Hack attack hits ATM jackpots
Monday 02 August 2010
Computer security researcher Barnaby Jack jokes that he has resorted to hiding cash under his bed since figuring out how to crack automated teller machines remotely using the Internet.
The New Zealand native on Saturday demonstrated his "ATM jackpotting" discovery for an overflow crowd of hackers during a presentation at the infamous DefCon gathering in Las Vegas.
"You don't have to go to the ATM at all," Jack told AFP after briefing fellow software savants. "You can do it from the comfort of your own bedroom."
Jack proved his findings using two kinds of ATMs typically found in corner stores, bars or other "stand-alone" venues in the United States but said the flaw likely exists in machines at banks.
Banks use "remote management" software to monitor and control their ATMs, and Jack used a weakness in that kind of code to take control of machines by way of the Internet.
He found a way to bypass having to submit passwords and serial numbers to access ATMs remotely. Once in the machines, he could command them to spit out cash or transfer funds.
He could also capture account data from magnetic strips on credit or bank cards as well as passwords punched in by ATM users.
"When you think about ATM security you generally think about the hardware side; is it bolted down and are the cameras in position," Jack said.
"This is the first time anyone has taken the approach of trying to attack the underlying software. It is time to find software defenses rather than hardware defenses."
Jack did his research on ATMs he bought on the Internet. He also found master keys for stand-alone machines available for purchase online, meaning hackers could walk up and tinker with ATM software, he added.
"We shouldn't dwell on the walk-up attack, because no physical access is required," Jack said. "They have a flaw that lets me bypass all authentication on the device on the Internet, and I am the ATM at that stage."
He didn't reveal specifics of the attack to hackers even though the ATM makers were told of the flaw and have bolstered machine defenses.
"I might get my butt in hot water if I released the code," said the IO Active software security researcher who did the ATM hack 'as a hobby.'
"I was careful not to release the keys to the kingdom."
Jack said he doesn't know if criminals have exploited the software flaw "in the wild" but that it is tough to be certain.
"It is not an easy attack to replicate but I am not naive enough to think I am the only one who can do it," Jack said, admitting he has grown wary of ATMs. "I just keep my cash under the bed now, mate."
Life & Style blogs
10 ways we damage our teeth – without realising
Facebook Messenger sends 'creepily' precise location data, as revealed by Marauders Map Chrome extension
What do the emoji on Snapchat mean?
iPhone 'effective power' text: how to be safe from iOS bug that lets people crash your phone
Video claims California will be hit by huge earthquake because of the alignment of the planets — but it’s probably wrong
EU referendum: David Cameron's rules are a 'democratic disgrace', says French-born Scottish politician set to be denied a vote
SNP fury as HS2 finds 'no business case' for taking fast train service to Scotland
British tourists complain that impoverished boat migrants are making holidays 'awkward' in Kos
Australian man punched in the face for defending Muslim women from abuse on train
A nation of inequality: How the UK is failing to feed its most vulnerable people
David Starkey 'tells Amal Clooney to shut up and stop over-promoting human rights'
- 1 10 ways we damage our teeth – without realising
- 2 Fifa corruption arrests: Nike reported to be 'multinational sportswear company' at centre of bribery claims over Brazil shirt deal
- 3 Facebook Messenger sends 'creepily' precise location data, as revealed by Marauders Map Chrome extension
- 4 Photo of wedding guest proposing to girlfriend in front of bride and groom goes viral
- 5 Charlie Charlie Challenge explained: it's just gravity — not a Mexican demon being summoned
iJobs Gadgets & Tech
£20 - 28k + Benefits: Guru Careers: We are seeking a Graduate Software Develop...
Negotiable: Recruitment Genius: A Digital Web Designer is required to join a f...
£35-40k (DOE) + Benefits: Guru Careers: We are seeking a Marketing Communicati...
£22000 - £25000 per annum: Recruitment Genius: IT Support Technician is requir...