Slashdot Mirror
ATM Vendors Threaten, Stop Research Presentation
An anonymous reader writes "A presentation about 'The Underground Economy,' by Italian white hat hacker and security expert Raoul Chiesa, was replaced at the last minute during last week's Hack In The Box conference. The reason behind this cancellation was that Chiesa received legal pressure from ATM vendors over the fact that the originally scheduled presentation covers details of various techniques and exploits of vulnerabilities that cyber criminals use to break into ATMs — flaws that have been known for a long time."
Hot grits and naked and petrified natalie portman. Why does this laptop only have a power cord? Where is ethernet if i'm on the internet?
No government nor corporation has a right to muzzle our mouths.
"I disapprove of what you say, but I will defend to the death your right to say it." - historian Evelyn Beatrice Hall
where are all the headlines pointing out how easily tumbler locks can be opened? security isn't about building the biggest wall.
presenting this information can only decrease the security and value of your savings. anyone that argues that the information needs to be public is probably broke.
The people who are using it to cause damages already know how this is done. The only dangerous part about something like this is that the public might be made aware of just how far from secure most financial transactions are.
Security through obscurity, we all know how well that works... *sigh
~men are from earth. women are from earth. deal with it.~
If researches aren't allowed to talk about those flaws, perhaps they'll just go away?
in the USA?? I would not recommend that at all. Just put it on the net from a secure location..
For justice, we must go to Don Corleone
in the USA?? I would not recommend that at all. Just put it on the net from a secure location..
Have the Chinese host it.
Dear China: Please host this to show the decadent capitalist pigs who are enslaved by the banks how their system is screwing them over.
RIP America
July 4, 1776 - September 11, 2001
Remember when Jeff Moss had his talk cancelled, or Kim Zetter? All it did was make people salivate to read thier presentation when they released it online at a later date. The last thing you want to do to this demographic is tell them the info is "too dangerous (see awesome) for them to hear. It will be everywhere with in the week.
sig loading.......
Its funny that they think, I'm assuming, that not letting someone speak about it is helping them in any way. The more people who know about vulnerabilities the safer we are because while there will be more people working to exploit it, there are also more people working to patch it.
Where has reason in the world gone? Have we abandoned it in favor of power and politics?
A large amount of criminals are rather dumb. That is often why they choose a life of crime. In particular, someone who is going to go around trying to hack ATMs is pretty dumb. You aren't going to get a whole lot of money out of them. If the hack is based around someone's particular account, you'll get a max of like $500 per day for an account, that is generally the highest you see withdrawal limits (if you need more you go in the bank). Even if you could get the ATM to empty itself, you'd get maybe $10,000-20,000. Ok well that is on a device that has a camera, and belongs to a financial institution. Banks have a lot of pull with law enforcement and a lot of reason to want to catch someone stealing from their ATMs.
So, doing this would be a dumb crime. Doing it once, the only real way you are going to have a chance not to get caught, doesn't net you enough to be worth it. Doing it on a recurring basis pretty much guarantees you get caught. It is just not a smart crime.
As such the sort of people who would do it are not the sort who are going to sit and carefully investigate ATM security, perhaps buy their own and test it. They are the kind of criminal who would do it if there's a how to guide. If someone gives them the directions, they'll say "Hey, easy money!" and do it.
Thus keeping it obscure really DOES work. This "Security through obscurity doesn't work," thing is a bogus statement that people online like to parrot. While it isn't the best kind of security, it doesn't mean it is worthless.
In the real, physical, world you have to accept that all security is imperfect. No matter what you do, someone can get by it. You can have an underground vault surrounded by trained armed guards, doesn't matter. All someone needs is an attack force large enough to get rid of your guards and sufficient time and tools to physically dismantle your protections. There is no magic, perfect, "Nobody can get past this." You can only aim for two things:
1) Having security good enough that nobody who would try to get through it could. Whatever level of threat you are likely to face, you have security that can stop that.
2) Having security that seems good enough that nobody will try. Make it intimidating to the point that nobody is going to even attempt to get around it.
Well, part of #2 is obscurity. You don't tell people everything you are doing. They don't know what all they have to get past. Their ability to try and draw up a plan is compromised by the fact that they do not know what all they have to deal with.
Take something like, say, the security of the CIA building. There's plenty of security you can see, they have their own, armed, police force, there are physical barriers and so on. However if you think that's all there is you are a fool. What else might there be? You don't know, and that makes it real hard to plan how to overcome.
This is the same as when anti-white racists put pressure on any forum that tries to have speakers speak about the facts of the genetic basis of racial differences in intelligence and more importantly morality and behavior.
No one tries to save free speech there! Even when it is the destruction of their race that is at stake!
Even though this is not the first time that ATM vendors prevented a security researcher to publicly disclose findings about flaws in their devices at a conference, this instance is really surprising, since Chiesa held this same presentation at a couple of security conferences already, and the slides he employed are also available online.
The thing is these slides are sanitized, the details of the ATM attack were removed.
Does anybody know where to find a non-sanitized version?
so EVERY bad guy, including would-be bad guys, already know this? do you know it? how about you post it as an anonymous response to this comment.... i mean, it's everywhere, right?
College-Pages.com - Online Colleges, Degrees, and Programs
Is that chip-and-pin is supposed to be "secure" so the liability for fraudulent transactions can be shifted back onto the consumer, or at the least, they are expected to somehow prove their innocence (that they didn't leak their pin somehow) which is generally impossible.
In the manner in which they are currently deployed, chip and pin cards are no more secure than regular non-chipped cards, but not everybody recognizes this.
They could try to intimidate you and say stop and desist everybody, but I have to wonder, if by doing this they are not giving the illusion that ATMs are safe. I applauded the effort that one consultant did security wise about the flaw with microsoft, and then turning around and posting on youtube (or whatever) the flaw ....so that M$ could not hide behind their usual crap....they were forced to fix it right away and issue a patch, this tends to let me think the same with this situation, disclose the problem after 1 week of letting them know, and they will have to force a firmware upgrade to all outlets....that's what most people are forced to do with their machines, ... why not them???