Slashdot Mirror
Hacker Develops ATM Rootkit
alphadogg writes "One year after his Black Hat talk on automated teller machine security vulnerabilities was yanked by his employer, security researcher Barnaby Jack plans to deliver the talk and disclose a new ATM rootkit at the computer security conference. He plans to give the talk, entitled "Jackpotting Automated Teller Machines," at the Black Hat Las Vegas conference, held July 28 and 29. Jack will demonstrate several ways of attacking ATMs, including remote, network-based attacks."
I'm stuffing all my cash under my mattress from now on. If you can't trust a Deibold ATM, what can you trust?
You almost made it through the whole summary without saying it.
...just get a deal going with McAfee? Then there systems would be completely safe and always online!
"from the well-that-doesn't-make-me-feel-better dept."
Where's the zip, the punch in your writing? This is the news business! If Larry Wall can be funny AND write Perl code, so can you!
Suggestions:
"from the All Your ATM Are Belong To Us dept"
"from the Who Says Cybercrime Doesn't Pay dept."
"from the Your Money Is In Good Hands -- NOT dept"
"from the Can We Have Human Tellers Again dept"
"from the It'll Be The Debit Of Me dept."
Rich And Stupid is not so bad as Working For Rich And Stupid.
Can the banks file a lawsuit at him?
I can't stand companies not taking security seriously.
Remember when ATMs first came out? The data being sent from ATM to the bank's systems had NO encryption.
Why? For pointing out security flaws? I know people love litigation as a means to prevent actions, however once information can be presented at a conference, any conference, don't you think that the cat is already out of the bag somewhere else.
Everyone should know that a lock can be picked. It's just a matter of return for a thief. Making the lock so time consumable to pick that it's not worth it. So the ATM manufactures have to create security that is not worth the criminals time. Now if these hacks are easy, then I think the consumers have a right to hold the banks accountable.
There are no loopholes. It's either legal or it's not.
Don't you remember Verizon and other companies SUED people when they showed their websites were UNSECURE?
It would depend upon the nature of hte hack. The promotional materials for his speech are light on details. Is this a top end ATM from NCR, or a white label generic ATM which are little more than PCs with a cash handler attached? What level of physical access does he need to the cabinet? Is this an internal exploit (implying you get your software/rootkit installed as part of a distribution) or he looking an something more subtle?
I'll reserve judgement on his expose until i read of the details; i understand why he wouldn't want to advertise the juicy details before his presentaiton, but on the other hand I'm skeptical around what he's implying.
John Maynard Keynes: "When the facts change, I change my mind. What do you do?"
Can anyone determine if these are Automated ATM Machines?
I'd better be careful entering my personal PIN number into these from now on.
Don't recall that one. Depends on the circumstances though. I remember a ton of other cases where the "showing they were insecure" part included hacking into the network in question. That's illegally accessing a computer system.
It'd be akin to you telling your neighbor that his lock sucks and him just dismissing your idea.
One of two possible scenarios then play out:
a. You show at the next town meeting that your neighbor - John Q. Noob, is using a Lockatron LT-200 front door lock, and then proceed to show pictures, diagrams, and and example lock and how to pick it.
b. He comes home the next day, and you're standing in his living room yelling "I TOLD YOU THE LOCK WASN'T ANY GOOD!!!!".
A is fine. He'll get pissed and change his lock. B is trespassing. Too often in computer security terms people consider them the same action, and they aren't.
"People who think they know everything are very annoying to those of us who do."-Mark Twain
As far as I can tell, all ATMs are based on data processing OSes - either ones with a desktop heritage then multi-processing and networking added on (Windows) or with a data processing/networking heritage with desktop added on (*nix families). It seems to me that they ought to be based on real-time control OSs, such as those used in the automotive and aerospace industry, I don't see how an ATM is any more complicated than a Digital Engine Control system, especially for state-of-the art engines. People who design such systems know about reliability, which can include security in a limited function machine. The problem with general-purpose machines is that they have generalized functionality, just hidden away. Such systems can be subverted and the extra functionality exploited. Machines built from the ground up to do only what they have to do do not have the functionality to be subverted.
I see no reason why such fixed-function machines should be much more expensive that those based on general purpose machines. There is an up-front cost in getting started, probably compensated by reduced security testing later. Wat will be harder is all the dreams the marketing people will have, of using the ATM to do other things, such as sell insurance. It will do only what it is built to do. Inflexible, but secure.
Consciousness is an illusion caused by an excess of self consciousness.
So the combination is... one, two, three, four, five? That's the stupidest combination I've ever heard in my life! The kind of thing an idiot would have on his luggage!
Threaten to disclose the vulnerabilities, get paid hush money to pull your presentation (again). Rinse, repeat.
If you were blocking sigs, you wouldn't have to read this.
Remember when ATMs first came out? The data being sent from ATM to the bank's systems had NO encryption.
Dude, it was the 1950s.How were they supposed to encrypt punch cards? Colour them in?
The data was "sent" using the secure process of having a burly security guard open the little door at the back and carry the deposits, punch cards and microfilm (they took a photo of all deposits) over to the back office.
Andrew Oakley - www.aoakley.com
What pisses me off is that he is publishing this.
Why does that make you mad?
Only two groups of people should be upset by this revelation: any thieves exploiting the weakness who may soon lose their money stream, and the banks who have to plug these holes.
The only reason the banks should have to be mad is that they may not have budgeted the costs of these fixes for this year. Well that's too bad, I'm all broke up for them.
So again I ask, why you are mad? Are you a banker or a thief? (And yes those are usually different unless you're on Wall Street.)
John
The problem is that it's a catch-22: usually the only way to find these vulnerabilities is to exploit them in the first place. And companies often don't grant access to white-hats because they think their systems are secure (or at least want to believe so), which can't be disproven until said hackers show them wrong.
One would hope that a company wouldn't press charges unless there was malicious intent (he dispensed and pocketed several hundred dollar for himself to 'test' the system). Of course, this is America, and I have nowhere near that much faith in our corporations or justice system...
Write your representatives! Repeal the 2nd Law of Thermodynamics!
No, the real reason is liability.
If you sell the machine and believe it to be secure and sell it as such with out the review & audit, and then it's proven to be insecure, fine, unknown bug.
If you audit the machine with white hat hackers, they tell you of issues, you sell the machine anyways, it's hacked, you're on a very big hook.
III.IIVIVIXIIVIVIIIVVIIIIXVIIIXIIIIIIIIVIIIIVVIII
His talk is a year old already. You don't think he's disclosed it to the banks long ago? No, they've had all the warning they need. Now it's time to prove they've fixed their equipment.
Seriously, if he never releases his info, it will never get fixed. You can talk to the I.T. staff for a year about the problems and nothing will get done. The banks can even have a guy inside I.T. shouting "we gotta fix this!!" and he'll be ignored.
Post it on the internet, deliver it to a roomful of blackhats, THEN something will get done. Until then, however, we're all still vulnerable to the bad guys who are already exploiting this kind of crap.
John
"There's a difference between pointing out that a lock can be picked and demonstrating in detail how to do it. Especially when the audience isn't limited to the owner of the lock."
Not legally, there isn't. I'll be giving a talk on exactly this subject in 6 weeks. Marc Tobias, a lawyer, has co-authored an extremely detailed book on picking, bypassing, and completely ignoring the security of Medeco Biaxial locks. Find a better analogy.