Supercharge your infrastructure

A talk demonstrating security weaknesses in a widely used automatic teller machine has been pulled from next month's Black Hat conference after the machine vendor placed pressure on the speaker's employer.

Juniper Networks, a provider of network devices and security services, said it delayed the talk by its employee Barnaby Jack at the request of the ATM vendor. The talk promised to "explore both local and remote attack vectors, and finish with a live demonstration of an attack on an unmodified, stock ATM," according to a description of the talk pulled from the Black Hat website in the past 24 hours.

"Juniper believes that Jack's research is important to be presented in a public forum in order to advance the state of security," the company said in a statement. "However, the affected ATM vendor has expressed to us concern about publicly disclosing the research findings before its constituents were fully protected. Considering the scope and possible exposure of this issue on other vendors, Juniper decided to postpone Jack's presentation until all affected vendors have sufficiently addressed the issues found his research."

The talk, which was titled "Jackpotting Automated Teller Machines," was to include a demonstration showing how the ATM could be forced to disburse all its cash, according to Risky.Biz, which reported the cancellation earlier.

Neither Jack nor Juniper identified the ATM brand that was the subject of the talk. Earlier this year, ATM vendor Diebold warned customers of an isolated incident in Russia in which criminals attempted to use the malware to intercept sensitive information after installing malware on some machines. Earlier this month, researchers from Trustwave's SpiderLabs documented several similar trojans that had managed to burrow into ATMs in Eastern Europe.

By now, canceled talks at Black Hat have become old hat. In 2005 Michael Lynn, then a researcher for Internet Security Systems, was ordered to pull a talk detailing security holes in network routers made by Cisco Systems. Rather than comply, he quit his job and gave the presentation anyway and eventually wound up working for Juniper, where he now works.

Two years later, a talk by Chris Paget, then a researcher at IOActive, was pulled at the last minute following pressure from HID Corp., a manufacture of radio frequency identification products. Paget said at the time the demonstration showing how to bypass building access controls incorporated concepts that had been public for a long while.

And last year, at Black Hat sister conference Defcon, three undergrads from the Massachusetts Institute of Technology were barred from speaking about security weaknesses in an electronic payment system used by the Massachusetts Bay Transit Authority. The ruling was later overturned. ®

5 ways to prepare your advertising infrastructure for disaster