Slashdot Mirror
Most ATMs Can Be Hacked in Under 20 Minutes (zdnet.com)
An extensive testing session carried out by bank security experts at Positive Technologies has revealed that most ATMs can be hacked in under 20 minutes, and even less, in certain types of attacks. From a report: Experts tested ATMs from NCR, Diebold Nixdorf, and GRGBanking, and detailed their findings in a 22-page report published this week. The attacks they tried are the typical types of exploits and tricks used by cyber-criminals seeking to obtain money from the ATM safe or to copy the details of users' bank cards (also known as skimming). Experts said that 85 percent of the ATMs they tested allowed an attacker access to the network. The research team did this by either unplugging and tapping into Ethernet cables, or by spoofing wireless connections or devices to which the ATM usually connected to. Researchers said that 27 percent of the tested ATMs were vulnerable to having their processing center communications spoofed, while 58 percent of tested ATMs had vulnerabilities in their network components or services that could be exploited to control the ATM remotely.
Pickup trucks appear to be the meth addicts tool of choice. (Google it)
I've abandoned my search for truth; now I'm just looking for some useful delusions.
Hmmm. I guess I never thought about it before, but who is liable for theft from an ATM? The bank? The company that built the ATM? The FDIC? The customer?
Anyone with sense limits the amount of money in their ATM / online banking accessible account to a small amount, like 15-20k, unless a large purchase is coming. This is a simple way to protect yourself.
The majority of people in the US don't even have enough liquid money to afford a $1000 emergency and you think 15-20k is a small amount?
The only thing necessary for evil to triumph is for it to be pitted against a slightly greater evil
Is that the same as even less than under 20 minutes?
Good thing they got rid of those banks with safes and armed guards.
Might take some real risks to rob a bank.
Diebold made voting machines.
Everyone else in that industry is just as bad. No threat models, at all. That's why I'm getting into the industry.
Support my political activism on Patreon.
Anyone with sense limits the amount of money in their ATM / online banking accessible account to a small amount, like 15-20k, unless a large purchase is coming. This is a simple way to protect yourself.
[British Accent]Quite right you are my man. Unless Foofy needs a new rolls I try to limit my personal cashier boy to a similar small fund which they may withdraw from these mechanical money boxes. Least the less trustworthy boys have been known to drain a persons account to the point that one must take a public jet to the Alps instead our families private whirly birds.[/British Accent]
These attacks seem to require you to be alone with the machine, while having access to its backside where the cables come out.
Yeah... veeery realistic. --.--
Try again with a vandalism-hardened ATM in a brick wall with cameras and security personnel looking at them. Then and only then do you get to write sensationalist headlines like this.
Why do you think the PIN only has 4 digits most of the time? Not because that's so hard to crack. It's only a token. The security is provided by what's around it.
(And yeah, they should still improve these things anyway, because it's always good to have multiple layers of security. Then again, if we'd think this though, we'd get rid of banks altogether, as they are untrustworthy thieves by their very definition. [Actually worse than thieves, as thieves usually don't make up money on the spot [$92 for every $8] and get the government to side *with* their imaginary money being real.])
What constitutes "hacking" these machines? Root access? Money shooting out? Transfer of funds from accountA to accountB?
Politics; n. : A religion whereby man is god.
These guys did it in 36 seconds. Granted, network hacks and elegant solutions need to be addressed. But what's the point if you cant keep a couple of guys with a pickup truck and a chain from driving off with it. It always reminds me of this xkcd.
Anyone with sense limits the amount of money in their ATM / online banking accessible account to a small amount, like 15-20k, unless a large purchase is coming. This is a simple way to protect yourself.
The majority of people in the US don't even have enough liquid money to afford a $1000 emergency and you think 15-20k is a small amount?
Gosh, I have foolishly been keeping a billion and a half dollars in my checking account connected to my ATM card... I should probably reduce that to 15 to 20 times the maximum amount I’ve ever HEARD of an ATM allowing someone to take out, (or more like about 40 times, for most ATMs I’ve ever used).
What I was going to suggest though, is that it’s okay for most ATMs to be hackable in under twenty minutes, as long as they alert the police when someone starts trying to hack them, and the time it takes for the police to arrive, and shoot the thief in the head averages, say... 10 minutes or less. As long as trying to steal from an ATM more often than not results in a dead thief, I’m not really sure how that’s a problem.
See, I’m normally pretty sympathetic to the poor, and someone who steals a loaf of bread to feed his starving family and has no other way, or someone who breaks some law by accident... but when you HACK into an ATM, that’s... yeah, I’m pretty sure you can’t, WOOPS, ACCIDENTALLY hack into an ATM, and if you’re stealing thousands or tens of thousands of dollars at a time, yeah-no.
You might even say you’re okay with theft from a bank or an ATM because banks, which own the ATMs, are rich. But that’s just the problem. You can’t steal from the rich. They find ways to turn around and make it so that when you try to steal from them, you really end up having stolen from their customers, most of whom are NOT rich. Same goes for petty theft from any place where I shop. You’re not stealing from MalWart, let’s say, you’re stealing from ME if I shop there, because to cover the loss, they have to raise prices... because they’ll be DAMNED before they cut profits or executive salaries. As for common worker salaries, they’ve already cut those to the bone. There’s no fat there left to cut. Hell, they’ve already half-way to done away with cashiers. I wonder how they’ll get us, the customers to stock their shelves for them.
I’m sure they’re working on it.
Thanks, found several videos of idiots ripping their back axel off. Was very funny.
I mean, are banks actually running across a regular problem where they go to refill an ATM machine and verify all the transactions, and discover somebody emptied out a few hundred or thousand bucks that they can't account for?
Seeing the attitude they seem to take with credit card fraud (just cancel the card, refund the fraudulent transactions and move on) ... I guess nothing would surprise me. But I have to think the number of folks with the expertise to pull these hacks off who ALSO would risk jail time to do them is really small, vs. the number of common criminals who try the brute force methods we see on the TV news all the time. (Attach tow hook to machine and try to yank it out of the wall with a big truck, etc.)
20 minutes to hack an ATM seems pretty crazy, right? Don't worry, I have a solution.
Let's start an ATM Thieves Guild. It's unacceptable that in today's busy world that it takes so long to commit crimes. We promise to make Moore's Law work for you, and get that time down to 10 minutes or less.
Every one of the methods involved opening/unlocking the physical casing! Obviously, being able to remove the HDD or insert a USB drive is going to make the hack a lot easier.
What are you talking about. Why would an ATM have wifi-anything and why would you have an ATM with an ethernet cable accessible in a timeframe that less than what it takes for cops to arrive?
Don't you have the colouring anti theft measures in the ATMs in the US?
The bank is on the hook for the money, and by extension the bank's insurance company. I work for a bank and am familiar with this issue. A bigger issue is online scamming where somebody gets the login info for a legitimate customer's account and then orders a transfer to Paypal or some other online service, and then walks away with that money. The FBI won't even bother investigating for a few thousand bucks. And the transfer recipients generally don't help out either because they're prohibited from giving out their customer info without a warrant.
You didn't read the article. They are literately talking about jackpotting the ATM's by telling the ATM's OS to dispense money at will, or intercepting data to the ATM network. The latter is likely easier to catch by the ATM network, but if someone jackpots an ATM nobody will know unless the ATM has been physically damaged in the process.
Here's a theoretical example. Someone installs the malware on the Windows XP ATM, Someone comes by and withdraws or deposits 20$, the crook then waits for them to go away and then tells the ATM to dispense $2000, and snatch it without the camera seeing them. So the person who just withdrew will look like they somehow withdrew $2020, and since there's no crook on camera, guess who gets accused of it?
But that's not the only theoretical example. There's also the possibility of using malware on the ATM to digitally skim the cards and then replay the transaction over and over again until the ATM is empty.
... here in Oz.
'Trust fund kids' are the ones that the parents know are too incompetent to handle money (e.g. Jerry Brown, CA governor).
If they had 150k, they'd spend it on hookers and blow. That's why the trust has to dribble out a monthly allowance.
Someone claiming 150k$ in a checking account, is either a moron or a troll, depending on if it's true or not.
Or someone who assumes that the stock market will crash quickly, which will force the Fed to lower interest rates again, which will mean almost all asset classes will lose value over the coming month.
which will force the Fed to lower interest rates again, which will mean almost all asset classes will lose value over the coming month
No.... the Fed has been doing the opposite of Quantitative Easing they were aggressively doing during Obama's administration: attempting to trim their balance sheet, in addition to the aggressive interest rate increases --- the reverse QE will mean they could lower interest rates to 0 and still potentially make a catastrophe;
But leaders in the Fed have been looking disdainfully at the high stock market prices for a while now, and planning on how to take those prices down to what they personally feel they should be --- also, even though the Fed is supposed to be politically independent - I suspect some are political and upset with how well the economy appear to be doing during a Trump presidency; since appearance is everything, there are people in the Fed who would like to try and quietly use fed influence to cut back on liquidity at an excessive rate to make the economy appear to be a disaster for the next 2 years or so, in the hopes their result by Fed tampering is they get a democrat into office next.
They are not done yet by far... and they intend to accelerate the rate of reverse QE over the course of the next couple of years until they eliminate the excess reserves (electronic fictional cash they created).
Reverse QE reduces the size of the base money supply and will be evaporating 1.5 Trillion of $$ in deposits/lendable money out of the banking system.
Regardless of what they do with interest rates; the Uncertain affects of the reverse QE likely stand to have a high chance of causing not merely some loss in value but to crash nearly ALL asset prices
including precious metals, and there will be some more bank insolvencies that may make 2008 or the last time the Fed tried something like this.... 1937.. look tame.
https://www.ptsecurity.com/ww-...
over here they all have die packs and cameras
How does the camera in the ATM - that takes photos of every person pushing ATM buttons - not see the culprit?
How does the camera filming the area the ATM/s are in not see someone at an ATM?
If you are invisible, there are easier and safer ways to get rich.
You don't know what a trust is. It has nothing to do with the assets, only putting an adult in charge of the assets so the 'Trust fund kid' can't blow it all.
Jerry Brown's parents knew him better than the voters of CA. Like most true morons, he has only gotten dumber with age.
John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'