Slashdot Mirror
Bank Employee Plants Malware on ATMs
Wired's Threat Level has a piece on a Bank of America employee, Rodney Reed Caverly, who has been charged with installing malware on ATMs in North Carolina. Caverly, who worked on the bank's IT staff, allegedly withdrew cash untraceably from the ATMs over a period of 7 months last year. "The charges were filed the same day that credit card company Visa warned the banking industry that Eastern European ATM malware recently showed up in America for the first time. That code, initially spotted last year on some 20 ATMs in Russia and Ukraine, was designed primarily to capture PINs and bank card magstripe data, but also allowed thieves to instruct the machine to eject whatever cash was still in it... At least 16 versions of the East European malware have been found so far and were designed to attack ATMs made by Diebold and NCR, according to the April 1 Visa alert. There is no information tying the malware found in Russia with the malware allegedly used by Caverly."
Now we'll have to jump through even more hoops while banking.
Yet Another Tech Blog
(but so much more, including game and movie reviews)
http://yanteb.peasantoid.org
I RTFA, and maybe I just missed it...but did they detail how they caught the guy?
Living With a Nerd
I once deposited cash at a Diebold BofA ATM that didn't use envelopes. The little door around the cash-taker closed on the bills and stuck there, so I had to slide/pull them back out. It couldn't read the amount I'd put it (since it ended up being $0) so it made me enter it on the keypad. It wouldn't accept that I'd deposited $0, so eventually I told it I'd deposited $1 so it would give the card back.
To put a long story short, those things are not well-programmed.
Hmmm, where have I heard that before, the terms Diebold and untraceable in the same sentence...beats me!
Tired of my customary (Score:1)
This fellow will serve more time than any of the bank CEOs responsible for the huge mess in America's economy.
Although I hear diebold does better with ATM's, I can't help but wonder how much effort they put into ATM security versus the voting machine fiasco.
I went to a Bank of America branch here in Eastern NC one day last year, and saw a Windows XP error screen on the ATM. I then saw a Diebold guy coming out of the bank, and asked him about it. He says that the BoA ATMs are now running XP on them. How safe do you feel knowing that?
That should send a message to the next one.
yeah, sure. I believe this!
not
sounds to me like someone wants mr Caverly for a long time behind bars. 3letter organizations?
... what do you do if you get counterfeit bills from an ATM?
File under 'M' for 'Manic ranting'
Is this the dude who put that "This bank charges a $3 fee for you to get your own money" exploit on there?
I hate that.
Hang him.
And I suggest you do not use them either. They just operate and behave wrongly, even when they don't have malware installed.
They're slow. -- ATM's in the 80's were faster.
They're obviously running window XP. -- The standard windows sounds are used.
Well.. maybe. Or Maybe not. But Definitely not sort of.
This is why banks should use Linux. That way it would be impossible to install the same malware on all systems. Because each slightly different model, released on slightly different dates, would have different versions of incompatible libraries
“Why GNU/Linux Viruses are fairly uncommon” from Charlie Harvey
Do these ATMs omit a paper log? Because I didn't know better then ATMs log everything they do on paper, and I do hope they didn't implement that in its userland.
Caverly, who worked on the bank's IT staff, allegedly withdrew cash untraceably from the ATMs over a period of 7 months last year.
Someone watched Officespace one too many times.
Motorcycles, Robots, Space Gossip and More!
IBM bids OS/2 farewell
When will people learn ... windows is bad for you !
When you become CEO you should sign a contract saying "I will return 100% of my bonuses if my fuckups cause this company to fail".
They do. It used to be called "bankruptcy". Sadly, we have a serious aversion to that under the current administration because it might be uncomfortable for many people living beyond their means.
GM, GMAC, GE, countless banks, many insurance companies --- all of them "bailed out" of bankruptcy.
And yes, I am bitter and pissed, as are MANY other business owners. My company doesn't get bailed out if I fail. Rather, I lose all my shit and have to start over. And for the record, that's how it should be. Bankruptcy is the ultimate "stick" to keep management and owners from doing stupid and/or risky stuff. Take that option off the table and you create a moral hazard that encourages MORE, rather than less, risk taking. ie: exactly the opposite of what you are trying to accomplish
... sends out an alert on the 1st April? Seriously?
You know, there is a difference between trolling and pointing out the flaws in your reasoning. Just saying.
Make them all touch screen - no more buttons.
"Hey blindey, what's the matter? can't see the screen?!?"
I mean, where'd he find malware code for *BSD or Linux? I mean, who'd be dumb enough to use a highly-targeted, personal computer OS for such an important, high-rel application?
OH! It *was* on Windows.
Serve's them right!
Are those school kids still making ATMs play Beethoven anymore?
--- For a good time mail uce@ftc.gov
What I fail to understand is why America seems to get few if any of the best bank robbery events. How difficult is it for two people to figure out who the bank manager is, grab his wife one morning, have her call him on the phone and have the manager hand relieved 50-100k to one of the robbers in the parking lot. Two people, doing it this way once every couple of months, in several states, could make a very nice living.
The article mentions how some malware previously seen in Ukraine and Russia has shown up in the USA for the first time. While I have not been to Russia, I have been to Ukraine several times. For years now, Kiev (the capital of Ukraine) has been infamous for ATM fraud. Rule of law is very weak in Ukraine and police and the judicial system are notoriously corrupt. Anyone "caught" for ATM fraud could just bribe his way out of trouble. I even heard of fake ATMs placed in various locations in Kiev that never give out money, all they do is record info off the ATM cards and pin numbers and that info is used by the crooks later. It's been like this since at least the early 2000s. I never used an ATM on the times when I was in Kiev. I brought enough cash with me to use anytime I was going to Kiev. For the record, I used ATMs in various other Ukrainian cities and I never had a problem. In fact the only city I've ever heard of ATM fraud happening in is Kiev, but it wouldn't surprise me if it happened in some other large cities like Odessa.
WHY DID WE HAVE TO DROP OS/2 IT WAS SAID XP was bad and full of crap like this but no M$ had to pay for that golf trip.
for electronic cash transactions.
I expect to be back to only using cash in about 20 years.
The Kruger Dunning explains most post on
Um, apparently not.
We may not imagine how our lives could be more frustrating and complex—but Congress can. – Cullen Hightower
Many moons ago, my brother-in-law was an ATM tech. He told me that ATMs were the last major users of BeOS. Waddayaknow.
beos on a ATM? any ones on amiga os?
You know when they refer to someone using *all three* (first, full middle, and last names) that the cuplrit is a guilty-as-hell criminal.
Now all we need to do is to get the authorities to start referring to the bank CEOs using all three names, then you'll get your wish.
they probably didn't have a manufacturer of custom hardware, so when the OTS hardware changed with time, OS/2 didn't support the newer hardware and they had to update to a OS that could.
That *does* remind me of Office Space.
I guess a "pound me in the ass" prison is now in order...
Alot of them run on Windows so that pretty much sums up their security. In the UK, a lot of rail ticket machines are windows too.
The last place I want Windows is where I stick my bank card.
I expect to be back to only using cash in about 20 years.
If the economy keeps heading in the direction it's going, I expect to be using the barter system within 20 years.
Like as in: Hey Mr. Blacksmith, I'll swap you 3 dozen fresh hen's eggs for a pound of nails and this here yearling billygoat for welding up my broken plow blade.
I got turned down for an IT position in Chicago at BofA due to "poor credit"... at least im not a felonious, thievin' butthole...
SHEESH
Actually this is done on some of them. By the way, did you know than a great many ATMs are running OS2 Warp?
That happens all the time in the US. Someone shows up at the mall early Friday morning with a new ATM and an official-looking shirt. Sometimes the guards even help them bring it into the building and find a power outlet. The machine sits there all weekend, and every time someone puts a card and PIN into it the machine comes back with a polite message about how it's out of order. Monday morning the official-looking shirt guy shows up and says that there have been complaints that the machine is not working and they'll have to take it back for repair. Guard holds the door for them as they wheel it and a couple hundred bank account numbers out the door. I also heard of them picking up the data wirelessly, but a convincing-looking fake ATM isn't cheap.
We set up security cameras for a mall where this happened, about a month after the incident.
"Think about how stupid the average person is. Now, realise that half of them are dumber than that." - George Carlin
Oh, I dunno; maybe he showed up to work one day driving a car worth ten times his annual salary?
Just because someone can write code doesn't necessarily mean they're not dumber than a turnip.
Regards;