Hackers Break Currency Validator To Pass Any Paper As Valid Euro

Trailrunner7 writes "If espionage is the world's second-oldest profession, counterfeiting may be in the running to be third on that list. People have been trying to forge currency for just about as long as currency has been circulating, and anti-counterfeiting methods have tried to keep pace with the state of the art. The anti-counterfeiting technology in use today of course relies on computers and software, and like all software, it has bugs, as researchers at IOActive discovered when they reverse-engineered the firmware in a popular Euro currency verifier and found that they could insert their own firmware and force the machine to verify any piece of paper as a valid Euro note. 'The impact is obvious. An attacker with temporary physical access to the device could install customized firmware and cause the device to accept counterfeit money. Taking into account the types of places where these devices are usually deployed (shops, mall, offices, etc.) this scenario is more than feasible.'"

Comments

Well duh

[PhilHibbs]

If you can physically access and modify a machine, you can change the way it behaves. Is this really news? Can they do it wirelessly? Over the internet?

Re:Well duh

[gstoddart]

f you can physically access and modify a machine, you can change the way it behaves. Is this really news?

This part of the article is what struck me:

After watching some videos from the vendor Inves on the machine's operations and reading through the machine's documentation, Santamarta came to the conclusions that some of the security claims the vendor makes were somewhat specious.

"Unfortunately, some of these claims are not completely true and others are simply false. It is possible to understand how Secureuro works; we can access the firmware and EEPROM without even needing hardware hacking. Also, there is no encryption system protecting the firmware"

So it sounds more like the company said "our stuff is secure, awesome, and hax0r proof", and someone essentially said "challenge accepted".

That he could do the initial reverse engineering without ever even having had the device (he downloaded just the free firmware) tells me that this device was pretty ripe for the picking.

Re:Firmware update? Unlikely.

[Qzukk]

"Hello, I'm from the maintenance department and I'm here to update your firmware to protect you from the exploit that was recently published on 2013-10-13."

Re:Firmware update? Unlikely.

[jandrese]

Unless this attack is a buffer overflow or something when you put in a particularly formatted note, I don't see the issue. "Oh, you can bypass the bill checker if you break the machine open, pull the ROM chips, and put in new ROM chips!"

According to TFA, the guy went and analyzed the firmware to discover how it worked, and then noted that you could bypass the check routines in it to always set the "good" pins high. About the only thing even mildly worrying is that there is apparently no crypto lock on the firmware, but a crypto lock on the firmware would be useless if you have physical access to the machine anyway, only slightly complicating the job of redesigning the internals, so that's not saying much. There's a reason these machines are secured with a lock and a sturdy metal case.

Counterfeiting ?

[mbone]

If it accepts _any_ piece of paper, I don't see how that is counterfeiting - theft and fraud, sure, but if I make no effort to copy something, how is that still counterfeiting?

Re:Second-oldest profession FTFY

[Chemisor]

You are absolutely right. Here are the top ten similarities between politics and programming:

• Design is always better than the implementation.
• Our number generators are random. Really.
• Polling is a lousy way to gather information.
• Codes always have bugs and loopholes. When they are found, lawyers are often involved.
• Old codes never die and never fade away.
• After failure, always blame the third party.
• Paying for support is expensive.
• DRM and vendor lock-in are the best means of increasing sales.
• Never listen to your your customers when they say they want fewer features. They must be lying.
• Power corrupts. That's why we have checksums and balancing.

Re:Firmware update? Unlikely.

[sootman]

> Which is a vulnerability of your employees
> allowing access to some stranger...

I work in an office with over 500 employees. Do you think I know everyone who works in security, telecom, and I.T.?

Re:Firmware update? Unlikely.

[Wycliffe]

And how did that work out for him?

Don't be so smug. Crimes like these have a reverse survivorship bias. You usually
only hear about the ones that get caught or at least leave evidence behind.