the client had phoned Sobbi to request the search within proximity of the bug. That tipped off police who soon after raided the premises.
“If you ever suspect a phone bug,” Sobbi said “don’t talk about it if you are within range.”
Though 20 percent of Sobbi's work involved searching for suspected bugs, this year he had also found several hidden cameras and keyloggers implanted on the backs of computers.
Lasers had in some cases been used to listen in on corporate meetings, a ploy ultimately foiled by a mock meeting Sobbi established to detect the location of the laser.
“With enough tweaking, even a whisper can be heard,” Sobbi said of the laser.
Most of Sobbi’s cases involved suspected espionage. His team of six within National Surveillance and Intelligence serviced big business like Australia’s mining giants, government agencies and law firms. The company regularly performed “bug sweeps” of conference rooms ahead of sensitive meetings.
Sobbi also ran forensic scans of mobile devices with the same equipment used by police.
This service was a favourite of lawyers, big business and individual clients who suspected foul play by staff and partners.
“When staff leave, companies often want to know if incriminating text messages or phone calls were sent," he said. "Husbands and wives also want to check out if their phone was tampered or tracking software had been installed.”
