Slashdot Mirror
Another ATM Maker Pwned by Googling
bagsc writes "Kevin Poulsen of Wired.com strikes fear into another ATM manufacturer. This time, Triton ATMs had their super-secret master codes revealed by simple Google searches. Tranax was the most recent company with this problem, but probably not the last."
I guess it's time for me to stop reading slashdot. This shit is ridiculous.
This is why I keep all my money in gold bullion strapped into my underwear. Of course that makes my pants weigh too much to move around in, but I wasn't realy going anyplace any how.
"Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
Ok, so people have been hacking pr0n sites, coke machines, etc, for years, but with a bit of warning ATM companies can't manage to practice a bit of security?
Even if it IS stupid user error, then BANKS can't get their act together?!?!
This just makes me feel all warm and fuzzy about Diebold, etc.
Bottom line, this is a perfectly routine default password issue. Blame your bank.
What I'm listening to now on Pandora...
I live in the UK, and we use different brands of ATM machine here. I can't find any codes that will give me free money here. Drat! Possibly for the best though, as I'm a member of an accountancy association who will kick me out if I get convicted for fraud. And I'd lose my job. My job is the best source of money for doing very little, it's just time consuming.
What is "pwned"?
Probable solution? Sue google.
I wish this was a joke.
Given that Google is likely to have cached the manuals and the patches will not be ready for a couple of months (certification et al.), I wonder whether the author should have waited a few weeks before publishing the article, to give the manufacturers a chance to spread the word.
Jumpstart the tartan drive.
Lipman's Nurit ATM manuals are also available to the public on their website, which also contain the default passwords accessing the operator menus. And unlike Triton, their manuals don't even warn/instruct the user to change the default passwords. Pretty sad if you ask me.
there's another doc up there exposing the defualt master password at http://www.tritonatm.com/en/service/technical_bull etins/05-48.pdf
i emailed them about it so it might come down
i support the right to offend.
A default password that is MEANT to be CHANGED ASAP is not supersecret. It's in the fucking
manual and even if the manual is not on the web then you can probably order one from the
manufacturer and they wont make sure you even purchased the ATM to go with it.
The real news is that the people who set ATMs up and operate them are as dumb as dog shit.
UUuuuuh secret password! Uuuuuuh!
Anybody who rents/buys an ATM to install in their store deserves exactly what they get if they don't change the default password. Are these people really that clueless to think an ATM would be secure if the password is printed in the users manual?
Who do I have to murder to remove "pwn" from the common technobabble lexicon?
I'll do it... Seriously...
Obviously, people don't have the brain capacity to be serious about security.
:D
What should we do?
It's simple: Shut down the internet.
No more easily-guessed passwords or dissemination of information on how to break into stuff.
No child porn proliferation and no worries about your 9yr old girl chatting with 45yr olds.
An extreme decline in virii and similar stuff for everyone's favorite OS.
In total? Awesomeness
Wikipedia went a bit overboard with their definition. They pulled a bit of a Clavin. Owned started with gaming where one player played so much better than the other that they owned them, in that they could do with them what they pleased. pwned came about much later and is simply a misspelling of owned, look where the o and the p are on the keyboard. pwned and teh are common typos in games where you are franticly trying to type in a comment before you get killed. Therefore using them in your text implies a sense of frantic urgency.
That's all there is to it. Anybody trying to make a distinction on when and where the proper use of the term own vs. pwn is just talking out their tailpipe.
What does having the password allow you to do? Surely you can't actually get money out of it. Can you make it not charge the $1.50 per use?
The masses are the crack whores of religion.
How many real ATMs have been exploited using this information? Manuals for common hardware are basically public information (although I'm sure the vendor retains copyright to them and could conceivably also use trade secret law to keep people from sharing proprietary information). I don't really think this is much of a threat. If you are a security researcher and want to learn more, here are two ATM manuals that I've found.
Images scanned from a physical ATM manual
A different manual in PDF form
------ Take away the right to say fuck and you take away the right to say fuck the government.
This post from last week's Google/ATM article had a direct link to the Triton manual.
Seriously, if some Wired blogger is striking the fear in ATM manufacturers, they've grossly underestimated the magnitude of the problem.
Beauty is in the eye of the beerholder.
Listen up kids, "owned", "pwned", "h4x0red", "l33t", was interesting for about 5 minutes 5 years ago, now it's over. Stop using them, it's pathetically annoying. Try using some proper English for once. For the love of shit, even Penny-Arcade makes fun of this crap, and it's a video game based web comic.
Perhaps I'm just being dumb this morning, but why wouldn't you control diagnostic mode from a switch inside the ATM, rather than by some magical keystrokes that can be input from the keypad (preferably a switch that is automatically nudged back into the normal mode when the case is closed so that you can't accidently leave the machine in diagnostic mode).
Weapons grade uranium has a risk of zero of carving hole sin your body, unless you happen to set it off, then you have MUCH larger problems to worry about then... Holes being carved in your body, more like holes being carved in your side of the planet. WGU's radiation is mostly alpha particles which won't even penetrate your skin, let alone get to living tissue.
/ properties.htm
http://www.umich.edu/~radinfo/introduction/lesson
...I didn't read them so i don't know if they also mentions the default password.
NCR ATM's are very common in northern europe.
...about 80% of the people who play CS and WoW, but that's a conservative estimate.
In the last story about this, someone posted a link to the Triton manuals. I read the manual and it did have a password in it but it said to make sure you change the password before the ATM is put into production.
He's got a damned good point. If we can't even make sure our ATMs are in working order, how can we be so sure about our own voting machines? I don't want to be a conspiracy theorist, but in all honesty too much of our hardware is being dictated by politics instead of progress. If we had less political movements, we would have more progress. Put religion aside and we'd probably learn a lot more than we were probably supposed to learn in such a given amount of time. No bashing against religion. I claim to be athiest but I'm a Scottish-Catholic/Jew in reality. >.>
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
My local bank has a Diebold ATM. Both this one and the one it replaced play a tune when dispensing bills. It is a short tune as if played on a piccolo with a trill at the end. It has been bugging me for years. Why does the ATM need to play a tune?
If Slashdot were chemistry it would look like this:Cadaverine
Google still has the manual viewable in "View as HTML" (I know this because I was curious and took a look-see).
When I read the default password, I damn near shit myself laughing.
Then I remember that these are default passwords to CASH DISPENSERS, and I stopped laughing (at least for a second).
Chas - The one, the only.
THANK GOD!!!
Security of physical kiosks is trivial stuff, it has been done to death, and people understand the pros and cons of the different technologies. Personally, I'd abandon the ATM and switch to the Mondo card, or something similar, as the risks are generally lower all-round and the security is far better distributed. (We're not talking what vain PHB's refer to as a smart card - which is a bit of non-volatile RAM and the processing power of a seedless grape. We're talking asymetric strong encryption with full-blown key exchange algorithms, transaction processing and - if the device is to be meaningfully secure - transaction logging, event logging and data validation. Such a system should be totally decentralized with all transactions being 100% local, not indirect via half a dozen organizations with dubious security.)
The basic technology for a totally secure, totally impervious financial system has existed for a decade and a half, maybe two, with far better response times and far lower risks to those involved. If it were updated to the technology that exists today, and enough funding was made available to get the technology in place, you could eliminate 90% of all the points of vulnerability in the banking system and eliminate 50% of the related services which - these days - serve no purpose at all.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
OK, so you have a machine full of money that will be placed out in public, where everyone and his third cousin Fingers McCrackit can play Billy Joel on the keyboard all day, using any information they can guess, beg, borrow, or steal (OK, slight exaggeration, but valid principle.)
Now, just HOW STUPID do you need to be to make it possible in the first place to gain system access from that keyboard without at least one hardware interlock that is NOT accessible without the key to the machine? You KNOW the bad guys will try everything they can think of to fool the machine; you should ASSUME that they have every piece of info on the machine that you do. (Cryptosystems -- good ones, at least -- are designed on this assumption; indeed, they assume that the adversary has a copy of your machine and all its specifications.)
A secure ATM thus REQUIRES that it be made completely IMPOSSIBLE to jigger the machine without physically getting inside its hardware. Password-protection just doesn't cut it for that level of security. Failure to provide this level of protection is SO stupid as to be a failure to exercise due care. And after all, how much does it cost to add that hardware interlock switch? Not much compared to the value of the ATM's contents...
Now for the scary part -- ATMs are, on average, far more secure than voting machines.
"My strength is as the strength of ten men, for I am wired to the eyeballs on espresso."
Is there anyone who doesn't love the "Bank Error in Your Favor" card? Greed, yes. Ignorance, not really. There are certainly people out there who have lost enough money to ATM fees that the prospect of getting a little back wouldn't seem as "evil" as pure theft, particularly when you're skimming it from a faceless, nameless machine that is tied into a mega-giant bank. I'm not saying that bank robbing is noble or hardly justified, but a faulty ATM seems about as ignorant as my bank forcing to cough up four bucks to withdraw $40 from an unapproved machine.
So is the process for a sex change and full recovery while being institutionalized for mental unstability. But you're a coward so there is no telling how long you've been away is there....
It's been made clear throughout the last three decades that people who should know better don't change the default password. Routers, firewalls have had this problem. Various incarnations of Unix have had this problem. VMS had this problem! Yes, people should change the default password, but in the interest of security, we should make them do it on first boot. OpenBSD makes you set up a complex root password after install.
People don't wear seatbelts, either, which is why we have such seemingly inane things like seatbelt laws. This is clearly a test for rationality. Because apparently dying isn't bad enough but being punished is. People are stupid.
If anything the headline should be "Journalist convinces managers to take support documents offline"
Are routers next?
Because if you want to talk security, you can reset the password and access *all customer data* on the most popular PC transaction software by deleting 1 config file. On every installed system up to current.
*that* is the true state of security in the finacial industry. Security consists of a chain of promises, where if something *does* happen, a chain of fines happens which obscures the impact from the consumer. The insidious reality is it is cheaper to prosecute fraudsters, pay off customers and grease the political, legislative wheels than to actually produce good software. And in an industry where cutting corners is status quo, those who don't can't possibly succeed.
This is why the focus for fraud isn't getting rid of the magnetic swipe technology portfolio, but instead to augment the backend looking for statistical anomolies, and to augment the inherently insecure swipe mechanism with shoehorned technologies (like the new magnetic signature technology), which are logistically impossible to implement nation-wide, but allow the key players to retain thier IP portfolios, investments and clout.
Our system is secure as long as we keep moving our hands and no one looks under all 3 shells at once.
pffff... Only americans needs the "master password". Some time ago, in Sao Paulo/Brazil, criminals were stealing the entire ATM (no, I'm not joking).
ilex paraguariensis for all
Triton requires that in order to get support for your ATM, you must first attend a training class on them. In the training class, they always recommend you change the default password. It even says so in the book. So who makes you vulnerable? It's the people who buy the ATM and service them, not Triton.
Honestly, if you don't change the password what do you expect??? Hi, I am password please don't change me!
Only two things are infinite, the universe and human stupidity, and I'm not sure about the former. ~Albert Einstein
these guys came up with much better plans than googling for passwords... just take the whole darn thing!
"i stand on the edge of destruction" -shai hulud
lipman NURIT 5000 ATM Manual
NURIT 6000 ATM Manual
The NCR Personas manual is out there somewhere, too. They're just manuals -- the vendors give them away on their web sites...
In an electronics class I took we made our own PCBs. One guy put a tiny little capacitor in backwards. The result was *very* loud.
Anyone know what happens if you plug one of these suckers in backwards?
-Qyiet
Pwned came from the word owned. That much is clear. But I have a little update to add based on my own experience. I have no idea if this theory is correct but I think it might add a little context and might explain the origins of pwned, with a "p". I can only tell you about when I first saw it.
...and it's not "owned with a stick" as a previous poster mentioned, which is clever - but wrong.
I have played computer games a long time. A really long time, in fact. And the first time I remember seeing pwned with a "p", was back in the early counterstrike beta days. Yea, as in Half Life 1 - Counterstrike (beta). Like when we had the good ole days of "gun running" (stealing all your enemies guns and "running" them back to your own base). At the time, there were really good CS players (those that had DSL) and really bad CS players (those on dial-up). Obviously, lower latency gave those with DSL a major advantage. And remember, this was the early days of FPS multiplayers so there were still hiccups and imbalances so yes - latency made a major difference. Anyway, on almost every occasion, the low-ping-bastards (LPB) would absolutely destroy the high-ping-bastard (HPBs).
If you look at your keyboard, you will see that "o" is right next to "p", in most cases. The non-word "pwned" originially came from DSL players trying to type between kills. They just hit the wrong damn button. And then some newb (who didn't know what it meant), kept it going as he started "pwN1ng joo".
Anyone remember seeing it earlier?
People don't wear seatbelts, either, which is why we have such seemingly inane things like seatbelt laws. This is clearly a test for rationality. Because apparently dying isn't bad enough but being punished is. People are stupid.
Then tell me why I am not allowed to drive without seatbelt, yet others are still allowed to smoke, to eat fast food or to go skying without proper training, all of which are probably a lot more deadly?
I've always wondered if there were any "secret codes" left behind by the firmware developers for vending machines. I'm not up to messing with an ATM, but it sure would be cool to know how to get a free soda or candy bar the next time the damn machine eats my money.
Anyone got a line on those kinds of "default passwords?"
Kevin Poulsen is a notorious ex hacker and phone freak, who's feats were much more impressive than most of the better known hackers. This guy is something of a legend.
From wikipedia: http://en.wikipedia.org/wiki/Kevin_Poulsen
"His best-appreciated hack was a takeover of all of the telephone lines for Los Angeles radio station KIIS-FM, guaranteeing that he would be the 102nd caller, and netting him a Porsche 944 S2"
According to the book about him he also
1. Broke into numerous Ma Bell facilities.
2. Hijacked and sold unused numbers to a prostitution ring.
3. Located and listened in on various government taps on foreign embasies.
4. Succesfully snuck into the office of the officer assigned to his case to figure out if they were close to catching him.
However these details are from the book that according to the wikipedia entry, poulsen himself "decries." I don't know what "decries" means in terms of poulsen's view of the books *accuracy*, but maybe some knowledgeable slashdotter could clear things up?
p.s. blog.wired.com isn't loading for me, so I unfortunately didn't RTFA
for a while. And just for the record, all Triton ATMs I have tried in the past 4 years have not had the default password.
http://www.youtube.com/watch?v=cmW_4R81jVU
FWIW, Cisco routers do NOT have this problem, at least as far as remote access. If the 'line' password for the telnet vty isnt set, it simply doesnt let you telnet in, at all. The only way to access a brand new router is with a physical serial port connection.
Actually, the labels are prettry unnecessary, even in American courts. Between the already existing precedents on liability and the laws that specifically govern situations like this, they do little more than let corporate lawyers sleep better at night in a land where McDonalds settled with a woman who spilled coffee on her lap.
DATABASE WOW WOW
who needs condoms when you're sterile? :D :P
this is my first time i get into this website and i found it as a really good place to find an information to gain more knowledge about IT...and i can use the knowledge when i am graduate soon as IT worker... there are a lot of information that was new for me and everyday more and more latest news come in... and for this issues which the ATMs had their super-secret master codes revealed by simple Google searches...this is surprise me...make me feel unsecure and take all the money in the bank and make a manual saving at home...hahaha...very funny...
Another ATM Maker Pwned by Googling... What is PWNED??really need an oxford right now...perhaps more than that...
We have seatbelt laws because the insurance industry lobbies for it. It has nothing to do with heartfelt worry for your walfare(as long as you're well) or rationality as you call it, but then again where is the rationality of spending $Billions on risks that are tantamount to winning a lottery. They are legislating morality in a perverted self-serving way and even if everyone was wearing their seatbelts like a good-luck charm, those laws would still be in the lawbooks. It's as if making people less responsible for their choices will somehow make them more so. Like spoonfeeding someone today will make them less hungry tomorrow. And that's exactly what you are describing.
hmmm... yes. I guess this is security through obscurity http://en.wikipedia.org/wiki/Security_through_obs
In theory, there's no difference between theory and practice; in practice there is.
NO WAI!
Women are just naturaly driven to get in your pants, I can't figure it out. I wear a pair of bluejeans out to the resturant and set them aside, I mean I'm going to mow the grass, clean the garage and put out the trash later the next day so why should i wear a clean/clean pair of jeans when I have a pefect pair of worn/clean blue-jeans to get dirty/dirty! So what happen, the natural instinct takes over, she senses the worn/clean pants on the floor (Temporay storage) picks them up, takes out all of the money in them, leaves the wallet and puts the pants I was saving for yard-work tomorrow in the dirty clothes hamper! After that she's angry with me for making her steal the money out of my pockets and leaving my "dirty" pants on the floor for the rest of the day so I don't even get laid that night! She wouldn't even touch my dirty/dirty stuff, makes me wash it myself; not in "her" machine either, I have to take it the the laundromat and she wouldn't even give me my own change back to do it with!
Apocalypse Cancelled, Sorry, No Ticket Refunds
I worked for a small ATM manufacturer/distributor for nearly a year and I'll tell you that ATM security has gotten a lot better (this was 6 months ago so I'd say '05 was the year of change) with encryption changes and more importantly the requirement of BACKGROUND checks on people who purchase ATMs. These little passwords and such are not very important, I have plenty of master passwords to ATMs all around the city and I'll tell that while it is possible to steal money it is NOT easy and does require hardware/programming knowledge that even I can barely handle and I wrote software for these machines. It is very easy to trace information on these atm's and rarely is this an exception.
As a user of an atm all you have to fear is protecting your credit card number and your PIN. Watch for cameras and installed card readers. Past that if the keypad looks tampered you do not want to touch the machine, the latest VISA requirements hold keypads to VERY high standards but only on NEW ATMs. Past that... there are lots of other ways to steal from atms... I'll tell you that there isn't too much to fear though as the people at the manufacturing level (me) are usually not interested in or capable of such complicated thefts. More likely the ATM will get yanked out of the wall, there will be a camera and a tampered machine to get your PIN, or something similair. But once again tampering with keypads is getting VERY difficult and has been impossible on Tritons for some time (german (if I recall correctly) made keypads which are VERY nice). These things are MUCH more secure than voting machines in that without your PIN no one can reach your money.
Equally important is the password complexity. Windows Server 2003 prompts for a password at installation and insists on a certain level of complexity, although you have the option of entering password of lower complexity, which is guaranteeing that a lazy or overworked admin will enter 'password' and tell himself he'll get back and enter a more complex one when he has time. And inevitably never does.
But an ATM or similar machine should enforce a password complexity level, and even provide a password generator with appropriate precautions and dialogs warning that if that password is lost then it will be *hell* to reset it.
Simple stuff.
Who is this delectable creature with an insatiable love of the dead?
No 1 search engine already proved that they manage to find anything for their user...hehe...like it or not..agree or not...just google it lah..
Banks should be more aware if they want to publish or to give any data to others. This thing might happen unintentionally but it's definitely scared the clients. But, banks are not the only side to blame, because they can't monitor their entire client all the time. Plus, something is more secured if we do it in a traditional way. I'm not sayin that technology is not good enough but the more security we implement, the more people trying to crack them out. Take the online voting as an example. We should not blame google as well. Google is just doing its job by providing the requested information to the users.
Lastly, all I want to say is, long live Google.. Google rocks... Y(*_*)Y
can somebody tell me how to get score more than one??
i aint loosing my money..but i'm gonna loose my mind... thinking about how can i get more score in slashdot..
Banks should be more aware if they want to publish or to give any data to others. This thing might happen unintentionally but it's definitely scared the clients. But, banks are not the only side to blame, because they can't monitor their entire client all the time. Plus, something is more secured if we do it in a traditional way. I'm not sayin that technology is not good enough but the more security we implement, the more people trying to crack them out. Take the online voting as an example. We should not blame google as well. Google is just doing its job by providing the requested information to the users. Lastly, all I want to say is, long live Google.. Google rocks... Y(*_*)Y
Actually Diebold ATMs need to be physically opened (in some cases opening a combination lock with a constantly changing combination) and then require two passwords (one to disable the alarm and one to login) to access any admin controls. These appear to be the low end models of the ATM world that have this blatant flaw.
Is Fingers McCrackit a Free Open Source character, so I can write stories of his continuing adventures terrorizing ATM vendors everywhere?
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
this situation make me always think about money everyday,everytime,everyseconds and maybe one day i cannot sleept. think about money that i always carry on in my beg and make me see the doctor coz of backpain...maybe scary of atm.... but no matter what, atm is still atm but now in danger version. "u know what, sometimes i think to create my own atm to be put in my house in the future"
Samantha Carter: Actually, it's what.
Please, for the good of Humanity, vote Obama.
oh well on the internet nothing is impossible!
Ever since the world revolution, technology has been changing at a fast pace. technology more updated and bring good consequences to human but sometimes tecnology also bring negative effects to society and this is the effect from the technology itself. :easily to be pawned oh my god really feel insecure now.
So I just noticed that the "Master Code" is equal to the password for the Air Shield. On a lesser note, I need to remember to change my luggage combination now.