ATM Vendors Threaten, Stop Research Presentation

An anonymous reader writes "A presentation about 'The Underground Economy,' by Italian white hat hacker and security expert Raoul Chiesa, was replaced at the last minute during last week's Hack In The Box conference. The reason behind this cancellation was that Chiesa received legal pressure from ATM vendors over the fact that the originally scheduled presentation covers details of various techniques and exploits of vulnerabilities that cyber criminals use to break into ATMs — flaws that have been known for a long time."

Comments

Publish it on Piratebay instead

[commodore64_love]

No government nor corporation has a right to muzzle our mouths.

Re:Publish it on Piratebay instead

[countertrolling]

No government nor corporation has a right to muzzle our mouths.

No they don't, but they did and they do... And the public couldn't care less. If he put it on piratebay, he can still get in trouble. His name is all over it. Only anonymous disclosure can remedy this.

Re:Publish it on Piratebay instead

[Michael Kristopeit]

if the governments or corporations have the ability to convince people to muzzle themselves, and no one who depends on the protection of their savings will stand up to fight for the self-muzzled, then any "rights" are irrelevant.

Re:Publish it on Piratebay instead

[s0litaire]

What we really need is a "Wiki" we can "leak" things to...
what's it called again.... ermm Pirate-leaks, no Wiki-Bay
Nope can't remember the name...

Re:Publish it on Piratebay instead

[Yuan-Lung]

Why would he be in trouble? It's not illegal to speak or publish your thoughts.

Really?

I am thinking of a number.... it's between 13,256,278,887,989,457,651,018,865,901,401,704,639 and 13,256,278,887,989,457,651,018,865,901,401,704,641

This isn't dangerous in the way they claim

[nixNscratches]

The people who are using it to cause damages already know how this is done. The only dangerous part about something like this is that the public might be made aware of just how far from secure most financial transactions are.

Re:This isn't dangerous in the way they claim

[Moddington]

It may be pointless now, but there's always the possibility that they're using cards with both the old strip and the new chip as an intermediate step, to try to shift card owners over to using just the chip a little more softly. Of course, it could also just be another example of incompetence in security.

Re:This isn't dangerous in the way they claim

[abigsmurf]

You are completely wrong about what you think chip and pin is.

The magnetic strip on the card contains the exact same information as on regular cards.

The chip contains the pin, if the pin is guessed incorrectly 3 times, the card will lock itself. If a chip and pin terminal senses a pin, it will not authorise a transaction without the pin (which on correct entry will cause the card to send an encrypted 'pin verified' code to the bank).

The only way chip and pin cards have been compromised (outside of cards using outdated protocols in a lab envoironment) is standard card skimming. You copy the magnetic stripe and PIN from a compromised terminal to clone the card. This only works if you use the cloned card on a non-chip and pin terminal. To do this you need to leave the country as all terminals in the UK (and other chip and pin countries) are required to be chip and pin. Nothing like someone suddenly making a massive purchase 1000 miles away in a different country 30 minutes after making one in their home country to flag up a transaction with the bank.

Basically, the only practical vulnerability at the moment for chip and pin is a vulnerability for strip only cards. There's a reason there's been massive reductions in ATM fraud in chip and pin countries.

Re:you'd rather your bank was burgled?

[countertrolling]

you'd rather your bank was burgled?

No, I'd rather hold the bank responsible for any loss. They should have to replace the money. With that kind of incentive, they might actually try to make their systems a bit more secure. An important step in this direction would be to quit using cheap commodity systems in their networks.

Re:you'd rather your bank was burgled?

[schon]

presenting this information can only decrease the security and value of your savings.

You're an idiot.

As the article states, the information is already known by the bad guys. Keeping it secret helps the bad guys, and hurts everyone else. Making it public will encourage the banks to fix the vulnerabilities, which will increase the security and value of my savings.

anyone that argues that the information needs to be public is probably broke.

No, the people who argue that the information needs to be public actually understand the issue here.

Black hat confrence?

[countertrolling]

in the USA?? I would not recommend that at all. Just put it on the net from a secure location..

Re:you'd rather your bank was burgled?

[lgw]

Never argue with a man who cannot learn how to operate the "Shift" key.

Re:you'd rather your bank was burgled?

[Anonymous Coward]

Try watching "Corrupt Banking System" on Youtube...

You obviously don't know what the Fractional Reserve system is, nor that the banks now OWN all of us, since we can never produce enough goods or labour to pay off all the debts that the banks are allowed to print out of thin air...