Thread Rating:
  • 0 Vote(s) - 0 Average
  • 1
  • 2
  • 3
  • 4
  • 5
Windows CE-based ATM's can easily be made to dole out $, security researcher says
08-03-2010, 05:49 PM,
Windows CE-based ATM's can easily be made to dole out $, security researcher says

ATM hack gives cash on demand
Windows CE-based machines can easily be made to dole out cash, a security researcher says
By Robert McMillan, IDG News Service
July 28, 2010 06:42 PM ET
Sponsored by:

Barnaby Jack hit the jackpot at Black Hat on Wednesday. Twice.

Don't Miss: Our quiz on Black Hat's most notorious incidents

Exploiting bugs in two different ATM machines, the researcher from IOActive was able to get them to spit out money on demand and record sensitive data from the cards of people who used them.

He showed the attacks on two systems he had purchased himself -- the type of generic ATM machines typically found in bars and convenience stores. Criminals have been hitting this type of machine for years, using ATM skimmers to record card data and PIN numbers, or in some cases simply pulling up a truck and hauling the machines away.

Patches have already been developed for the systems, built by ATM-makers Triton and and Tranax, Jack said. Triton patched the issue in November 2009, said Bob Douglas, Triton's vice president of engineering.

Douglas showed up at Black Hat to attend the talk and a subsequent press conference. Tranax could not immediately be reached for comment.

Tranax has had security problems before. In 2006, CNN reported that a Virginia Beach, Virginia, criminal used a keypad code to reprogram a Tranax machine into thinking it was dispensing $5 bills. Then, using an anonymous prepaid debit card, he withdrew $20 bills, but was only debited for one-quarter of the money he took. A manual showing how to do this, was reportedly available on the web.

But according to Jack there's an easier, much more alarming way to get the money out. Criminals can connect to the machines by dialing them up -- Jack believes a large number of them have remote management tools that can be accessed over a telephone -- and then launching an attack.

After experimenting with his own machines, Jack developed a way of bypassing the remote authentication system and installing a homemade rootkit, named Scrooge, that lets him override the machine's firmware. He also developed an online management tool, called Dillinger, that can keep track of compromised machines and store data stolen from people who use them.

Criminals could find vulnerable ATMs by using open-source "war-dialling" software to call hundreds of thousands of numbers, looking for those that respond by saying they have the vulnerable management software installed. Criminals have already used a similar technique over the Internet to break into vulnerable point-of-sale systems.

Jack's tools are just proof-of-concept software, designed to show how vulnerable the machines really are, he said. "The goal of the talk is to spark discussion on the best ways to remediate," he said.

"It's time to give these devices an overhaul," Jack said. "Companies who manufacture the devices aren't Microsoft. They haven't had 10 years of continual attacks against them."

The machines Jack hacked were, however, based on Microsoft's Windows CE operating system.

In an dramatic on-stage demonstration at Black Hat, he connected remotely to an ATM and ran a program called Jackpot that caused the ATMs to spit out cash, while playing a tune and splashing the word "Jackpot" across the screen of the machine.

In a second demo, he walked up to the machine, opened it with a key he had obtained on the Internet, and installed his own firmware. A single, standard key can open many different types of machines, he said, presenting another serious security problem.

He demonstrated the remote attack on an unpatched Tranax system; the hands-on attack was on an older Triton machine, he said.

Jack had planned to deliver the talk at last year's conference, but it was pulled after ATM vendors asked for more time to patch the issues he'd discovered.

He got the green light for the talk after leaving his former employer, Juniper Networks, and taking a job with IOActive, a company that sells -- among other things -- ATM security consulting services.

The security researcher seems to have had a good time researching ATM bugs. When a delivery man showed up, asking him why on earth he'd want a machine delivered to his home, Jack quipped, "Oh I just don’t' like the transaction fees, mate."
[Image: conspiracy_theory.jpg]
09-08-2010, 04:43 AM,
RE: Windows CE-based ATM's can easily be made to dole out $, security researcher says
Interesting but I'll pass - money is fake but prison is fairly real.

Fun Fact: Most Canadian banks (TD almost exclusively) use Diebold hardware OS for their ATMs.
There are no others, there is only us.
09-08-2010, 05:09 AM,
RE: Windows CE-based ATM's can easily be made to dole out $, security researcher says
Both posts are very interesting.
An error does not become truth by reason of multiplied propagation, nor does truth become error because nobody sees it.
Mohandas Gandhi

Each of us is put here in this time and this place to personally decide the future of humankind.
Did you think you were put here for something less?
Chief Arvol Looking Horse

Possibly Related Threads...
Thread Author Replies Views Last Post
  Installing DNSCrypt on Windows 4cc 2 602 04-11-2014, 05:30 PM
Last Post: 4cc
Exclamation Massive Security Bug In OpenSSL Could Affect A Huge Chunk Of The Internet temp9 7 1,667 04-10-2014, 03:36 PM
Last Post: temp9
  Microsoft says Windows 8 is a Failure! shortwave 14 1,605 05-15-2013, 09:56 PM
Last Post: ComradeRed
  Clover: Windows Explorer with Tabs (freeware) thokling 0 518 04-08-2013, 03:50 PM
Last Post: thokling
  How NSA access was built into Windows BlackFerdy 2 869 11-29-2012, 06:38 PM
Last Post: fujiinn
  Security slackers risk Internet blackout on March 8 Frank2 0 609 02-23-2012, 09:55 PM
Last Post: Frank2
  flaws in the key generation that underpins the security of protocols, including SSL. h3rm35 0 423 02-17-2012, 10:27 PM
Last Post: h3rm35
  Incognito - debian based Linux OS made with privacy in mind. Telecaster72 1 1,848 05-11-2011, 05:56 PM
Last Post: danny0085
  New Critical Bug In All Current Windows Versions pax681 2 1,323 01-30-2011, 09:30 AM
Last Post: pax681
  Iconoclast icon stuck in windows media player Orwell63 5 2,614 11-29-2010, 05:32 PM
Last Post: yeti

Forum Jump:

Users browsing this thread: 1 Guest(s)