Feeds

Researcher barred from demoing ATM security vuln

Not ready for prime time

Protecting against web application threats using SSL

A talk demonstrating security weaknesses in a widely used automatic teller machine has been pulled from next month's Black Hat conference after the machine vendor placed pressure on the speaker's employer.

Juniper Networks, a provider of network devices and security services, said it delayed the talk by its employee Barnaby Jack at the request of the ATM vendor. The talk promised to "explore both local and remote attack vectors, and finish with a live demonstration of an attack on an unmodified, stock ATM," according to a description of the talk pulled from the Black Hat website in the past 24 hours.

"Juniper believes that Jack's research is important to be presented in a public forum in order to advance the state of security," the company said in a statement. "However, the affected ATM vendor has expressed to us concern about publicly disclosing the research findings before its constituents were fully protected. Considering the scope and possible exposure of this issue on other vendors, Juniper decided to postpone Jack's presentation until all affected vendors have sufficiently addressed the issues found his research."

The talk, which was titled "Jackpotting Automated Teller Machines," was to include a demonstration showing how the ATM could be forced to disburse all its cash, according to Risky.Biz, which reported the cancellation earlier.

Neither Jack nor Juniper identified the ATM brand that was the subject of the talk. Earlier this year, ATM vendor Diebold warned customers of an isolated incident in Russia in which criminals attempted to use the malware to intercept sensitive information after installing malware on some machines. Earlier this month, researchers from Trustwave's SpiderLabs documented several similar trojans that had managed to burrow into ATMs in Eastern Europe.

By now, canceled talks at Black Hat have become old hat. In 2005 Michael Lynn, then a researcher for Internet Security Systems, was ordered to pull a talk detailing security holes in network routers made by Cisco Systems. Rather than comply, he quit his job and gave the presentation anyway and eventually wound up working for Juniper, where he now works.

Two years later, a talk by Chris Paget, then a researcher at IOActive, was pulled at the last minute following pressure from HID Corp., a manufacture of radio frequency identification products. Paget said at the time the demonstration showing how to bypass building access controls incorporated concepts that had been public for a long while.

And last year, at Black Hat sister conference Defcon, three undergrads from the Massachusetts Institute of Technology were barred from speaking about security weaknesses in an electronic payment system used by the Massachusetts Bay Transit Authority. The ruling was later overturned. ®

Reducing the cost and complexity of web vulnerability management

More from The Register

next story
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
China hacked US Army transport orgs TWENTY TIMES in ONE YEAR
FBI et al knew of nine hacks - but didn't tell TRANSCOM
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.