Slashdot Mirror
Another ATM Maker Pwned by Googling
bagsc writes "Kevin Poulsen of Wired.com strikes fear into another ATM manufacturer. This time, Triton ATMs had their super-secret master codes revealed by simple Google searches. Tranax was the most recent company with this problem, but probably not the last."
This is why I keep all my money in gold bullion strapped into my underwear. Of course that makes my pants weigh too much to move around in, but I wasn't realy going anyplace any how.
"Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
Ok, so people have been hacking pr0n sites, coke machines, etc, for years, but with a bit of warning ATM companies can't manage to practice a bit of security?
Even if it IS stupid user error, then BANKS can't get their act together?!?!
This just makes me feel all warm and fuzzy about Diebold, etc.
Bottom line, this is a perfectly routine default password issue. Blame your bank.
What I'm listening to now on Pandora...
I live in the UK, and we use different brands of ATM machine here. I can't find any codes that will give me free money here. Drat! Possibly for the best though, as I'm a member of an accountancy association who will kick me out if I get convicted for fraud. And I'd lose my job. My job is the best source of money for doing very little, it's just time consuming.
What is "pwned"?
I agree, I had no idea people from the WoW general forums were submitting stories here!
Probable solution? Sue google.
I wish this was a joke.
Given that Google is likely to have cached the manuals and the patches will not be ready for a couple of months (certification et al.), I wonder whether the author should have waited a few weeks before publishing the article, to give the manufacturers a chance to spread the word.
Jumpstart the tartan drive.
Lipman's Nurit ATM manuals are also available to the public on their website, which also contain the default passwords accessing the operator menus. And unlike Triton, their manuals don't even warn/instruct the user to change the default passwords. Pretty sad if you ask me.
there's another doc up there exposing the defualt master password at http://www.tritonatm.com/en/service/technical_bull etins/05-48.pdf
i emailed them about it so it might come down
i support the right to offend.
A default password that is MEANT to be CHANGED ASAP is not supersecret. It's in the fucking
manual and even if the manual is not on the web then you can probably order one from the
manufacturer and they wont make sure you even purchased the ATM to go with it.
The real news is that the people who set ATMs up and operate them are as dumb as dog shit.
UUuuuuh secret password! Uuuuuuh!
Who do I have to murder to remove "pwn" from the common technobabble lexicon?
I'll do it... Seriously...
Obviously, people don't have the brain capacity to be serious about security.
:D
What should we do?
It's simple: Shut down the internet.
No more easily-guessed passwords or dissemination of information on how to break into stuff.
No child porn proliferation and no worries about your 9yr old girl chatting with 45yr olds.
An extreme decline in virii and similar stuff for everyone's favorite OS.
In total? Awesomeness
How many real ATMs have been exploited using this information? Manuals for common hardware are basically public information (although I'm sure the vendor retains copyright to them and could conceivably also use trade secret law to keep people from sharing proprietary information). I don't really think this is much of a threat. If you are a security researcher and want to learn more, here are two ATM manuals that I've found.
Images scanned from a physical ATM manual
A different manual in PDF form
------ Take away the right to say fuck and you take away the right to say fuck the government.
Listen up kids, "owned", "pwned", "h4x0red", "l33t", was interesting for about 5 minutes 5 years ago, now it's over. Stop using them, it's pathetically annoying. Try using some proper English for once. For the love of shit, even Penny-Arcade makes fun of this crap, and it's a video game based web comic.
In the last story about this, someone posted a link to the Triton manuals. I read the manual and it did have a password in it but it said to make sure you change the password before the ATM is put into production.
My local bank has a Diebold ATM. Both this one and the one it replaced play a tune when dispensing bills. It is a short tune as if played on a piccolo with a trill at the end. It has been bugging me for years. Why does the ATM need to play a tune?
If Slashdot were chemistry it would look like this:Cadaverine
Security of physical kiosks is trivial stuff, it has been done to death, and people understand the pros and cons of the different technologies. Personally, I'd abandon the ATM and switch to the Mondo card, or something similar, as the risks are generally lower all-round and the security is far better distributed. (We're not talking what vain PHB's refer to as a smart card - which is a bit of non-volatile RAM and the processing power of a seedless grape. We're talking asymetric strong encryption with full-blown key exchange algorithms, transaction processing and - if the device is to be meaningfully secure - transaction logging, event logging and data validation. Such a system should be totally decentralized with all transactions being 100% local, not indirect via half a dozen organizations with dubious security.)
The basic technology for a totally secure, totally impervious financial system has existed for a decade and a half, maybe two, with far better response times and far lower risks to those involved. If it were updated to the technology that exists today, and enough funding was made available to get the technology in place, you could eliminate 90% of all the points of vulnerability in the banking system and eliminate 50% of the related services which - these days - serve no purpose at all.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
OK, so you have a machine full of money that will be placed out in public, where everyone and his third cousin Fingers McCrackit can play Billy Joel on the keyboard all day, using any information they can guess, beg, borrow, or steal (OK, slight exaggeration, but valid principle.)
Now, just HOW STUPID do you need to be to make it possible in the first place to gain system access from that keyboard without at least one hardware interlock that is NOT accessible without the key to the machine? You KNOW the bad guys will try everything they can think of to fool the machine; you should ASSUME that they have every piece of info on the machine that you do. (Cryptosystems -- good ones, at least -- are designed on this assumption; indeed, they assume that the adversary has a copy of your machine and all its specifications.)
A secure ATM thus REQUIRES that it be made completely IMPOSSIBLE to jigger the machine without physically getting inside its hardware. Password-protection just doesn't cut it for that level of security. Failure to provide this level of protection is SO stupid as to be a failure to exercise due care. And after all, how much does it cost to add that hardware interlock switch? Not much compared to the value of the ATM's contents...
Now for the scary part -- ATMs are, on average, far more secure than voting machines.
"My strength is as the strength of ten men, for I am wired to the eyeballs on espresso."
It's been made clear throughout the last three decades that people who should know better don't change the default password. Routers, firewalls have had this problem. Various incarnations of Unix have had this problem. VMS had this problem! Yes, people should change the default password, but in the interest of security, we should make them do it on first boot. OpenBSD makes you set up a complex root password after install.
People don't wear seatbelts, either, which is why we have such seemingly inane things like seatbelt laws. This is clearly a test for rationality. Because apparently dying isn't bad enough but being punished is. People are stupid.
If anything the headline should be "Journalist convinces managers to take support documents offline"
Are routers next?
Because if you want to talk security, you can reset the password and access *all customer data* on the most popular PC transaction software by deleting 1 config file. On every installed system up to current.
*that* is the true state of security in the finacial industry. Security consists of a chain of promises, where if something *does* happen, a chain of fines happens which obscures the impact from the consumer. The insidious reality is it is cheaper to prosecute fraudsters, pay off customers and grease the political, legislative wheels than to actually produce good software. And in an industry where cutting corners is status quo, those who don't can't possibly succeed.
This is why the focus for fraud isn't getting rid of the magnetic swipe technology portfolio, but instead to augment the backend looking for statistical anomolies, and to augment the inherently insecure swipe mechanism with shoehorned technologies (like the new magnetic signature technology), which are logistically impossible to implement nation-wide, but allow the key players to retain thier IP portfolios, investments and clout.
Our system is secure as long as we keep moving our hands and no one looks under all 3 shells at once.
Retards. Why obscure your face when you're putting your own card in the machine?
Man, you really need that seminar!
The real fun is to change the primary phone number that it dials to get authorization to a phone sex line. The call will fail to connect to a modem and fallback to the secondary number Transactions take longer, but they are racking up $4.99 per call on the ATM owner's line. Payback for the surcharge fee.
'The tyrant will always find pretext for his tyranny.' - Aesop's Fables
Theft is theft is theft is theft.
Beware of the Leopard.