Hacker gives ATM officials a security lesson

Hacker gives ATM officials a security lesson
Tags: ATM Industry Association (ATMIA), Associations / Conferences, North America, Security, Software, Vault Cash / Cash Management
July 28, 2010 - Frederick Lowe

ATM manufacturers must use knowledge gained from an ethical hacker who discovered a way to force off-premise ATMs to dispense vault cash without PINs, said Mike Lee, CEO of the ATM Industry Association.

“This type of research conducted by professionals like [Barnaby] Jack should be leveraged by our industry to improve ATM Security,” Lee said. “Even though we have produced a whole set of ATM guidelines, we are always looking to raise awareness to continuously improve security of the ATM channel in a global environment that is faced with an evolving risk of fraud.”

During the Black Hat conference yesterday in Las Vegas, Jack, who is director of security research at IOActive Inc. in Seattle, demonstrated how he forced three ATMs to dispense funds by exploiting the machines’ weaknesses in the computers that operate the ATMs.

Jack purchased machines online from different manufacturers. He discovered that the physical keys were the same for all ATMs of that type made by that manufacturer.

He used the keys to unlock a compartment of the ATM that had standard USB slots. He then inserted a program he wrote for one of the machines, commanding it to dispense all of its vault cash.

Jack also hacked ATMs by exploiting the weakness in the way in which ATM manufacturers communicate with the machines over the Internet. Outsiders are permitted to bypass the need for a password, he said. This type of hacking is considered very dangerous because a hacker can gain full control of the ATM without opening it up.

Jack taught industry officials an important lesson, Lee said.

“Independent Black Hat security briefings remind industry practitioners to stay vigilant, especially in regard to new and emerging threats,” he added.