Slashdot Mirror
ATM Vendors Threaten, Stop Research Presentation
An anonymous reader writes "A presentation about 'The Underground Economy,' by Italian white hat hacker and security expert Raoul Chiesa, was replaced at the last minute during last week's Hack In The Box conference. The reason behind this cancellation was that Chiesa received legal pressure from ATM vendors over the fact that the originally scheduled presentation covers details of various techniques and exploits of vulnerabilities that cyber criminals use to break into ATMs — flaws that have been known for a long time."
No government nor corporation has a right to muzzle our mouths.
"I disapprove of what you say, but I will defend to the death your right to say it." - historian Evelyn Beatrice Hall
The people who are using it to cause damages already know how this is done. The only dangerous part about something like this is that the public might be made aware of just how far from secure most financial transactions are.
you'd rather your bank was burgled?
No, I'd rather hold the bank responsible for any loss. They should have to replace the money. With that kind of incentive, they might actually try to make their systems a bit more secure. An important step in this direction would be to quit using cheap commodity systems in their networks.
For justice, we must go to Don Corleone
presenting this information can only decrease the security and value of your savings.
You're an idiot.
As the article states, the information is already known by the bad guys. Keeping it secret helps the bad guys, and hurts everyone else. Making it public will encourage the banks to fix the vulnerabilities, which will increase the security and value of my savings.
anyone that argues that the information needs to be public is probably broke.
No, the people who argue that the information needs to be public actually understand the issue here.
Security through obscurity, we all know how well that works... *sigh
~men are from earth. women are from earth. deal with it.~
in the USA?? I would not recommend that at all. Just put it on the net from a secure location..
For justice, we must go to Don Corleone
While I'm not sure if they are legally responsible, I would have to say that they do bear the cost. I have had my bank card duped twice in the last 4 years, and both times the bank fixed the problem before I even realized the money was gone. I'm not sure which banks you deal with, but of all the times I have had this happen to me, or any body I personally know, the bank has put the money back in the account very quickly. Granted it would be better if it didn't happen in the first place. However, depending on how severely the system is flawed, it may not be possible to fix the problem at all, without changing out all the current machines, and settling on a new standard, which may again have its own list of faults.
Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
Remember when Jeff Moss had his talk cancelled, or Kim Zetter? All it did was make people salivate to read thier presentation when they released it online at a later date. The last thing you want to do to this demographic is tell them the info is "too dangerous (see awesome) for them to hear. It will be everywhere with in the week.
sig loading.......
It seems to me that the people who understand the issue here the most have been intimidated into inaction by people who might or might not understand the issue but understand that revealing any flaws in their methods would mean less profit for them, and that's all they care about.
There are two kinds of fool One says 'This is old therefore good' Another says 'This is new therefore better'- Dean Ing
Any devaluation that may be happening with the dollar is irrelevant to this discussion. Chewbacca would have been more relevant to the discussion.
The banks will do what they always do: pass any costs plus a hefty markup to the consumer. The banks make more money on fees and penalties than they ever did as honest bankers. Like they do now. $3.00 ATM fees?!? The transaction is pretty much free to them. Sure , they have a lot of bogus "costs" they say they incur, but the fact of the matter is ATM fees are extremely profitable gravy that are only beat in profitability by the fees that cell phone carriers charge for text messages.
RIP America
July 4, 1776 - September 11, 2001
Its funny that they think, I'm assuming, that not letting someone speak about it is helping them in any way. The more people who know about vulnerabilities the safer we are because while there will be more people working to exploit it, there are also more people working to patch it.
Where has reason in the world gone? Have we abandoned it in favor of power and politics?
where are all the headlines pointing out how easily tumbler locks can be opened?
This isn't a headline of how easy it is to bypass ATM security, per se (as what you're implying), this is if, for example, Schlage or Master tries to tell a locksmith that he cannot give a presentation on some of the vulnerabilities of a padlock. There are ALREADY dozens of books out there for sale in major bookstores and Amazon.com detailing how to pick locks -- describing techniques and tools (and some books tell you where to obtain these tools). The lock-making companies have responded not by attempting to curtail the freedom to publish this information, but to make the locks stronger and more difficult to bypass.
security isn't about building the biggest wall.
Security through obscurity -- which is what the banks are essentially desiring in this case -- isn't all that effective either.
presenting this information can only decrease the security and value of your savings.
No, the bank itself not spending its "hard earned" profits on increasing already known and presented security issues decreases the security and value of your savings.
"A government is a body of people usually -- notably -- ungoverned." -Shepherd Book
Have the Chinese host it.
Dear China: Please host this to show the decadent capitalist pigs who are enslaved by the banks how their system is screwing them over.
Uh yah, please do. China doesn't have banks, laws, or lack of freedom of speech after all. Go for it dude.
Says the moron that thinks ignoring the problem is as good as fixing it.
Maybe the people who are trying to stop the information from going public are some of the same people who are exploiting the flaws. The more public the flaws, and the more people exploiting it, the more likely it is that the flaw will be fixed. If you were making lots of money from an existing flaw, wouldn't you want that flaw to remain open?
Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
so EVERY bad guy, including would-be bad guys, already know this? do you know it? how about you post it as an anonymous response to this comment.... i mean, it's everywhere, right?
Actually, probably everybody on this conference knows about this already.
Also it's not like he gives a step by step presentation on how to get cash out of an ATM.
How do I uncompress my MD5 archive?
What decade are you living in? Banks don't bear costs, taxpayers do in the form of bailouts. If the government is just going to print money to give to the banks, why not instead go with a simpler system where a fraudulent ATM withdraw is simply not recorded as a debit to any account? Same inflation either way ...
Socialism: a lie told by totalitarians and believed by fools.
Never argue with a man who cannot learn how to operate the "Shift" key.
Socialism: a lie told by totalitarians and believed by fools.
Try watching "Corrupt Banking System" on Youtube...
You obviously don't know what the Fractional Reserve system is, nor that the banks now OWN all of us, since we can never produce enough goods or labour to pay off all the debts that the banks are allowed to print out of thin air...
A large amount of criminals are rather dumb. That is often why they choose a life of crime. In particular, someone who is going to go around trying to hack ATMs is pretty dumb. You aren't going to get a whole lot of money out of them. If the hack is based around someone's particular account, you'll get a max of like $500 per day for an account, that is generally the highest you see withdrawal limits (if you need more you go in the bank). Even if you could get the ATM to empty itself, you'd get maybe $10,000-20,000. Ok well that is on a device that has a camera, and belongs to a financial institution. Banks have a lot of pull with law enforcement and a lot of reason to want to catch someone stealing from their ATMs.
So, doing this would be a dumb crime. Doing it once, the only real way you are going to have a chance not to get caught, doesn't net you enough to be worth it. Doing it on a recurring basis pretty much guarantees you get caught. It is just not a smart crime.
As such the sort of people who would do it are not the sort who are going to sit and carefully investigate ATM security, perhaps buy their own and test it. They are the kind of criminal who would do it if there's a how to guide. If someone gives them the directions, they'll say "Hey, easy money!" and do it.
Thus keeping it obscure really DOES work. This "Security through obscurity doesn't work," thing is a bogus statement that people online like to parrot. While it isn't the best kind of security, it doesn't mean it is worthless.
In the real, physical, world you have to accept that all security is imperfect. No matter what you do, someone can get by it. You can have an underground vault surrounded by trained armed guards, doesn't matter. All someone needs is an attack force large enough to get rid of your guards and sufficient time and tools to physically dismantle your protections. There is no magic, perfect, "Nobody can get past this." You can only aim for two things:
1) Having security good enough that nobody who would try to get through it could. Whatever level of threat you are likely to face, you have security that can stop that.
2) Having security that seems good enough that nobody will try. Make it intimidating to the point that nobody is going to even attempt to get around it.
Well, part of #2 is obscurity. You don't tell people everything you are doing. They don't know what all they have to get past. Their ability to try and draw up a plan is compromised by the fact that they do not know what all they have to deal with.
Take something like, say, the security of the CIA building. There's plenty of security you can see, they have their own, armed, police force, there are physical barriers and so on. However if you think that's all there is you are a fool. What else might there be? You don't know, and that makes it real hard to plan how to overcome.
Publication, or the threat thereof is the only way that this problem will get addressed. According to this researcher, these exploits are being used by criminals right now. Its the ATM companies that want this covered up, so that they can present their machines as "totally secure", when in fact they're riddled with more holes than Swiss cheese.
In fact, publication would help the banks, as they would be able to test ATMs to see which ones were vulnerable. This would allow them to hold the ATM vendors accountable, rather than just having to accept a certain level of "loss" from ATMs.
We all know what to do, but we don't know how to get re-elected once we have done it
There is such a tendency on /. to think in black and white.
It's already known by some bad guys. How widely known is another matter altogether - are they discussing it openly on web forums? Discussing it openly on web forums which require registration and somebody who's already on the forum to vouch for you before they'll let you view anything? Discussing it on Usenet? Discussing it under blankets in a locked room after dark?
How widely is it being exploited in the wild? How much is being lost every year through this sort of fraud? How much would it cost to fix?
Even though this is not the first time that ATM vendors prevented a security researcher to publicly disclose findings about flaws in their devices at a conference, this instance is really surprising, since Chiesa held this same presentation at a couple of security conferences already, and the slides he employed are also available online.
The thing is these slides are sanitized, the details of the ATM attack were removed.
Does anybody know where to find a non-sanitized version?
LOL. No information is "criminal" or "non-criminal". Information is just information and it's good for people to know just how secure the machines they rely on to handle their cash is. Those ATM vendors were just scared that people could know how insecure their hardware and software was, and that they would have to spend money (SHOCK! HORROR!) to address the issue. Better to silence those dangerous "citizens", in the interest of corporate buggery.
Run, coward, run. I live. I hunger. Beware.
Geeks are so full of shit that "beating the crap out of them" takes a whole new meaning.
"the flaws are purposefully left in the ATMs to detract would be thieves from arming themselves and stealing money from banks "the old fashioned way".
LOOOOOL! Congratulations, loserboy. You're eligible for the Most Gullible Idiot in the World Award! Either that, or you're a low-level employee of some ATM maker. Either way, my diarrhoea is your shampoo.
Trust your masters, loserboy. Give them all of your money. Do as they say, they know what's better for you. Right.
Geeks are so full of shit that "beating the crap out of them" takes a whole new meaning.
They could try to intimidate you and say stop and desist everybody, but I have to wonder, if by doing this they are not giving the illusion that ATMs are safe. I applauded the effort that one consultant did security wise about the flaw with microsoft, and then turning around and posting on youtube (or whatever) the flaw ....so that M$ could not hide behind their usual crap....they were forced to fix it right away and issue a patch, this tends to let me think the same with this situation, disclose the problem after 1 week of letting them know, and they will have to force a firmware upgrade to all outlets....that's what most people are forced to do with their machines, ... why not them???