Kids With Operators Manual Alert Bank Officials: "We Hacked Your ATM"

← Back to Stories (view on slashdot.org)

Kids With Operators Manual Alert Bank Officials: "We Hacked Your ATM"

Posted by samzenpus on Monday June 9, 2014 @07:45AM from the protect-ya-neck dept.

An anonymous reader writes "Two 14-year-olds hacked a Bank of Montreal ATM after finding an operators manual online that showed how to gain administrative control. Matthew Hewlett and Caleb Turon alerted bank employees after testing the instructions on an ATM at a nearby supermarket. At first the employees thought the boys had the PIN numbers of customers. 'I said: "No, no, no. We hacked your ATM. We got into the operator mode,"' Hewlett was quoted as saying. Then, the bank employees asked for proof. 'So we both went back to the ATM and I got into the operator mode again,' Hewlett said. 'Then I started printing off documentations like how much money is currently in the machine, how many withdrawals have happened that day, how much it's made off surcharges. Then I found a way to change the surcharge amount, so I changed the surcharge amount to one cent.'"

17 of 378 comments (clear)

Min score:

Reason:

Sort:

Not surprising. by Z00L00K · 2014-06-09 07:48 · Score: 5, Insightful

I'm not even mildly surprised that this was possible.

--
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
1. Re:Not surprising. by NotDrWho · 2014-06-09 08:30 · Score: 5, Funny
  
  Okay, a lifetime of prison with the signs also in French.
  
  --
  SJW's don't eliminate discrimination. They just expropriate it for themselves.
2. Re: Not surprising. by Pieroxy · 2014-06-09 08:32 · Score: 5, Funny
  
  I'm actually surprised they're not yet in jail...
  
  --
  Write boring code, not shiny code!
3. Re: Not surprising. by Anonymous Coward · 2014-06-09 08:42 · Score: 5, Informative
  
  If the ATM is anything like what was at the various gas stations I worked at, they wouldn't be able to make any withdrawals. Yes we could get into Admin mode with just a code that was punched into the keypad. There was an option to test the bill dispenser, but the bill that got pulled from the cartridge during the test never left the inside of the safe, it just got dropped into another compartment inside the safe for us to pull out later when we changed the cartridge. I would imagine that hackers would have to gain access to the computer inside the ATM to be able to get it to spit out bills to be grabbed, but hacking being what it is, I'm sure someone will figure out how to do it from just the outside keypad eventually.
4. Re: Not surprising. by StrangeBrew · 2014-06-09 09:11 · Score: 5, Funny
  
  Jail would only have been a concern if they weren't in Quebec and changed the default language to english, as part of their 'proof'.
5. Re: Not surprising. by Lumpy · 2014-06-09 11:01 · Score: 5, Insightful
  
  If this was in the USA, the kids would have been shot several times by cops and the bodies taken to Gitmo for waterboarding.
  Kids in the USA, DO NOT try and be a white hat unless you can do it untraceable and anonymously. You will be severely punished for doing something good here.
  
  --
  Do not look at laser with remaining good eye.
6. Re: Not surprising. by Ingenium13 · 2014-06-09 11:17 · Score: 5, Informative
  
  There was a post on here several years ago about this same issue on Tritan and Tranax ATMs where the operators never changed the default passwords. What they would do is change the denomination that's in the drawer, so the ATM thinks it has $1 bills instead of $20 bills. They would then use a prepaid credit/debit card (like the Greendot ones you can get pretty much anywhere) to withdraw say $200. Rather than giving 10 $20 bills like it's supposed to, the machine would spit out 200 $20 bills.
7. Re: Not surprising. by Bitbyte_x · 2014-06-09 12:38 · Score: 5, Insightful
  
  Wouldn't go about using the media's term "hacking" the kids followed the operating manual the bank was just silly in not restricting their end devices properly It would be hacking if they ran some kind of exploit and found a zero day but they didn't they just followed easy to obtain documents
8. Re: Not surprising. by zeugma-amp · 2014-06-09 16:11 · Score: 5, Insightful
  
  Kids in the USA, DO NOT try and be a white hat unless you can do it untraceable and anonymously. You will be severely punished for doing something good here.
  Damn. I had mod points yesterday. This is absolutely true, and I would hope that everyone understand that by now. Sadly, many don't see the police state until it's boot is stomping them.
  
  --
  This is an ex-parrot!
In other news... by Anonymous Coward · 2014-06-09 07:53 · Score: 5, Funny

In other news, domestic terrorist ringleaders Matthew Hewlett and Caleb Turon were arrested today in what Department of Homeland Security spokesman Peter Atriot called "a blow for freedom against Jihadists". The two men are believed to diverted funds vital to global banking, thereby aiding and assisting worldwide terror organisations.
Re:In the US they'd have been charged by Anonymous Coward · 2014-06-09 07:54 · Score: 5, Insightful

They also probably would have shot any of their pets on the way in. Dude isn't joking; this place is a fucking terror state and does this to people every day.
Relax, folks. by Anonymous Coward · 2014-06-09 07:54 · Score: 5, Insightful

This is Canada. As long as they don't try to link good science to administrative policy, the government probably won't care.
Demo Disks by Ronin+Developer · 2014-06-09 08:03 · Score: 5, Interesting

Years ago, when ATMs were first becoming available, someone I know worked as a security exec for a large bank. Seems back then, each ATM came with a demo disk hat, when inserted into a floppy disk port inside the ATM's housing (but, easily accessed) placed the machine into demo mode and allowed the operator full control of the device. The sales operator could then fully demonstrate ALL the features of the ATM - including the automatic dispensing of cash.
With furled eyebrows, he asked whatever became of all the demo disks after the ATM was installed..nobody knew...just assumed they were thrown out. He asked if they considered this a problem. And, he was told 'No'. At the time, stealing the ATM was all the rage and his concerns were discounted...until one day when money just started disappearing from ATMs. Seems, somebody else found or had one of those disks and realized what they had.
Pretty scary these kids could find a manual online and that the command sequence to place it into admin mode could be done from the user console vs a separate terminal. One has to wonder if they could have dispensed cash like a Pez dispensor like was possible with the old demo disks.
Re:Kids these days. by Ionized · 2014-06-09 08:09 · Score: 5, Insightful

they were inquisitive, did some research, and experimented on a system, and succeeded in gaining unauthorized access. they then responsibly reported their findings to the device owner.
what these kids did, while perhaps not quite on par with hacking the gibson, still very much represents the (white hat) hacker ethos at work.
you, on the other hand, represent the asshat ethos, for downplaying what they did and trying to fiddle fart around with semantics.
Re:Too dangerous to keep digitally now? by cdrudge · 2014-06-09 08:13 · Score: 5, Interesting

though nowadays routers come with individualized passwords, but they didn't used to
When Verizon FiOS first came to my area, the autogenerated WEP password was based on a 5 character SSID. There were online tools that you could use to lookup what the default password would be and almost no one, relatively speaking, bothered to change it from the default. Came in handy on more than a few occasions to get free wifi as just about anywhere you go you were in range of someone that had FiOS.
Another brand used the wireless MAC as the WEP key. shm
Re:Hacked? by Yakasha · 2014-06-09 08:16 · Score: 5, Funny

So.... they had the manual with passwords....
this is hacked.... how?
Same way I hacked my VCR so it doesn't flash 12:00 anymore!
Re:Hacked? by Yakasha · 2014-06-09 08:17 · Score: 5, Insightful

True, it's a "hack" but it's a pretty trivial hack.
They are the ultimate script kiddies. Kids, using a script published by the manufacturer.
Even putting "trivial" in front diminishes the glory of hacking.