Slashdot Mirror
ATM Vendors Threaten, Stop Research Presentation
An anonymous reader writes "A presentation about 'The Underground Economy,' by Italian white hat hacker and security expert Raoul Chiesa, was replaced at the last minute during last week's Hack In The Box conference. The reason behind this cancellation was that Chiesa received legal pressure from ATM vendors over the fact that the originally scheduled presentation covers details of various techniques and exploits of vulnerabilities that cyber criminals use to break into ATMs — flaws that have been known for a long time."
No government nor corporation has a right to muzzle our mouths.
"I disapprove of what you say, but I will defend to the death your right to say it." - historian Evelyn Beatrice Hall
The people who are using it to cause damages already know how this is done. The only dangerous part about something like this is that the public might be made aware of just how far from secure most financial transactions are.
you'd rather your bank was burgled?
No, I'd rather hold the bank responsible for any loss. They should have to replace the money. With that kind of incentive, they might actually try to make their systems a bit more secure. An important step in this direction would be to quit using cheap commodity systems in their networks.
For justice, we must go to Don Corleone
presenting this information can only decrease the security and value of your savings.
You're an idiot.
As the article states, the information is already known by the bad guys. Keeping it secret helps the bad guys, and hurts everyone else. Making it public will encourage the banks to fix the vulnerabilities, which will increase the security and value of my savings.
anyone that argues that the information needs to be public is probably broke.
No, the people who argue that the information needs to be public actually understand the issue here.
Security through obscurity, we all know how well that works... *sigh
~men are from earth. women are from earth. deal with it.~
If researches aren't allowed to talk about those flaws, perhaps they'll just go away?
in the USA?? I would not recommend that at all. Just put it on the net from a secure location..
For justice, we must go to Don Corleone
in the USA?? I would not recommend that at all. Just put it on the net from a secure location..
Have the Chinese host it.
Dear China: Please host this to show the decadent capitalist pigs who are enslaved by the banks how their system is screwing them over.
RIP America
July 4, 1776 - September 11, 2001
the people who argue that the information needs to be public actually understand the issue here.
It seems to me that the people that understand the issue here the most have chosen not to go forward with their public presentation.
While I'm not sure if they are legally responsible, I would have to say that they do bear the cost. I have had my bank card duped twice in the last 4 years, and both times the bank fixed the problem before I even realized the money was gone. I'm not sure which banks you deal with, but of all the times I have had this happen to me, or any body I personally know, the bank has put the money back in the account very quickly. Granted it would be better if it didn't happen in the first place. However, depending on how severely the system is flawed, it may not be possible to fix the problem at all, without changing out all the current machines, and settling on a new standard, which may again have its own list of faults.
Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
Remember when Jeff Moss had his talk cancelled, or Kim Zetter? All it did was make people salivate to read thier presentation when they released it online at a later date. The last thing you want to do to this demographic is tell them the info is "too dangerous (see awesome) for them to hear. It will be everywhere with in the week.
sig loading.......
It seems to me that the people who understand the issue here the most have been intimidated into inaction by people who might or might not understand the issue but understand that revealing any flaws in their methods would mean less profit for them, and that's all they care about.
There are two kinds of fool One says 'This is old therefore good' Another says 'This is new therefore better'- Dean Ing
Any devaluation that may be happening with the dollar is irrelevant to this discussion. Chewbacca would have been more relevant to the discussion.
The banks will do what they always do: pass any costs plus a hefty markup to the consumer. The banks make more money on fees and penalties than they ever did as honest bankers. Like they do now. $3.00 ATM fees?!? The transaction is pretty much free to them. Sure , they have a lot of bogus "costs" they say they incur, but the fact of the matter is ATM fees are extremely profitable gravy that are only beat in profitability by the fees that cell phone carriers charge for text messages.
RIP America
July 4, 1776 - September 11, 2001
so EVERY bad guy, including would-be bad guys, already know this? do you know it? how about you post it as an anonymous response to this comment.... i mean, it's everywhere, right?
Oh yes, because the fact that someone far removed from the problems doesn't know the details of it prove that no one could possibly already know the details. I mean, it's so obvious, no security issues exist, because I don't know about them, so if I don't know about them, then no one can, because they can't be well known. IT'S PERFECTLY REASONABLE LOGIC! /sarcasm
you mean the issue where more exposure can only lead to more exploitation, and degradation of the value of a dollar?
*citation needed*
are offenders currently prosecuted and convicted?
Probably not. It's kind of hard to arrest and prosecute someone for doing something you don't even know is possible...
if the specific exploit was plugged, would others ALWAYS still exist?
Ah yes, the great 'there will always be problems, so why bother fixing them' argument. Remind me never to work with you, you're the worst kind of person for working on technology. Will there always be issues? Probably, though not certainly. Should those issues be fixed as quickly as possible (prioritizing bigger issues of course). YES. Period. Not fixing the problem and silencing people to keep it hidden is the worst kind of security that exists. It's like sticking your head in the sand so you can't see the bad things happening around you, and it's bound to cause more issues than just fixing the problem would. But heck, if it's never going to be perfect, why not just open the thing up so that people can steal money whenever they want?
There are two kinds of fool One says 'This is old therefore good' Another says 'This is new therefore better'- Dean Ing
GOD FORBID they should step up and take responsibility for the problem. No we'll just sweep this one under the rug and hope no one is looking. Then they have the audacity to threaten the author if he reveals what he knows. Bastards. I agree with others that Wikileaks is probably the best way to do this. Beware those who seek to control information for they see themself as your master (someone here has that as their sig and it seemed appropriate for the occasion). Shoehornjob
Its funny that they think, I'm assuming, that not letting someone speak about it is helping them in any way. The more people who know about vulnerabilities the safer we are because while there will be more people working to exploit it, there are also more people working to patch it.
Where has reason in the world gone? Have we abandoned it in favor of power and politics?
where are all the headlines pointing out how easily tumbler locks can be opened?
This isn't a headline of how easy it is to bypass ATM security, per se (as what you're implying), this is if, for example, Schlage or Master tries to tell a locksmith that he cannot give a presentation on some of the vulnerabilities of a padlock. There are ALREADY dozens of books out there for sale in major bookstores and Amazon.com detailing how to pick locks -- describing techniques and tools (and some books tell you where to obtain these tools). The lock-making companies have responded not by attempting to curtail the freedom to publish this information, but to make the locks stronger and more difficult to bypass.
security isn't about building the biggest wall.
Security through obscurity -- which is what the banks are essentially desiring in this case -- isn't all that effective either.
presenting this information can only decrease the security and value of your savings.
No, the bank itself not spending its "hard earned" profits on increasing already known and presented security issues decreases the security and value of your savings.
"A government is a body of people usually -- notably -- ungoverned." -Shepherd Book
so it seems you believe the banks should upgrade their entire ATM hardware infrastructure, and yet you complain about a fee and claim the transaction is "pretty much free".... yeah, except for their costs. a french fry is pretty much free to mcdonald's. why do they charge for them?
you mean the issue where more exposure can only lead to more exploitation, and degradation of the value of a dollar?
*citation needed*
so you are suggesting that publishing instructions on how to perform an act will lead to less people executing that act....... *logic needed*
the great 'there will always be problems, so why bother fixing them' argument. Remind me never to work with you, you're the worst kind of person for working on technology.
ahhh yes, the classic "don't point out the potential of man in the middle network attacks, or the ability of humans to get inside a closed box" argument.
you aren't qualified to work with me.
Says the moron that thinks ignoring the problem is as good as fixing it.
Maybe the people who are trying to stop the information from going public are some of the same people who are exploiting the flaws. The more public the flaws, and the more people exploiting it, the more likely it is that the flaw will be fixed. If you were making lots of money from an existing flaw, wouldn't you want that flaw to remain open?
Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
only a moron would conclude that i think the problem should be ignored. i think that publishing the details of how to steal money from banks is irresponsible... and it seems so do the people that were going to present it, as they have concluded it is in their best interest to not present it.
so EVERY bad guy, including would-be bad guys, already know this? do you know it? how about you post it as an anonymous response to this comment.... i mean, it's everywhere, right?
Actually, probably everybody on this conference knows about this already.
Also it's not like he gives a step by step presentation on how to get cash out of an ATM.
How do I uncompress my MD5 archive?
What decade are you living in? Banks don't bear costs, taxpayers do in the form of bailouts. If the government is just going to print money to give to the banks, why not instead go with a simpler system where a fraudulent ATM withdraw is simply not recorded as a debit to any account? Same inflation either way ...
Socialism: a lie told by totalitarians and believed by fools.
Never argue with a man who cannot learn how to operate the "Shift" key.
Socialism: a lie told by totalitarians and believed by fools.
Michael Kristopeit: YOU ARE NOTHING!
"so you are suggesting that publishing instructions on how to perform an act will lead to less people executing that act....... *logic needed*"
Everybody who has half a brain and went through basic chemistry knows enough to wreak some toxic havoc. Hint: bleach + ammonia. Do you think we should ban chemistry books, wannabe inquisitor masturbator boy? Afraid of knowledge? Scared by science? Did a science jock beat you up in high school, loserboy? Did he twist your arms while reading Aristotle?
Geeks are so full of shit that "beating the crap out of them" takes a whole new meaning.
Try watching "Corrupt Banking System" on Youtube...
You obviously don't know what the Fractional Reserve system is, nor that the banks now OWN all of us, since we can never produce enough goods or labour to pay off all the debts that the banks are allowed to print out of thin air...
A large amount of criminals are rather dumb. That is often why they choose a life of crime. In particular, someone who is going to go around trying to hack ATMs is pretty dumb. You aren't going to get a whole lot of money out of them. If the hack is based around someone's particular account, you'll get a max of like $500 per day for an account, that is generally the highest you see withdrawal limits (if you need more you go in the bank). Even if you could get the ATM to empty itself, you'd get maybe $10,000-20,000. Ok well that is on a device that has a camera, and belongs to a financial institution. Banks have a lot of pull with law enforcement and a lot of reason to want to catch someone stealing from their ATMs.
So, doing this would be a dumb crime. Doing it once, the only real way you are going to have a chance not to get caught, doesn't net you enough to be worth it. Doing it on a recurring basis pretty much guarantees you get caught. It is just not a smart crime.
As such the sort of people who would do it are not the sort who are going to sit and carefully investigate ATM security, perhaps buy their own and test it. They are the kind of criminal who would do it if there's a how to guide. If someone gives them the directions, they'll say "Hey, easy money!" and do it.
Thus keeping it obscure really DOES work. This "Security through obscurity doesn't work," thing is a bogus statement that people online like to parrot. While it isn't the best kind of security, it doesn't mean it is worthless.
In the real, physical, world you have to accept that all security is imperfect. No matter what you do, someone can get by it. You can have an underground vault surrounded by trained armed guards, doesn't matter. All someone needs is an attack force large enough to get rid of your guards and sufficient time and tools to physically dismantle your protections. There is no magic, perfect, "Nobody can get past this." You can only aim for two things:
1) Having security good enough that nobody who would try to get through it could. Whatever level of threat you are likely to face, you have security that can stop that.
2) Having security that seems good enough that nobody will try. Make it intimidating to the point that nobody is going to even attempt to get around it.
Well, part of #2 is obscurity. You don't tell people everything you are doing. They don't know what all they have to get past. Their ability to try and draw up a plan is compromised by the fact that they do not know what all they have to deal with.
Take something like, say, the security of the CIA building. There's plenty of security you can see, they have their own, armed, police force, there are physical barriers and so on. However if you think that's all there is you are a fool. What else might there be? You don't know, and that makes it real hard to plan how to overcome.
Publication, or the threat thereof is the only way that this problem will get addressed. According to this researcher, these exploits are being used by criminals right now. Its the ATM companies that want this covered up, so that they can present their machines as "totally secure", when in fact they're riddled with more holes than Swiss cheese.
In fact, publication would help the banks, as they would be able to test ATMs to see which ones were vulnerable. This would allow them to hold the ATM vendors accountable, rather than just having to accept a certain level of "loss" from ATMs.
We all know what to do, but we don't know how to get re-elected once we have done it
There is such a tendency on /. to think in black and white.
It's already known by some bad guys. How widely known is another matter altogether - are they discussing it openly on web forums? Discussing it openly on web forums which require registration and somebody who's already on the forum to vouch for you before they'll let you view anything? Discussing it on Usenet? Discussing it under blankets in a locked room after dark?
How widely is it being exploited in the wild? How much is being lost every year through this sort of fraud? How much would it cost to fix?
... so arguing logic in response to ignorance, according to you, makes someone scared of knowledge and science, and the reason that that someone would be scared of knowledge and science would be assumed to be because a "science jock" beat them up in high school.
living up to your username at least. wouldn't someone scared of knowledge be too scared of having the knowledge of being scared of knowledge that they would never actually be scared of it? or is that too much science and logic for you? do you rely more on weak stereotypes and dogma?
i never said ban the information. i said that publicly presenting this specific case is irresponsible and doesn't teach anyone anything other than how to steal from banks... an act that has no non-criminal use, in direct opposition to chemistry which always has a potential non-criminal use. the presentation is no more useful to a banker or banking student or society, than would be a text explaining why leaving the bank's money out in the open in the lobby utilizing the honor system is worse than hiring a teller and putting the money in a drawer kept closed with a 6 pin tumbler lock. at the same time, putting all money sequentially behind every known security lock, guarded by armed men is too wasteful for a commercial bank to remain in business, and also suggests the local populace requires this level of protection from themselves and their neighbors.
PEOPLE CAN STEAL FROM BANKS. THE JUSTICE DEPARTMENT PROSECUTES AND CONVICTS PEOPLE THAT STEAL FROM BANKS. YOU ARE ONLY AS SECURE AS YOUR NEIGHBOR CHOOSES TO ALLOW YOU TO BE. DEAL WITH IT.
This is the same as when anti-white racists put pressure on any forum that tries to have speakers speak about the facts of the genetic basis of racial differences in intelligence and more importantly morality and behavior.
No one tries to save free speech there! Even when it is the destruction of their race that is at stake!
And your a hell of a lot more secure with an alarm system and security cameras and deadbolts on your doors than unlocked doors and no security system.
Even though this is not the first time that ATM vendors prevented a security researcher to publicly disclose findings about flaws in their devices at a conference, this instance is really surprising, since Chiesa held this same presentation at a couple of security conferences already, and the slides he employed are also available online.
The thing is these slides are sanitized, the details of the ATM attack were removed.
Does anybody know where to find a non-sanitized version?
LOL. No information is "criminal" or "non-criminal". Information is just information and it's good for people to know just how secure the machines they rely on to handle their cash is. Those ATM vendors were just scared that people could know how insecure their hardware and software was, and that they would have to spend money (SHOCK! HORROR!) to address the issue. Better to silence those dangerous "citizens", in the interest of corporate buggery.
Run, coward, run. I live. I hunger. Beware.
Geeks are so full of shit that "beating the crap out of them" takes a whole new meaning.
Is that chip-and-pin is supposed to be "secure" so the liability for fraudulent transactions can be shifted back onto the consumer, or at the least, they are expected to somehow prove their innocence (that they didn't leak their pin somehow) which is generally impossible.
In the manner in which they are currently deployed, chip and pin cards are no more secure than regular non-chipped cards, but not everybody recognizes this.
and perhaps like an algae tank in an aquarium, the flaws are purposefully left in the ATMs to detract would be thieves from arming themselves and stealing money from banks "the old fashioned way".
US currency is backed ONLY by TRUST. trust in a government of the people. trust in OURSELVES.
when people like JockTroll make themselves known as a threat to that trust, i don't run. there is nothing to beware that a few bullets can't stop.
you are NOTHING.
and i assume you like to do your banking with your neighborhood tellers behind a wall of bulletproof glass or steel bars. i assume you think the lack of class in your banking experience is riddled with holes... JUST LIKE CHEESE! i mean, i can see a pile of $100 bills just sitting there in the tray in the drawer right behind the counter (i'm 6'4")... how stupid could they be? i could just jump over this desk, overpower the 22 year old woman, and probably make out with a couple grand. why would the banks allow this to happen? why am i not being strip searched before the bank allows me the privilege to speak face to face with the people who i've placed my trust in?
if the would-be exploit publisher wanted to help banks, they could... tell them about it in private. if they wanted to hurt banks, they could... execute the exploit. or are they scared of obviously getting caught and convicted for numerous felonies? if they want to publish their criminal theory, i'm pretty sure they can as long as the anarchist's cookbook is still legal to publish.
i'm only saying that it's a selfish and irresponsible endeavor.
"the flaws are purposefully left in the ATMs to detract would be thieves from arming themselves and stealing money from banks "the old fashioned way".
LOOOOOL! Congratulations, loserboy. You're eligible for the Most Gullible Idiot in the World Award! Either that, or you're a low-level employee of some ATM maker. Either way, my diarrhoea is your shampoo.
Trust your masters, loserboy. Give them all of your money. Do as they say, they know what's better for you. Right.
Geeks are so full of shit that "beating the crap out of them" takes a whole new meaning.
They could try to intimidate you and say stop and desist everybody, but I have to wonder, if by doing this they are not giving the illusion that ATMs are safe. I applauded the effort that one consultant did security wise about the flaw with microsoft, and then turning around and posting on youtube (or whatever) the flaw ....so that M$ could not hide behind their usual crap....they were forced to fix it right away and issue a patch, this tends to let me think the same with this situation, disclose the problem after 1 week of letting them know, and they will have to force a firmware upgrade to all outlets....that's what most people are forced to do with their machines, ... why not them???
do you know what "perhaps" means? kind of an important word to leave out of a quote.
Yeah, he likes posting off-topic, retarded shite on topics he knows nothing about. Don't take him seriously or anything...