Feeds

Researcher barred from demoing ATM security vuln

Not ready for prime time

5 things you didn’t know about cloud backup

A talk demonstrating security weaknesses in a widely used automatic teller machine has been pulled from next month's Black Hat conference after the machine vendor placed pressure on the speaker's employer.

Juniper Networks, a provider of network devices and security services, said it delayed the talk by its employee Barnaby Jack at the request of the ATM vendor. The talk promised to "explore both local and remote attack vectors, and finish with a live demonstration of an attack on an unmodified, stock ATM," according to a description of the talk pulled from the Black Hat website in the past 24 hours.

"Juniper believes that Jack's research is important to be presented in a public forum in order to advance the state of security," the company said in a statement. "However, the affected ATM vendor has expressed to us concern about publicly disclosing the research findings before its constituents were fully protected. Considering the scope and possible exposure of this issue on other vendors, Juniper decided to postpone Jack's presentation until all affected vendors have sufficiently addressed the issues found his research."

The talk, which was titled "Jackpotting Automated Teller Machines," was to include a demonstration showing how the ATM could be forced to disburse all its cash, according to Risky.Biz, which reported the cancellation earlier.

Neither Jack nor Juniper identified the ATM brand that was the subject of the talk. Earlier this year, ATM vendor Diebold warned customers of an isolated incident in Russia in which criminals attempted to use the malware to intercept sensitive information after installing malware on some machines. Earlier this month, researchers from Trustwave's SpiderLabs documented several similar trojans that had managed to burrow into ATMs in Eastern Europe.

By now, canceled talks at Black Hat have become old hat. In 2005 Michael Lynn, then a researcher for Internet Security Systems, was ordered to pull a talk detailing security holes in network routers made by Cisco Systems. Rather than comply, he quit his job and gave the presentation anyway and eventually wound up working for Juniper, where he now works.

Two years later, a talk by Chris Paget, then a researcher at IOActive, was pulled at the last minute following pressure from HID Corp., a manufacture of radio frequency identification products. Paget said at the time the demonstration showing how to bypass building access controls incorporated concepts that had been public for a long while.

And last year, at Black Hat sister conference Defcon, three undergrads from the Massachusetts Institute of Technology were barred from speaking about security weaknesses in an electronic payment system used by the Massachusetts Bay Transit Authority. The ruling was later overturned. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
One HUNDRED FAMOUS LADIES exposed NUDE online
Celebrity women victimised as Apple iCloud accounts reportedly popped
Rubbish WPS config sees WiFi router keys popped in seconds
Another day, another way in to your home router
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
NZ Justice Minister scalped as hacker leaks emails
Grab your popcorn: Subterfuge and slur disrupts election run up
HP: NORKS' cyber spying efforts actually a credible cyberthreat
'Sophisticated' spies, DIY tech and a TROLL ARMY – report
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
New Snowden leak: How NSA shared 850-billion-plus metadata records
'Federated search' spaffed info all over Five Eyes chums
prev story

Whitepapers

Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Advanced data protection for your virtualized environments
Find a natural fit for optimizing protection for the often resource-constrained data protection process found in virtual environments.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.