Slashdot Mirror
Googling for ATM Master Passwords
default DOLLAR writes to mention an eWeek article following up on the ATM reprogramming scam pulled in Virginia Beach last week. A security researcher in New York has used a YouTube video, a few Google searches, and other legal methods to discover the master passwords to thousands of ATMs across the country. From the article: "Dave Goldsmith, founder and president of penetration testing outfit Matasano Security, in New York, did not say how he obtained the operator manual--which contains master passwords and other sensitive security information about the cash-dispensing machines--but an eWEEK investigation shows that a simple Google query will return a 102-page PDF file that provides a road map to the hack."
I recently did IT for the largest casino company on the planet. I was dual-property and responsible for two casinos. The master code that would open the keyboxes and get you keys to anywhere in the casino was 654321. And people told each other all their passwords and such all the time.
I couldn't believe it.
http://blindscribblings.com - Tasty pop-culture in conceptual fashion.
Close. Actually it apears that it's 001234. http://www.tritonatm.com/en/service/manuals/07103- 00013C%20(FT5KUsrMan(3.0))file.pdf
Wow that is cool, it was a quick search and I found it!
It says that to enter the management screen you hold the key and press one. Then the default UID is 00 and the default password is 12345 so you should enter 0012345 into the prompt.
I am off to the ATM down stairs. I could use a little extra cash.
Search for: atm operator manual filetype:pdf
I don't know what his was, but the one I used was:
.pdf format. Most seemed to include the default master operator password. Took me about 3 minutes.
atm operator manual
It returned a fair number of, well, ATM Operator Manuals in
No, I don't have the manual. I don't really care either, it was an interesting academic exercise.
No but this one is: http://www.diebold.com/ficcdsvdoc/TechPubs/books/T P-820327-001/tp-820327-001-1.htm
that one is.
Diebold actually makes really good atms in my opinion. At least as far as the end user interface is considered. The ones my bank uses have a lot of nice features:
- can dispense change to the penny
- can scan/cash/deposit checks
- doesn't make you hit OK after you put in your pin (aren't they all 4 chars long?)
- doesn't keep your card until the end of the transaction so you forget it
nothing
Well you can always find more interesting things by doing a Google search for: [Confidential "not for public release"] Like this
This technique was posted on Boing Boing and Bruce Schneier a couple of weeks ago. Still. Plenty of good stuff out there.
Honestly people, it isn't too hard to find this manual, the article gives you all the info you need. And no, the manual has not been pulled down from the site...yet.
Try the following search terms:
Tranax 1500 Manual inurl:pdf (and then check the 6th result)
http://www.wegrowbusiness.ca/manuals/Tranax_MB_Ope rator_Manual.pdf
or from google cache
http://72.14.209.104/search?q=cache:SUoMvavsghUJ:w ww.wegrowbusiness.ca/manuals/Tranax_MB_Operator_Ma nual.pdf
Besides, I was wrong- only the PDF for THAT SPECIFIC MODEL has been removed. Operators manuals for hundreds of other ATMs still are up....
SJW: a person who perceives an injustice, and while correcting it, commits a greater injustice.
Try this instead http://www.wegrowbusiness.ca/manuals/
The Tranax Mini-Bank 1500 doesn't require a power cycle.
- Space Rogue
This will work:
.ca
.ca but did mention it was a Canadian reseller.
Tranax Mini-Bank "Transaction Setup"
All from the article, they even put the quotes around "transation setup" for you. Didn't see
The ATM Terminals for my bank have the front keypad tied to transactions only. Want real access? then you have to get past the buildings security systems, into a locked room, unlock the back panel then unlock the cash drawers or enter a password to access the machine. (I was contracted to do the cabling when my branch added a 2nd machine.)