Slashdot Mirror
UK ATM System Could Have Ruined Economy
seanyboy writes "The Register is running the story of how the UK banking system could have collapsed in the early 1990s, how easy it was at the time to withdraw against other people's accounts and the worrying case of a Bank's rogue IT Department." From the article: "What quickly became clear was that the law needed a system to provide proof that events had happened so that legal cases could be made. You might say that 'the computer debited the account', but to a barrister (and more importantly, a judge) that's not enough. Did the computer do it at random? In that case it's like a tree branch falling - an accident. Or did a person program it to do so? In which case the person must be able to testify about the precise circumstances when a debit could happen. Sounds daft, but the law rests on proving each step of an argument irrefutably."
The worst part of the story was that the lawyer couldn't tell anyone about the security problem because he was no longer retained by his original client. I believe that in the US attorneys are obliged to come forward with information related to a criminal nature because they are officers of the court. I don't know if that distiction would have helped in this case, but the fact that the whole system perched precariously on the fact that only a few criminals knew how to bilk the system is disturbing.
"Rocky Rococo, at your cervix!"
I had an account with National Westminster in '87 when I lived in the UK. The ATM's would always let you take cash out no matter how much in the red you already were. (It was my roommate that took advantage of it, not me, honest!)
I went to withdraw from an ATM. I put the card in, entered my PIN, and selected the amount I wanted - $200.
The ATM goes nuts and procedes to give me only $160 while debiting my account two transactions: one for $200 and another for $160.
I call my credit union and I tell them what happened. They tell me to fax a letter stating that I was diputing the $200. I did. They audited the ATM.
Long story short, the credit union backed out the $200 debit.
Evil people don't think they're evil. - George Lucas, Making of Ep III
lifts up his mattress and whispers to his stash of crumpled bills that he knew they were safe all along and the youngsters just don't know! They JUST DON'T KNOW!
My humor is probably your flamebait
It would be a sad thing if we've already lost our democracy.
Abstinence is a government conspiracy. www.SafeSexZone.co
Computers? Pah! Everyone knows that back in those days it was a midget with a box of money, trained to make BEEP! BEEP! noises.
Mother, do you think they'll like this sig?
banks rob YOU!
+1 funny, -2 overrated. Life isn't fair.
The article has a number of strange assertions. First, only 3 PINs being generated by the card issuing system. I can see this is possible if you hack the application code itself but the HSMs (hardware security modules) that actually do the cryptographic operations wouldn't do this using Visa, IBM or Diebold PIN offset generation calls. It's possible, but it would be an insider job in one bank NOT the whole banking system. Second, the description of the scam is that one PIN offset on track 2 can be used with multiple account numbers. Again, all the standard PIN methods explicitly prevent this - the account number (PAN) is part of the input data to the PIN verification call. Third, the description has the crook shoulder surfing for PINs. Why does he need to do this if any known PIN can be used with any account? He only needs one known PIN and the corresponding card to be able to write as many cards as he likes. I'm sure there's some truth in the story but the technical detail is unconvincing.
computers have been a synonym for organized fraud in other places.
In Mexico, in the 1988 elections, the opposition candidate was winning by a large margin according to the official data. Then suddenly, "the system crashed", and when it came up, the official party was winning by a large margin.
This event was called "La caida del sistema de 1988", and makes me think that there's nothing new under the sun (Diebold voting machines, anyone?).
The lesson is clear: Regarding data and computers, if someone can do something wrong, he WILL. So auditing is a must.
2 - The UK didn't have something similar to Reg E in the United States regulating "electronic" banking (in the US, that would include ACH items, wire transfers, and ATM/debit card transactions). And apparently, the UK doesn't have the banking regulatory structure to add such regulations as necessary without passing new laws.
If anyone is interested, here is Reg E in all of its glory.
A fine is a tax you pay for doing wrong and a tax is a fine you pay for doing all right.
My dad, who used to work for a well-known UK building society, told me a story sometime in the early 1990s of how there had been some buggy code on all their ATMs. When making a withdrawl, the machine would issue the cash and wait around a minute. If you hadn't taken the cash by then, it assumed you were still waiting for the cash to be dispensed and would issue it again, possibly even several times over if you kept waiting and waiting. Apparently it took the company quite some time to discover this bug.
I'm reasonable sure the story is completely true, although since my dad isn't around anymore, I can't ask him about it.
Organic free-range music... yum!
Related to this is the completely insecure EFT system in the US. One time, just to see if I could, I typed my friends routing number and checking account number into my online credit card website. She had given me a check, and so I wasn't stealing from her. I was just debiting the funds from her checking account in a slightly different way. The credit card online website had no trouble taking the money out of her account and crediting it to my account.
But this story gets better. I went on a trip and didn't see my friend for a few weeks. She noticed the debit in her checking account and at first thought it was something fishy. She called her bank and they told her the name of the credit card company and said that she'd have to call the credit card company to find out more. She called the CC company and they couldn't help her even though they had taken her money. After a couple weeks, she made the connection that it was probably me, sent me an email and I confirmed it. She had a father who went to jail for banking fraud and wasn't freaked out by things like this.
But the point is, that there's no security on EFT transfers, or for that matter checks. I could print up a check if I know the routing and account numbers and just cash it at one of those check cashing places... I can't believe that our system hasn't collapsed yet.
Used it myself a few times when I worked in London in the 80's.
First of all, it would only work with a Nat West Deposit Account, if you did it with a current account you were screwed as you would get charged.
Lets say you had a big weekend coming up, you had £100 in your pocket and £100 in the bank. You would go to the bank and deposit £100 in the branch so you had £200 in Nat West. This would flag up on the ATM as you had £200 to withdraw, so you could go and withdraw £200 from the ATM, but for some reason (I assume the ATM's did a processing job every couple of days to a mainframe) the transaction didn't register on the branches computers for about 3 days and you could walk into the same branch 5 minutes later and withdraw another £200, so you had £400 now for the weekend. 3 days later however, the bank will have caught up and you are overdrawn by £200.
OK, now you are thinking about "hey you are going to get big charges for that", but the beauty was that it was meant to be impossible for you to go overdrawn on a deposit account so there was no charging procedures in place (the old computers are infallible thing that was mentioned in the original article), I did get called in to the bank once or twice to explain my actions but I just shrugged my shoulders and said "Well, I thought I had that much money in my account, sorry I buggered up, but why did you let me take that extra money out when I didn't have it, why didn't your computers stop me?" So I got away with it every time.
It was never a way to get free money, it was just a way to tide you over if you were a little short before your next pay day.
Jonathan
Oscar The Grouch Does America - http://www.mccormackj.fsnet.co.uk/oscarthegrouch/
In the late 80's,
There was a known fault on some of the ATMS where the "picker" and the "presenter" units could go into a runaway condition.
This happened on London's Edgeware Road while the shutter (remember them) was open.
So there we were with the ATM spewing £5's and &10s all over the street as fast as it could pick them.
A number of passers by collected up the money while another went into the bank to alert the staff.
Amazingly when the bank balanced the ATM they found that there was no money missing.
A retrofit was quicly engineered to prevent the presenter motors running when the picker unit was in operation.