Hack attack hits ATM jackpots
Monday 02 August 2010
Computer security researcher Barnaby Jack jokes that he has resorted to hiding cash under his bed since figuring out how to crack automated teller machines remotely using the Internet.
The New Zealand native on Saturday demonstrated his "ATM jackpotting" discovery for an overflow crowd of hackers during a presentation at the infamous DefCon gathering in Las Vegas.
"You don't have to go to the ATM at all," Jack told AFP after briefing fellow software savants. "You can do it from the comfort of your own bedroom."
Jack proved his findings using two kinds of ATMs typically found in corner stores, bars or other "stand-alone" venues in the United States but said the flaw likely exists in machines at banks.
Banks use "remote management" software to monitor and control their ATMs, and Jack used a weakness in that kind of code to take control of machines by way of the Internet.
He found a way to bypass having to submit passwords and serial numbers to access ATMs remotely. Once in the machines, he could command them to spit out cash or transfer funds.
He could also capture account data from magnetic strips on credit or bank cards as well as passwords punched in by ATM users.
"When you think about ATM security you generally think about the hardware side; is it bolted down and are the cameras in position," Jack said.
"This is the first time anyone has taken the approach of trying to attack the underlying software. It is time to find software defenses rather than hardware defenses."
Jack did his research on ATMs he bought on the Internet. He also found master keys for stand-alone machines available for purchase online, meaning hackers could walk up and tinker with ATM software, he added.
"We shouldn't dwell on the walk-up attack, because no physical access is required," Jack said. "They have a flaw that lets me bypass all authentication on the device on the Internet, and I am the ATM at that stage."
He didn't reveal specifics of the attack to hackers even though the ATM makers were told of the flaw and have bolstered machine defenses.
"I might get my butt in hot water if I released the code," said the IO Active software security researcher who did the ATM hack 'as a hobby.'
"I was careful not to release the keys to the kingdom."
Jack said he doesn't know if criminals have exploited the software flaw "in the wild" but that it is tough to be certain.
"It is not an easy attack to replicate but I am not naive enough to think I am the only one who can do it," Jack said, admitting he has grown wary of ATMs. "I just keep my cash under the bed now, mate."
Life & Style blogs
Android One handsets launch in India: £65 apiece with cricket scores baked in
Jennifer Lawrence nude pictures leaked: Reddit removes 'The Fappening' board dedicated to sharing naked pictures of celebrities
A bottle of wine a day is not bad for you and abstaining is worse than drinking, scientist claims
Vogue under fire for 'Big Booty' article
Vogue's 'Big Booty' stars
Daniele Watts: Django Unchained actress detained by Los Angeles police after being mistaken for a prostitute
The political class is doing what Hitler couldn’t – destroying Britain
Scottish independence: Nationalist leader Jim Sillars threatens pro-union companies with 'day of reckoning' after independence
Scottish independence: Yes campaign feels the heat as Alex Salmond's NHS claims come under furious attack
£23m Birmingham cycle scheme is attacked by Tory councillor for not catering to the elderly
Salmond accused of laughing off national debt with ‘what are they going to do: invade?’ joke
- 1 Scottish independence: Ireland since 1919 is a lesson for Scotland in what a Yes vote means
- 2 Thailand deaths: Pair's bloodied bodies found naked on Koh Tao beach
- 3 Lego breaks out of the toy box and heads for the gallery
- 4 Julian Assange and Edward Snowden join piracy mogul Kim Dotcom’s political campaign in New Zealand
- 5 Daniele Watts: Django Unchained actress detained by Los Angeles police after being mistaken for a prostitute
iJobs Gadgets & Tech
£400 Per Day: Clearwater People Solutions Ltd: Our client are currently seekin...
£45000 Per Annum: Clearwater People Solutions Ltd: Our client based in Chelmsf...
£25000 - £30000 Per Annum: Clearwater People Solutions Ltd: Our client are cur...
£40000 - £45000 Per Annum + benefits: Clearwater People Solutions Ltd: Project...