Hack attack hits ATM jackpots
Monday 02 August 2010
Computer security researcher Barnaby Jack jokes that he has resorted to hiding cash under his bed since figuring out how to crack automated teller machines remotely using the Internet.
The New Zealand native on Saturday demonstrated his "ATM jackpotting" discovery for an overflow crowd of hackers during a presentation at the infamous DefCon gathering in Las Vegas.
"You don't have to go to the ATM at all," Jack told AFP after briefing fellow software savants. "You can do it from the comfort of your own bedroom."
Jack proved his findings using two kinds of ATMs typically found in corner stores, bars or other "stand-alone" venues in the United States but said the flaw likely exists in machines at banks.
Banks use "remote management" software to monitor and control their ATMs, and Jack used a weakness in that kind of code to take control of machines by way of the Internet.
He found a way to bypass having to submit passwords and serial numbers to access ATMs remotely. Once in the machines, he could command them to spit out cash or transfer funds.
He could also capture account data from magnetic strips on credit or bank cards as well as passwords punched in by ATM users.
"When you think about ATM security you generally think about the hardware side; is it bolted down and are the cameras in position," Jack said.
"This is the first time anyone has taken the approach of trying to attack the underlying software. It is time to find software defenses rather than hardware defenses."
Jack did his research on ATMs he bought on the Internet. He also found master keys for stand-alone machines available for purchase online, meaning hackers could walk up and tinker with ATM software, he added.
"We shouldn't dwell on the walk-up attack, because no physical access is required," Jack said. "They have a flaw that lets me bypass all authentication on the device on the Internet, and I am the ATM at that stage."
He didn't reveal specifics of the attack to hackers even though the ATM makers were told of the flaw and have bolstered machine defenses.
"I might get my butt in hot water if I released the code," said the IO Active software security researcher who did the ATM hack 'as a hobby.'
"I was careful not to release the keys to the kingdom."
Jack said he doesn't know if criminals have exploited the software flaw "in the wild" but that it is tough to be certain.
"It is not an easy attack to replicate but I am not naive enough to think I am the only one who can do it," Jack said, admitting he has grown wary of ATMs. "I just keep my cash under the bed now, mate."
Diving in at the deep end is no excuse for shirking the style stakes
Life & Style blogs
Sustained immigration has not harmed Britons' employment, say government advisers
War is war: Why I stand with Israel
7/7 memorial defaced on anniversary of 2005 attacks with ‘Blair lied thousands died’ graffiti
Australia facing international condemnation after turning around Sri Lankans at sea
Even when it brutalises one of its own teenage citizens, America is helpless against Israel
Socialist Worker called to apologise over ‘vile’ article saying Eton schoolboy Horatio Chapple's death is ‘reason to save the polar bears’
- 1 Why I'm on the brink of burning my Israeli passport
- 2 Comfortable in their own skin
- 3 Japanese plant experts produce 10,000 lettuce heads a day in LED-lit indoor farm
- 4 War is war: Why I stand with Israel
- 5 L'Oreal cuts ties with Belgium supporter Axelle Despiegelaere after hunting trip photographs
iJobs Gadgets & Tech
£30000 - £45000 per annum + Benefits + Bonus: Harrington Starr: C# Developer (...
£60000 - £80000 per annum + Benefits + Bonus: Harrington Starr: C# Integration...
£40000 - £45000 per annum + Benefits + Bonus: Harrington Starr: PHP Web Develo...