Feeds

Researcher barred from demoing ATM security vuln

Not ready for prime time

Top three mobile application threats

A talk demonstrating security weaknesses in a widely used automatic teller machine has been pulled from next month's Black Hat conference after the machine vendor placed pressure on the speaker's employer.

Juniper Networks, a provider of network devices and security services, said it delayed the talk by its employee Barnaby Jack at the request of the ATM vendor. The talk promised to "explore both local and remote attack vectors, and finish with a live demonstration of an attack on an unmodified, stock ATM," according to a description of the talk pulled from the Black Hat website in the past 24 hours.

"Juniper believes that Jack's research is important to be presented in a public forum in order to advance the state of security," the company said in a statement. "However, the affected ATM vendor has expressed to us concern about publicly disclosing the research findings before its constituents were fully protected. Considering the scope and possible exposure of this issue on other vendors, Juniper decided to postpone Jack's presentation until all affected vendors have sufficiently addressed the issues found his research."

The talk, which was titled "Jackpotting Automated Teller Machines," was to include a demonstration showing how the ATM could be forced to disburse all its cash, according to Risky.Biz, which reported the cancellation earlier.

Neither Jack nor Juniper identified the ATM brand that was the subject of the talk. Earlier this year, ATM vendor Diebold warned customers of an isolated incident in Russia in which criminals attempted to use the malware to intercept sensitive information after installing malware on some machines. Earlier this month, researchers from Trustwave's SpiderLabs documented several similar trojans that had managed to burrow into ATMs in Eastern Europe.

By now, canceled talks at Black Hat have become old hat. In 2005 Michael Lynn, then a researcher for Internet Security Systems, was ordered to pull a talk detailing security holes in network routers made by Cisco Systems. Rather than comply, he quit his job and gave the presentation anyway and eventually wound up working for Juniper, where he now works.

Two years later, a talk by Chris Paget, then a researcher at IOActive, was pulled at the last minute following pressure from HID Corp., a manufacture of radio frequency identification products. Paget said at the time the demonstration showing how to bypass building access controls incorporated concepts that had been public for a long while.

And last year, at Black Hat sister conference Defcon, three undergrads from the Massachusetts Institute of Technology were barred from speaking about security weaknesses in an electronic payment system used by the Massachusetts Bay Transit Authority. The ruling was later overturned. ®

Combat fraud and increase customer satisfaction

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Canadian taxman says hundreds pierced by Heartbleed SSL skewer
900 social insurance numbers nicked, says revenue watchman
German space centre endures cyber attack
Chinese code retrieved but NSA hack not ruled out
Burnt out on patches this month? Oracle's got 104 MORE fixes for you
Mass patch for issues across its software catalog
Reddit users discover iOS malware threat
'Unflod Baby Panda' looks to snatch Apple IDs
prev story

Whitepapers

Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.