Hack attack hits ATM jackpots

Computer security researcher Barnaby Jack jokes that he has resorted to hiding cash under his bed since figuring out how to crack automated teller machines remotely using the Internet.

The New Zealand native on Saturday demonstrated his "ATM jackpotting" discovery for an overflow crowd of hackers during a presentation at the infamous DefCon gathering in Las Vegas.

"You don't have to go to the ATM at all," Jack told AFP after briefing fellow software savants. "You can do it from the comfort of your own bedroom."

Jack proved his findings using two kinds of ATMs typically found in corner stores, bars or other "stand-alone" venues in the United States but said the flaw likely exists in machines at banks.

Banks use "remote management" software to monitor and control their ATMs, and Jack used a weakness in that kind of code to take control of machines by way of the Internet.

He found a way to bypass having to submit passwords and serial numbers to access ATMs remotely. Once in the machines, he could command them to spit out cash or transfer funds.

He could also capture account data from magnetic strips on credit or bank cards as well as passwords punched in by ATM users.

"When you think about ATM security you generally think about the hardware side; is it bolted down and are the cameras in position," Jack said.

"This is the first time anyone has taken the approach of trying to attack the underlying software. It is time to find software defenses rather than hardware defenses."

Jack did his research on ATMs he bought on the Internet. He also found master keys for stand-alone machines available for purchase online, meaning hackers could walk up and tinker with ATM software, he added.

"We shouldn't dwell on the walk-up attack, because no physical access is required," Jack said. "They have a flaw that lets me bypass all authentication on the device on the Internet, and I am the ATM at that stage."

He didn't reveal specifics of the attack to hackers even though the ATM makers were told of the flaw and have bolstered machine defenses.

"I might get my butt in hot water if I released the code," said the IO Active software security researcher who did the ATM hack 'as a hobby.'

"I was careful not to release the keys to the kingdom."

Jack said he doesn't know if criminals have exploited the software flaw "in the wild" but that it is tough to be certain.

"It is not an easy attack to replicate but I am not naive enough to think I am the only one who can do it," Jack said, admitting he has grown wary of ATMs. "I just keep my cash under the bed now, mate."

Arts and Entertainment
Gregg Wallace in Summer's Supermarket Secrets
tv All of this year's 15 contestants have now been named
Arts and Entertainment
Inside the gallery at Frederick Bremer School in Walthamstow
tvSimon Usborne goes behind-the-scenes to watch the latest series
Life and Style
A picture taken on January 12, 2011 shows sex shops at the Paris district of Pigalle.
newsThe industry's trade body issued the moratorium on Friday
News
Winchester College Football (universally known as Winkies) is designed to make athletic skill all but irrelevant
Life...arcane public school games explained
PROMOTED VIDEO
Life and Style
ebooksA superb mix of recipes serving up the freshest of local produce in a delicious range of styles
Life and Style
ebooksFrom the lifespan of a slug to the distance to the Sun: answers to 500 questions from readers
Arts and Entertainment
Could we see Iain back in the Bake Off tent next week?
tv Contestant teased Newsnight viewers on potential reappearance
Life and Style
Silvia says of her famous creation: 'I never stopped wearing it. Because I like to wear things when they are off the radar'
fashionThe fashion house celebrated fifteen years of the punchy pouch with a weighty tome
News
i100(and it's got nothing to do with the Great British Bake Off)
News
Angelina Jolie with her father Jon Voight
peopleAsked whether he was upset not to be invited, he responded by saying he was busy with the Emmy Awards
News
Bill Kerr has died aged 92
peopleBill Kerr appeared in Hancock’s Half Hour and later worked alongside Spike Milligan and Peter Sellers
News
news It's not just the world that's a mess at the moment...
Sport
footballPremiership preview: All the talking points ahead of this weekend's matches
News
Keira Knightley poses topless for a special September The Photographer's issue of Interview Magazine, out now
people
Voices
The Ukip leader has consistently refused to be drawn on where he would mount an attempt to secure a parliamentary seat
voicesNigel Farage: Those who predicted we would lose momentum heading into the 2015 election are going to have to think again
Arts and Entertainment
Cara Delevingne made her acting debut in Anna Karenina in 2012
film Cara Delevingne 'in talks' to star in Zoolander sequel
News
i100
Sport
Mario Balotelli pictured in his Liverpool shirt for the first time
football
Life and Style
tech
Independent
Travel Shop
the manor
Up to 70% off luxury travel
on city breaks Find out more
santorini
Up to 70% off luxury travel
on chic beach resorts Find out more
sardina foodie
Up to 70% off luxury travel
on country retreats Find out more
Latest stories from i100
Have you tried new the Independent Digital Edition apps?
Independent Dating
and  

By clicking 'Search' you
are agreeing to our
Terms of Use.

ES Rentals

    iJobs Job Widget
    iJobs Gadgets & Tech

    C# Algo-Developer (BDD/TDD, ASP.NET, JavaScript, RX)

    £45000 - £69999 per annum + Benefits + Bonus: Harrington Starr: C# Algo-Develo...

    Senior Data Scientist (Data Mining, Apache Mahout, Python,R,AI)

    £60000 - £70000 per annum + Benefits + Bonus: Harrington Starr: Senior Data Sc...

    Java Developer - 1 year contract

    £350 - £400 Per Day: Clearwater People Solutions Ltd: Our client based in Cent...

    Junior Analyst - Graduate - 6 Month fixed term contract

    £17000 - £20000 Per Annum Bonus, Life Insurance + Other Benefits: Clearwater P...

    Day In a Page

    Ukraine crisis: The phoney war is over as Russian troops and armour pour across the border

    The phoney war is over

    Russian troops and armour pour into Ukraine
    Potatoes could be off the menu as crop pests threaten UK

    Potatoes could be off the menu as crop pests threaten UK

    The world’s entire food system is under attack - and Britain is most at risk, according to a new study
    Gangnam smile: why the Chinese are flocking to South Korea to buy a new face

    Gangnam smile: why the Chinese are flocking to South Korea to buy a new face

    Seoul's plastic surgery industry is booming thanks to the popularity of the K-Pop look
    From Mozart to Orson Welles: Creative geniuses who peaked too soon

    Creative geniuses who peaked too soon

    After the death of Sandy Wilson, 90, who wrote his only hit musical in his twenties, John Walsh wonders what it's like to peak too soon and go on to live a life more ordinary
    Caught in the crossfire of a cyber Cold War

    Caught in the crossfire of a cyber Cold War

    Fears are mounting that Vladimir Putin has instructed hackers to target banks like JP Morgan
    Salomé's feminine wiles have inspired writers, painters and musicians for 2,000 years

    Salomé: A head for seduction

    Salomé's feminine wiles have inspired writers, painters and musicians for 2,000 years. Now audiences can meet the Biblical femme fatale in two new stage and screen projects
    From Bram Stoker to Stanley Kubrick, the British Library's latest exhibition celebrates all things Gothic

    British Library celebrates all things Gothic

    Forthcoming exhibition Terror and Wonder: The Gothic Imagination will be the UK's largest ever celebration of Gothic literature
    The Hard Rock Café's owners are embroiled in a bitter legal dispute - but is the restaurant chain worth fighting for?

    Is the Hard Rock Café worth fighting for?

    The restaurant chain's owners are currently embroiled in a bitter legal dispute
    Caribbean cuisine is becoming increasingly popular in the UK ... and there's more to it than jerk chicken at carnival

    In search of Caribbean soul food

    Caribbean cuisine is becoming increasingly popular in the UK ... and there's more to it than jerk chicken at carnival
    11 best face powders

    11 best face powders

    Sweep away shiny skin with our pick of the best pressed and loose powder bases
    England vs Norway: Roy Hodgson's hands tied by exploding top flight

    Roy Hodgson's hands tied by exploding top flight

    Lack of Englishmen at leading Premier League clubs leaves manager hamstrung
    Angel Di Maria and Cristiano Ronaldo: A tale of two Manchester United No 7s

    Di Maria and Ronaldo: A tale of two Manchester United No 7s

    They both inherited the iconic shirt at Old Trafford, but the £59.7m new boy is joining a club in a very different state
    Israel-Gaza conflict: No victory for Israel despite weeks of death and devastation

    Robert Fisk: No victory for Israel despite weeks of devastation

    Palestinians have won: they are still in Gaza, and Hamas is still there
    Mary Beard writes character reference for Twitter troll who called her a 'slut'

    Unlikely friends: Mary Beard and the troll who called her a ‘filthy old slut’

    The Cambridge University classicist even wrote the student a character reference
    America’s new apartheid: Prosperous white districts are choosing to break away from black cities and go it alone

    America’s new apartheid

    Prosperous white districts are choosing to break away from black cities and go it alone