Slashdot Mirror
Kids With Operators Manual Alert Bank Officials: "We Hacked Your ATM"
An anonymous reader writes "Two 14-year-olds hacked a Bank of Montreal ATM after finding an operators manual online that showed how to gain administrative control. Matthew Hewlett and Caleb Turon alerted bank employees after testing the instructions on an ATM at a nearby supermarket. At first the employees thought the boys had the PIN numbers of customers. 'I said: "No, no, no. We hacked your ATM. We got into the operator mode,"' Hewlett was quoted as saying. Then, the bank employees asked for proof. 'So we both went back to the ATM and I got into the operator mode again,' Hewlett said. 'Then I started printing off documentations like how much money is currently in the machine, how many withdrawals have happened that day, how much it's made off surcharges. Then I found a way to change the surcharge amount, so I changed the surcharge amount to one cent.'"
I'm not even mildly surprised that this was possible.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
So....
they had the manual with passwords....
this is hacked.... how?
Here lately, seems their day at school would have been moot as they are led to a waiting black SUV. Then, SWAT would move into their house and take everything that plugs into a wall and has Ethernet capabilities. Think I'm joking?
It's "hacked", because they did something that (in theory) only administrators are supposed to be able to do. That's really all the definition anyone needs.
Similarly, if an admin leaves the root passwords as "admin:admin", and someone logs in, that someone has hacked the system.
In other news, domestic terrorist ringleaders Matthew Hewlett and Caleb Turon were arrested today in what Department of Homeland Security spokesman Peter Atriot called "a blow for freedom against Jihadists". The two men are believed to diverted funds vital to global banking, thereby aiding and assisting worldwide terror organisations.
Reading a manual and following step by step instructions which tell you how to get into operator mode is NOT HACKING.. UGH.
This is Canada. As long as they don't try to link good science to administrative policy, the government probably won't care.
Back before the internet, it was common practice to put hard-coded admin passwords in documentation, in case anyone should forget the real password. In some industries (say, construction road signs) it just never occurred to them that anyone would ever care to look it up for a prank. In other industries, like ATMs, the assumption was that documentation was obscure and difficult to lay hands on without writing to a real person who then had to mail a manual to a real address of an existing customer.
The fact that they still do this is depressing, but doesn't surprise me in the least.
When does incompetence become criminal neglect?
For example, if they find bleach AND draino under the sink, you're also charged with "Chemical Weapons Possession" if they find candles and matches and charcoal, you have "bomb making materials". The spooks can get you for anything.
If telephones are outlawed, then only outlaws will have telephones.
Years ago, when ATMs were first becoming available, someone I know worked as a security exec for a large bank. Seems back then, each ATM came with a demo disk hat, when inserted into a floppy disk port inside the ATM's housing (but, easily accessed) placed the machine into demo mode and allowed the operator full control of the device. The sales operator could then fully demonstrate ALL the features of the ATM - including the automatic dispensing of cash.
With furled eyebrows, he asked whatever became of all the demo disks after the ATM was installed..nobody knew...just assumed they were thrown out. He asked if they considered this a problem. And, he was told 'No'. At the time, stealing the ATM was all the rage and his concerns were discounted...until one day when money just started disappearing from ATMs. Seems, somebody else found or had one of those disks and realized what they had.
Pretty scary these kids could find a manual online and that the command sequence to place it into admin mode could be done from the user console vs a separate terminal. One has to wonder if they could have dispensed cash like a Pez dispensor like was possible with the old demo disks.
NO, it is not worthless. It is a layer of security, and a valid one.
Any single layer security process is foolish.
Risk, costs, effort these are all factor that need to be mitigated.
The Kruger Dunning explains most post on
they were inquisitive, did some research, and experimented on a system, and succeeded in gaining unauthorized access. they then responsibly reported their findings to the device owner.
what these kids did, while perhaps not quite on par with hacking the gibson, still very much represents the (white hat) hacker ethos at work.
you, on the other hand, represent the asshat ethos, for downplaying what they did and trying to fiddle fart around with semantics.
From this to Highway Sign Hacking to that researcher that made a botnet of home routers with default config to ping the whole of ipv4, I really hope admins are getting the point that you can't just drop appliances in public places without adjusting the default configuration. What critical infrastructure is left out there just begging for someone with an operator's manual to wreck it, or even worse, exploit it? Can we get a wake-up call to the administrators of these appliances?
They had permission from an employee. Whether the employee had the authority to grant that permission is another issue altogether, but they were acting with the bank's permission.
When Verizon FiOS first came to my area, the autogenerated WEP password was based on a 5 character SSID. There were online tools that you could use to lookup what the default password would be and almost no one, relatively speaking, bothered to change it from the default. Came in handy on more than a few occasions to get free wifi as just about anywhere you go you were in range of someone that had FiOS.
Another brand used the wireless MAC as the WEP key. shm
If security through obscurity was worthless the military would be wearing fluorescent orange uniforms.
security through obscurity = camouflage
First, dozens of people shouldn't have administrative access to a particular ATM at once. Where I work, most systems have one or two people with passwords. If both people get hit by a bus, you can boot from a USB stick and proceed from there, but only two people have admin accounts.
Regarding the logistics of controlling who has access to what, every organization with more than a very few employees needs to manage who has access to what, and that's been true for thousands of years. It's very much a solved problem. Most companys use Active Directory for this purpose. Since ATMs already have card readers, an obvious answer for routine maintenance is to have the employee swipe their employee ID card. The ATM then uses its existing network connection to authorize access via AD. Back in the days of Benjamin Franklin, the solution was a key rack held by a designated employee. Other remployees would check out the keys they needed to use that day. It's kind of an interesting problem, but one that has been solved since roughly the Roman empire or so.
Kids?! More like cybercriminal financial terrorists! Time for a no-knock SWAT raid! Flashbangs, go go go and shoot the dog, too!
We don't have a state-run media we have a media-run state.
Specifically, there are tenses that apply to counterfactual but hypothetical cases. For instance, if you're trying to say that in the USA someone would be subject to thus and so, one might say "in the USA, they WOULD BE charged".
Or one might add as a prequel to your statement that standard word for hypothetical but counterfactual "if"...Nevermind. I forgot this was /., where literacy is never an expectation of the technically inclined.....
"I do not agree with what you say, but I will defend to the death your right to say it"
Seems like an echo of Richard Feynman's famous "I can open your safe" hobby at Los Alamos. Same method: guessing at obvious combinations like birthdates, in the 50% of cases where the lock wasn't still on the factory combination.
Honestly, I don't think even a wake-up call would do anything. Prime example from my life:
I went to a community college for a few years to get gen-eds out of the way cheap before going to a real college. In one of the buildings, there was a break room that was really popular with students despite not really being anything special - some tables and chairs, and that was about it. I had no idea why it was so popular when there were other break rooms on campus that had TVs and better Wi-Fi access and the like.
A few days in, I found out why. There was an older soda machine in the back of the room, and every so often I'd buy one. Almost every time, I'd wind up getting two (or sometimes three) sodas when I paid for one. At first I thought I was just really lucky, but then I found out that the machine was badly secured. There was a default button combination you could press that would take the machine into admin mode, where you could do things like get it to dispense free drinks. Doing this would cause a bottle to be loaded into position as if someone had paid for it, so the next person to buy a drink would get two.
Apparently, this was a well-known 'secret' on campus. Even the professors did it. I can't tell you how much money the vending machine owner probably lost, and I'm sure they knew that something was up based on how quickly the stuff was disappearing and how the money didn't add up. This was about seven years ago.
I went back to the same school to sign up for some classes just a month ago. On my way back, I stopped at that break room, and sure enough, that machine still hasn't had the password changed.
We're talking Canada. Password was probably "hockey".
When there's an ATM fraud in a customer's account, the customer is accounted responsible for his own account.
I've got better things to do tonight than die.
I worked on a device that acted as a security gateway within major ISP networks. We read material/took courses/interviewed the various security best practices, guidelines and design suggestions gurus before coming up with the general architecture. We had one-time-use passwords, 2-factor auth, admin mode pw reset that required special hw dongles etc.
The ISPs liked it initially, but their admins kept perma-locking the console, because they'd failed to enter the creds enough times. That forced the key-holder to fetch the dongle to reset the pw. It turned out, the "admins" were often high school dropouts who'd taken some remedial IT courses. Their qualifications were primarily that they'd do shift work for minimum wage, not any particular skill. As such, following printed, step-by-step instructions that required they enter the 2-factor random pw was *far* too complicated. They'd mix the pw order (secure card digits first vs. adminpass), screw up the capitalization etc etc. All the key-holder interventions st them too much downtime and paid overtime
In the end, we ended up implementing the industry standard, 6-8 character alphanumeric + !@#...) fixed string password. No 2-factor, no admin lockout with a default password that could be reset by holding certain keys down during startup. All the cutting edge stuff was tossed, because the freakin' ISPs' admins were smeg heads.
Argh!
C'mon. Even the Canadians know to use h0ckey.
then nancy grace would run a story about how al'qaeda has started recruiting sleeper agents out of the local grade schools.
we must clamp down on our schools, your kid might be a terrorist and you wouldn't even know.. until it's too late.
1. LEO have a case "quota" to meet.
2. Government attorneys who are thinking of running for an elected political office, want to appear to be "tough on crime" (which is apparently want most voters want, unfortunately.)
3. The top 1% wants to suppress any tiny indication of an uprising. An citizenry that is armed with biological, chemical or nuclear capabilities threatens the existence of the elite class.
New Economic Perspectives
Sure, the warning should really be against "Security only though obscurity." But that doesn't scan. Or something.
Then again, there are times when obscurity will hinder your security. I.e. it's a better trade-off to publish your new crypto algorithm to try and attract the experts to tell you where you got it wrong, rather than relying on your own expertise. Unless you'er a government signals intelligence organisation you probably don't have it.
Also. Keeping a well defined secret, is not "obscurity". So having a crypto key, or (in this case) a password, is not a problem per se. That's not "obscurity" as such. Thinking that having it printed in a manual that "the wrong people won't ever get to look at" without making sure of that is putting too much trust in "obscurity" though.
Stefan Axelsson
The owner of the machine was probably a genius. The markup on soda is so astronomical that he could probably sell 7 or 8 each time and still come out ahead. He was just shrewdly undercutting his competition on campus.
8B T/yr, times $2.22/T.
I think a problem with a potential downside of $17,760,000,000 is, well, a problem.
I come here for the love
The day I knew this was inevitable was the day I saw "Made in China" written in Spanish on something from a US company. (Yeah - I could have looked up "Made in China" and put it on here in Spanish, but I don't really care.)
"Newspapers: A tiny little part of the internet, printed out yesterday, and delivered to your house"
Well it has been done before and this seems like something that would be accessible when in operator mode.
Time to offend someone
By which I mean sanctioned kidnapping. I know; you were picturing 200 lumberjacks drunk on maple whiskey, performing a line dance while singing 'O Canada'.
I do not block ads. I do block third party scripts.