Hack attack hits ATM jackpots
Monday 02 August 2010
Computer security researcher Barnaby Jack jokes that he has resorted to hiding cash under his bed since figuring out how to crack automated teller machines remotely using the Internet.
The New Zealand native on Saturday demonstrated his "ATM jackpotting" discovery for an overflow crowd of hackers during a presentation at the infamous DefCon gathering in Las Vegas.
"You don't have to go to the ATM at all," Jack told AFP after briefing fellow software savants. "You can do it from the comfort of your own bedroom."
Jack proved his findings using two kinds of ATMs typically found in corner stores, bars or other "stand-alone" venues in the United States but said the flaw likely exists in machines at banks.
Banks use "remote management" software to monitor and control their ATMs, and Jack used a weakness in that kind of code to take control of machines by way of the Internet.
He found a way to bypass having to submit passwords and serial numbers to access ATMs remotely. Once in the machines, he could command them to spit out cash or transfer funds.
He could also capture account data from magnetic strips on credit or bank cards as well as passwords punched in by ATM users.
"When you think about ATM security you generally think about the hardware side; is it bolted down and are the cameras in position," Jack said.
"This is the first time anyone has taken the approach of trying to attack the underlying software. It is time to find software defenses rather than hardware defenses."
Jack did his research on ATMs he bought on the Internet. He also found master keys for stand-alone machines available for purchase online, meaning hackers could walk up and tinker with ATM software, he added.
"We shouldn't dwell on the walk-up attack, because no physical access is required," Jack said. "They have a flaw that lets me bypass all authentication on the device on the Internet, and I am the ATM at that stage."
He didn't reveal specifics of the attack to hackers even though the ATM makers were told of the flaw and have bolstered machine defenses.
"I might get my butt in hot water if I released the code," said the IO Active software security researcher who did the ATM hack 'as a hobby.'
"I was careful not to release the keys to the kingdom."
Jack said he doesn't know if criminals have exploited the software flaw "in the wild" but that it is tough to be certain.
"It is not an easy attack to replicate but I am not naive enough to think I am the only one who can do it," Jack said, admitting he has grown wary of ATMs. "I just keep my cash under the bed now, mate."
Life & Style blogs
What do the emojis on Snapchat mean?
A nap a day could save your life
Have sex with your iPad thanks to the new sex toy no-one asked for
Windows 10 automatically sends parents detailed dossier of their children's internet history and computer use
The antidote to Tinder? Majority of dating app users want relationship, rather than hook-ups, study finds
Climate change: 2015 will be the hottest year on record 'by a mile', experts say
'Women only' train carriages: Jeremy Corbyn unveils radical move to tackle public harassment
Black holes are a passage to another universe, says Stephen Hawking
Iain Duncan Smith 'should resign over disability benefit death figures', says Jeremy Corbyn
Tony Blair attacks Jeremy Corbyn's 'Alice In Wonderland' politics
Theresa May says migrants should be banned from entering the UK unless they have jobs lined up
- 1 Barbarians vs Samoa interrupted by sprinklers as fans criticise lack of Wi-Fi and poor seating at West Ham's Olympic Stadium
- 2 Watch the Supermoon live: How to see the brightest Moon of the year tonight
- 3 Hulk Hogan wants to be Donald Trump's running mate in the US Presidential election
- 4 Blood Moon and Supermoon: September to bring brightest – and dimmest – full Moon of the year on same night
- 5 David De Gea to Real Madrid: Real finally get their man with £29m bid for Manchester United goalkeeper
iJobs Gadgets & Tech
£40000 - £55000 per annum: Recruitment Genius: This is an exciting opportunity...
£20000 - £40000 per annum: Recruitment Genius: This IT provider for the educat...
£20000 - £25000 per annum: Recruitment Genius: This leader in the e-cigarette ...
£32000 - £40000 per annum: Recruitment Genius: With extensive experience and a...