Feeds

Researcher barred from demoing ATM security vuln

Not ready for prime time

5 things you didn’t know about cloud backup

A talk demonstrating security weaknesses in a widely used automatic teller machine has been pulled from next month's Black Hat conference after the machine vendor placed pressure on the speaker's employer.

Juniper Networks, a provider of network devices and security services, said it delayed the talk by its employee Barnaby Jack at the request of the ATM vendor. The talk promised to "explore both local and remote attack vectors, and finish with a live demonstration of an attack on an unmodified, stock ATM," according to a description of the talk pulled from the Black Hat website in the past 24 hours.

"Juniper believes that Jack's research is important to be presented in a public forum in order to advance the state of security," the company said in a statement. "However, the affected ATM vendor has expressed to us concern about publicly disclosing the research findings before its constituents were fully protected. Considering the scope and possible exposure of this issue on other vendors, Juniper decided to postpone Jack's presentation until all affected vendors have sufficiently addressed the issues found his research."

The talk, which was titled "Jackpotting Automated Teller Machines," was to include a demonstration showing how the ATM could be forced to disburse all its cash, according to Risky.Biz, which reported the cancellation earlier.

Neither Jack nor Juniper identified the ATM brand that was the subject of the talk. Earlier this year, ATM vendor Diebold warned customers of an isolated incident in Russia in which criminals attempted to use the malware to intercept sensitive information after installing malware on some machines. Earlier this month, researchers from Trustwave's SpiderLabs documented several similar trojans that had managed to burrow into ATMs in Eastern Europe.

By now, canceled talks at Black Hat have become old hat. In 2005 Michael Lynn, then a researcher for Internet Security Systems, was ordered to pull a talk detailing security holes in network routers made by Cisco Systems. Rather than comply, he quit his job and gave the presentation anyway and eventually wound up working for Juniper, where he now works.

Two years later, a talk by Chris Paget, then a researcher at IOActive, was pulled at the last minute following pressure from HID Corp., a manufacture of radio frequency identification products. Paget said at the time the demonstration showing how to bypass building access controls incorporated concepts that had been public for a long while.

And last year, at Black Hat sister conference Defcon, three undergrads from the Massachusetts Institute of Technology were barred from speaking about security weaknesses in an electronic payment system used by the Massachusetts Bay Transit Authority. The ruling was later overturned. ®

5 things you didn’t know about cloud backup

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
5 things you didn’t know about cloud backup
IT departments are embracing cloud backup, but there’s a lot you need to know before choosing a service provider. Learn all the critical things you need to know.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?