Hacker shows off remote ATM exploit
Hacker shows off remote ATM exploit
Posted 3 hours 17 minutes ago
A computer hacker has demonstrated a technique to remotely make an ATM spit out cash using the internet.
New Zealand researcher Barnaby Jack publicly showed off the "ATM jackpotting" technique at the DefCon hackers conference in Las Vagas, in the United States.
Mr Jack proved his findings using two kinds of ATMs typically found in corner stores, bars or other "stand-alone" venues in the US, but said the flaw likely exists in machines at well-known banks.
"You don't have to go to the ATM at all," Mr Jack said.
"You can do it from the comfort of your own bedroom."
Mr Jack says banks use remote management software to monitor and control their ATMs.
He says he used a weakness in that software to take control of machines over the internet.
He says his method bypasses the need to submit passwords and serial numbers to access ATMs remotely.
Once in the machines, he says he can command them to spit out cash or transfer funds.
He says he could also capture account data from magnetic strips on credit or bank cards as well as passwords punched in by ATM users.
"When you think about ATM security you generally think about the hardware side; is it bolted down and are the cameras in position," Mr Jack said.
"This is the first time anyone has taken the approach of trying to attack the underlying software.
"It is time to find software defences rather than hardware defences."
Mr Jack did not reveal specifics of the attack to hackers at the conference, but did tell ATM makers about the flaw so they could bolster machine defences.
"I might get my butt in hot water if I released the code," he said.
"I was careful not to release the keys to the kingdom."
Mr Jack says he has grown wary of ATMs since discovering the remote exploit.
"I just keep my cash under the bed now," he said.
- AFP
http://abc.com.au/news/stories/2010/...section=justin
