UK ATM System Could Have Ruined Economy

seanyboy writes "The Register is running the story of how the UK banking system could have collapsed in the early 1990s, how easy it was at the time to withdraw against other people's accounts and the worrying case of a Bank's rogue IT Department." From the article: "What quickly became clear was that the law needed a system to provide proof that events had happened so that legal cases could be made. You might say that 'the computer debited the account', but to a barrister (and more importantly, a judge) that's not enough. Did the computer do it at random? In that case it's like a tree branch falling - an accident. Or did a person program it to do so? In which case the person must be able to testify about the precise circumstances when a debit could happen. Sounds daft, but the law rests on proving each step of an argument irrefutably."

Comments

What A Mess

[geomon]

The worst part of the story was that the lawyer couldn't tell anyone about the security problem because he was no longer retained by his original client. I believe that in the US attorneys are obliged to come forward with information related to a criminal nature because they are officers of the court. I don't know if that distiction would have helped in this case, but the fact that the whole system perched precariously on the fact that only a few criminals knew how to bilk the system is disturbing.

Re:What A Mess

[Guppy06]

"I don't believe there is any legal backing to the claim lawyers are officers of the court."

In all criminal prosecutions, the accused shall enjoy the right(...) to have compulsory process for obtaining witnesses in his favor

In order for defense attorneys to exercise this compulsory power ("Show up or be arrested"), they have to be granted executive powers, making them de facto officers.

Constitutional requirements for due process also require certain rules to be followed by both sides. Defense attorneys aren't allowed to coax people into perjuring themselves, withold information on future crimes, etc.

Wasn't so hot in 1987 either

[Anonymous Coward]

I had an account with National Westminster in '87 when I lived in the UK. The ATM's would always let you take cash out no matter how much in the red you already were. (It was my roommate that took advantage of it, not me, honest!)

Re:Wasn't so hot in 1987 either

[MichaelSmith]

The ATM's would always let you take cash out no matter how much in the red you already were

Around the same time ATMs here in Australia would do that if they could not contact the banks central systems. This often happened during night time batch processing.

I funded a hitch hiking trip around Tasmania in 1987 by making night time withdrawls.

What happened to me...

[Karma_fucker_sucker]

here in the US.

I went to withdraw from an ATM. I put the card in, entered my PIN, and selected the amount I wanted - $200.
The ATM goes nuts and procedes to give me only $160 while debiting my account two transactions: one for $200 and another for $160.
I call my credit union and I tell them what happened. They tell me to fax a letter stating that I was diputing the $200. I did. They audited the ATM.

Long story short, the credit union backed out the $200 debit.

Re:What happened to me...

[ldspartan]

I believe you experienced the failsafe: ATM keeps card, no one gives it back. Similiar thing happens if you enter your PIN incorrectly x times at some ATMs. The ATM keeps the card, and unless the bank has proof of signature for you, they then shred it after they empty the ATM. The bank reissues your card.

What if the electricity had gone out for much longer? And, upon boot, the machine cleared the cardreader by spitting your ATM card into the street? That'd be worse, methinks.

--
Phil

Related articles

[Barkley44]

Seems like this article and http://it.slashdot.org/article.pl?sid=05/10/21/135 204&tid=172&tid=156 are related - getting to market is more important than making sure it's 100% secure.

record audit standards

[5n3ak3rp1mp]

Could someone post some techniques to record changes to database records that don't involve a lot of overhead yet allow one to revisit any prior state of the data?

I suppose this sort of duplicates the functions of a transaction log but I don't know if a transaction log is queryable.

The reason why I ask is that I suppose it might have been useful in this case (as long as the law enforces audit logging)

Meanwhile, the paranoid old guy

[Recovering Hater]

lifts up his mattress and whispers to his stash of crumpled bills that he knew they were safe all along and the youngsters just don't know! They JUST DON'T KNOW!

And they think worries about...

[Safe Sex Goddess]

And the politicians think worries about electronic voting machine fraud is just a bunch of conspiracy nuts.

It would be a sad thing if we've already lost our democracy.

Re:And they think worries about...

[Usquebaugh]

In the US you have never had democracy to lose!

Lack of proportional voting, Electoral college, Two party system etc etc etc

Myself, I want all public positions decided by lotto. Pull the SSN out of a hat, Ms. Brown welcome to the white house.

This way the government is a true representation of the country as a whole not some old rich wasp guy clique.

Computers?

[Hogwash McFly]

Computers? Pah! Everyone knows that back in those days it was a midget with a box of money, trained to make BEEP! BEEP! noises.

In industrialized Britain...

[cached]

banks rob YOU!

How much should you believe this?

[Mugs]

The article has a number of strange assertions. First, only 3 PINs being generated by the card issuing system. I can see this is possible if you hack the application code itself but the HSMs (hardware security modules) that actually do the cryptographic operations wouldn't do this using Visa, IBM or Diebold PIN offset generation calls. It's possible, but it would be an insider job in one bank NOT the whole banking system. Second, the description of the scam is that one PIN offset on track 2 can be used with multiple account numbers. Again, all the standard PIN methods explicitly prevent this - the account number (PAN) is part of the input data to the PIN verification call. Third, the description has the crook shoulder surfing for PINs. Why does he need to do this if any known PIN can be used with any account? He only needs one known PIN and the corresponding card to be able to write as many cards as he likes. I'm sure there's some truth in the story but the technical detail is unconvincing.

Re:How much should you believe this?

[geckofiend]

You're reading it like he was talking about one group of people. He was referring to several problems/crimes performed by many different groups. Bank insiders put the PIN hack in, common street criminals shoulder surfed etc.

Re:How much should you believe this?

[b1t r0t]

You're talking about the standard forms of PIN storage and handling. They've been standard (at least in the US) for a long time. I worked for a place that wrote software that had to use secure PIN pads for debit, and I don't remember anything about the PIN being on the card. The decision of whether the PIN was correct or not was entirely the responsibility of the other side of the network. All the customer side had to do was encrypt it for transport before it left the PIN pad, and the PIN pad would have to be injected with master keys by a trusted party.

This was apparently back in the early days of ATMs, and clearly someone in the UK came up with a less than secure system. To store the pin as a single encrypted value on the card, completely independent from the account number so that it could be copied like a key, borders on criminal stupidity on the part of the designers.

Re:How much should you believe this?

[MyGirlFriendsBroken]

First, only 3 PINs being generated by the card issuing system. I can see this is possible if you hack the application code itself but the HSMs (hardware security modules) that actually do the cryptographic operations wouldn't do this using Visa, IBM or Diebold PIN offset generation calls. It's possible, but it would be an insider job in one bank NOT the whole banking system.

This is what the article indicates, it was the people working with the PIN production system rigged it to do this

Second, the description of the scam is that one PIN offset on track 2 can be used with multiple account numbers. Again, all the standard PIN methods explicitly prevent this - the account number (PAN) is part of the input data to the PIN verification call.

The account number did not feature in this case, thus simply changing the account number on the card was sufficent, the original PIN would still work

Third, the description has the crook shoulder surfing for PINs. Why does he need to do this if any known PIN can be used with any account?

This is what the guy used to do originally, then he discovered the account number rewriting trick

The article is not that well writen, it took me 2 1/2 reads of the article to actually establish all of the above. what I want to know is, who is "rogue Bank" and are they the same one I bank with

Not new actually...

[Spy der Mann]

computers have been a synonym for organized fraud in other places.

In Mexico, in the 1988 elections, the opposition candidate was winning by a large margin according to the official data. Then suddenly, "the system crashed", and when it came up, the official party was winning by a large margin.

This event was called "La caida del sistema de 1988", and makes me think that there's nothing new under the sun (Diebold voting machines, anyone?).

The lesson is clear: Regarding data and computers, if someone can do something wrong, he WILL. So auditing is a must.

Sounds like 2 issues here

[TykeClone]

1 - If something undermines trust in the banking system (in any country), the economy can quickly go to hell in a handbasket.

2 - The UK didn't have something similar to Reg E in the United States regulating "electronic" banking (in the US, that would include ACH items, wire transfers, and ATM/debit card transactions). And apparently, the UK doesn't have the banking regulatory structure to add such regulations as necessary without passing new laws.

If anyone is interested, here is Reg E in all of its glory.

Another 1990s ATM exploit

[mu-sly]

My dad, who used to work for a well-known UK building society, told me a story sometime in the early 1990s of how there had been some buggy code on all their ATMs. When making a withdrawl, the machine would issue the cash and wait around a minute. If you hadn't taken the cash by then, it assumed you were still waiting for the cash to be dispensed and would issue it again, possibly even several times over if you kept waiting and waiting. Apparently it took the company quite some time to discover this bug.

I'm reasonable sure the story is completely true, although since my dad isn't around anymore, I can't ask him about it.

Re:Another 1990s ATM exploit

[gilesparsons]

a friend who works with a bank informs me that even now on some machines you can ask for £60, and only take out the middle note. when the machine takes back thr remaining £40 then if the other notes are not disturbed it has then no way of knowing that you have taken some of the money. but at the end of the day nothing will ever be totally secure; someone can always pinch your wallet when you're not looking.

Why Cryptosystems Fail

[sharp-bang]

If you liked this article and are interested in some technical background, you might also like Ross Anderson's essay: Why Cryptosystems Fail, which discusses some of the poor engineering that contributed to this situation.

A German friend of mine had phamtom debits

[NigelJohnstone]

This was about 1999 or 2000. He was in Germany, his ATM card was in Germany with him, his account was being debitted from ATMs in Thailand, 10 Euros or so a time. The bank refused to return the money (about 80 euros in total?) until he hired a solicitor, then they settled immediately.

So I think there are newer cases than 1992 that this comes from.

OK, Somewhat less flame-y

[temojen]

For a bank, you have 3 main tables:

accounts describes all the accounts

create table accounts (
id serial not null primary key,
owner int references customer,
type int references accounttype,
ballance numeric(18,2)
);

JournalEntries shows the date, time, type, who, etc of each transaction

create table JournalEntries (
id serial not null primary key,
when timestamp not null default now(),
ttype int not null references transactiontypes,
whodid int not null references users
);
revoke update, delete from public;

JournalLines shows part of each transaction

create table JournalLines (
trans int references JournalEntries,
acct int references accounts,
change numeric(18,2),
primary key (trans,acct)
);
revoke update, delete from public;

After All transactions, the sum of JournalLines(change) must be zero, and all account ballances must equal the sum of the changes to that account. No changing or deleting of past transactions is allowed, only compensating transactions if an error is found.

An ATM withdrawl would be:

subtract from owners account
add to withdrawls

subtract from cash in machine X
add to withdrawls from machine X

This would normally be done by a stored procedure that also checks the PIN, etc. The DB user that machines, etc connect as would only have access to run stored procedures, not change the journal directly.

EFT vulnerability

[jonniesmokes]

Related to this is the completely insecure EFT system in the US. One time, just to see if I could, I typed my friends routing number and checking account number into my online credit card website. She had given me a check, and so I wasn't stealing from her. I was just debiting the funds from her checking account in a slightly different way. The credit card online website had no trouble taking the money out of her account and crediting it to my account.

But this story gets better. I went on a trip and didn't see my friend for a few weeks. She noticed the debit in her checking account and at first thought it was something fishy. She called her bank and they told her the name of the credit card company and said that she'd have to call the credit card company to find out more. She called the CC company and they couldn't help her even though they had taken her money. After a couple weeks, she made the connection that it was probably me, sent me an email and I confirmed it. She had a father who went to jail for banking fraud and wasn't freaked out by things like this.

But the point is, that there's no security on EFT transfers, or for that matter checks. I could print up a check if I know the routing and account numbers and just cash it at one of those check cashing places... I can't believe that our system hasn't collapsed yet.

Re:EFT vulnerability

[jonniesmokes]

Regardless of what law might or might not have been broken. This should not be so easy. I was appalled that there was no check of even a name match or similarity. Some banks do EFT validation like the way Paypal does with those little deposits amounts that you have to go check and report back to Paypal. But so many online services just initiate EFTs without any checking whatsoever. Its a system ripe for abuse. And the fact that I wasn't even aware that what I did was against the law is even worse. There's no warning or text that tells you on those websites what your supposed to be typing in. I know that ignorance of the law isn't a defense in court, but by the time it gets to court its really too late anyways. Don't law and punishment really only work if people are aware of them?

I think someone should really scream loud about this before its too late.

Re:EFT vulnerability

[TykeClone]

Currently, assuming consumers look at their statements, the only losers will be banks. Reg E gives consumers a great number of rights for their money back if an unauthorized transaction is reported within 60 days of it showing up on a statement. But it is up to the consumer to look at their statements and to report bad transactions.

Online services are not banks (unless they are banks, but that's different). If I'm at some website and want to pay via "e-check", the company doesn't have incentive to validate the account before initiating the transaction. Validating accounts require at least 1 business day to complete and require the consumer to come back before finishing the e-check transaction.

I agree that something should be done - but I think that law enforcement should take small frauds seriously and that the punishment should be harsh. Large frauds are made up of a great number of small frauds.

My mom got her credit card number nicked a few years ago. The card is from the (small) bank I work at. We reported this to law enforcement. Their answer is "that the credit card companies are the ones who are hurt, so it's no big deal." Total fraud was small, but when law enforcement has that attitude there is no chance that anyone would get caught and ultimately punished.

free money from ATMs

[RandomWordGenerator]

A 'friend of mine' used to get free money out of ATMs in the late 80's by using the simple method of a piece of stickytape. you go to the ATM and draw out £5, on those old machines and when the gate opened you had time to stick a peice of tape across the dispensing rollers. You then hang around like surly teenagers while people fail to draw money out - after 5 people have done this you go back and withdraw another £5, when the gate opens you use a pair of tweezers to rip off the tape and claim the winnings (normally around £200 - £400). Yes, my friend had few morals when he was a teenager, but a nice computer.

Re:free money from ATMs

[slashnik]

What happens when five people complain
The journal roll is checked and the five failed transactions are found to occur between two of your transactions.
I don't think you have to try this too many times before they are onto you

Re:free money from ATMs

[FLEB]

I was going to say:

But, if you replace the tape, and take only some of the money (an amount completely unrelated to either of your deposits), and lodge a complaint as well, I imagine you could get away with it.

Then I realized, that you'd still leave a trail. What dumbass uses a broken ATM twice at two different times?

Perhaps if you had use of someone else's card to make the final "withdrawal".

That's not how the Nat West Cheat worked

[TAZ6416]

Used it myself a few times when I worked in London in the 80's.

First of all, it would only work with a Nat West Deposit Account, if you did it with a current account you were screwed as you would get charged.

Lets say you had a big weekend coming up, you had £100 in your pocket and £100 in the bank. You would go to the bank and deposit £100 in the branch so you had £200 in Nat West. This would flag up on the ATM as you had £200 to withdraw, so you could go and withdraw £200 from the ATM, but for some reason (I assume the ATM's did a processing job every couple of days to a mainframe) the transaction didn't register on the branches computers for about 3 days and you could walk into the same branch 5 minutes later and withdraw another £200, so you had £400 now for the weekend. 3 days later however, the bank will have caught up and you are overdrawn by £200.

OK, now you are thinking about "hey you are going to get big charges for that", but the beauty was that it was meant to be impossible for you to go overdrawn on a deposit account so there was no charging procedures in place (the old computers are infallible thing that was mentioned in the original article), I did get called in to the bank once or twice to explain my actions but I just shrugged my shoulders and said "Well, I thought I had that much money in my account, sorry I buggered up, but why did you let me take that extra money out when I didn't have it, why didn't your computers stop me?" So I got away with it every time.

It was never a way to get free money, it was just a way to tide you over if you were a little short before your next pay day.

Jonathan

Oscar The Grouch Does America - http://www.mccormackj.fsnet.co.uk/oscarthegrouch/

Re:What happened to me - Exploitation of a bug.

[CrackHappy]

About 8 years ago, there was one branch of Wells Fargo locally that had an ATM with issues. That ATM would essentially, every night at 12:28AM, be taken off the network for some kind of maintenance. For 10 minutes, that ATM wasn't connected in any way, and because of some sort of bug, if you withdrew cash, it would never report it to the bank.

This went on for a year before they fixed it. Anytime I was really low on cash I'd go make a free withdrawal in the middle of the night.

I still don't know how it would accept my card and pin, but not withdraw it.

Call that Nuts

[slashnik]

In the late 80's,

There was a known fault on some of the ATMS where the "picker" and the "presenter" units could go into a runaway condition.

This happened on London's Edgeware Road while the shutter (remember them) was open.
So there we were with the ATM spewing £5's and &10s all over the street as fast as it could pick them.

A number of passers by collected up the money while another went into the bank to alert the staff.

Amazingly when the bank balanced the ATM they found that there was no money missing.

A retrofit was quicly engineered to prevent the presenter motors running when the picker unit was in operation.

Re:U.S. Banks

[lgw]

Using demand drafts, someone could take money from your account without your written authorization. Here's a nice description of the problem: http://www.ftc.gov/speeches/other/ddraft.htm

However, this info is 10 years old. Does anyone know what's happened to banking law in the meantime?

Re:Yeah, but which bank was it?

[DemonSlayer]

using binoculars are too low tech.
Some criminals are using card readers and hidden cameras.

http://www.snopes.com/crime/warnings/atmcamera.asp

http://bizpartner.com.my/article/23

In Malaysia, a gang even created a fake ATM machine that "collected" the users cards and pin numbers.

By the time the user get the new ATM card and the bank statement. Thousands of dollars would have disappear from their account.

Re:What happened to me - Exploitation of a bug.

[csirac]

That sounds absolutely insane.

I worked for a company who, among other things, serviced ATMs. Although it wasn't 8 years ago, they certainly looked after some of that era (and then some).

They serviced Diebold, IBM and NCR machines, among others (like those little cash terminals). If the ATM goes offline for "maintenance", the authorised field tech has to call the Bank's NOC and obtain a new 3DES key to punch into the thing.

And believe me, if there is _ANY_ kind of network problem which prevents the ATM from authorising a transaction (EVERY transaction is authorised over the network before dispensing cash), it just sits there blinking "out of order".

When ATMs screw up, they will happily eat your cards, vomit ink on your receipts, and give you LESS cash than you are charged for, but everything about their design screams "no free money for you".

If you have a dispute about an ATM incorrectly dispensing cash, they can do an individual audit at your request on the machine which should show up anomolies.

They have procedures and practices that are continually monitoring and tracking the "performance" of these ATMs. If there's a discrepency in the amount of cash reported as going out vs the amount going in, it doesn't last long...

You must have strange ATMs in the US :-)