Feeds

The Hack in the Box ATM talk that never was...

No vendor threats, 'cos no talk, says researcher

The essential guide to IT transformation

A banking security researcher has stepped forward to deny reports that vendor threats forced him to cancel a presentation on ATM security at the Hack in the Box conference in Amsterdam earlier this month.

Many outlets, including El Reg, reported that a presentation on the vulnerabilities and security shortcomings that cyber criminals were using to break into ATMs was cancelled at the last minute due to legal threats against ethical hacker Raoul Chiesa.

Chiesa issued a statement on Monday explaining that the much-trailed talk on Third Generation ATM Frauds didn't happen because he and his firm Mediaservice.net decided 18 months ago to only disclose vulnerabilities that have emerged to "closed sector-specific" associations and not at public events. Secondly, Chiesa had other commitments at home in Rome on July 2, the date he was due to appear at Hack in the Box.

"No manufacturer or systems integrator of ATM, nor banking or financial institution, have ever threatened Chiesa or the company Mediaservice.net," the statement explained.

Chiesa's research team has already presented part of this research in European Union security agency ENISA's report ATM Crime: Overview of the European situation and golden rules on how to avoid it last September, and in greater depth at a closed-door conference of ABI, an Italian banking trade group, around the same time.

The Mediaservice.net team remains committed to responsible disclosure despite what it describes as "insufficient measures" in mitigating vulnerabilities by the banking industry. Without going into details, the team cited the tampering of software in Ukrainian bank ATMs by organised crime as among the new generation of threat the industry faces.

"Everything has been a big misunderstanding with HITB [Hack in the Box] staff," Chiesa told El Reg.

"My original presentation, planned to be given at HITB EU on July 2nd 2010, was on the "Underground Economy". It is a presentation I've already given (CONfidence 2010, Troopers 2009, nullcon India 2010) and does not have anything to do with ATMs.

"A couple of weeks before HITB EU, I was speaking internally at my company, if going for Full Disclosure or not, given the critical topic we were working on. I told to Dhillon from HITB EU - we're discussing this internally, I'd love to go for Full Disclosure. If we ever decided this, I'd love to give the talk at HITB, since the delegates are serious and the speaker's level is quite high."

Although the supposed legal threats against Chiesa have been denied, other security researchers have not been so lucky. For example, a presentation on ATM security by Barnaby Jack was pulled from last year's Black Hat, only to be reinstated for this month's show.

Jack has moved from Juniper Networks to IOActive Labs over the last 12 months, a job change that has allowed him to explain how ATM machines might be fooled into dispensing more cash than recorded during a transaction at this year's Black Hat USA.

The "Jackpotting" presentation, which Jack himself compares to the cash machines hack run by John Connor in Terminator 2, is likely to be one of the highlights of this year's conference. ®

Next gen security for virtualised datacentres

More from The Register

next story
Ice cream headache as black hat hacks sack Dairy Queen
I scream, you scream, we all scream 'DATA BREACH'!
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
New Snowden leak: How NSA shared 850-billion-plus metadata records
'Federated search' spaffed info all over Five Eyes chums
Three quarters of South Korea popped in online gaming raids
Records used to plunder game items, sold off to low lifes
Oz fed police in PDF redaction SNAFU
Give us your metadata, we'll publish your data
prev story

Whitepapers

5 things you didn’t know about cloud backup
IT departments are embracing cloud backup, but there’s a lot you need to know before choosing a service provider. Learn all the critical things you need to know.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Backing up Big Data
Solving backup challenges and “protect everything from everywhere,” as we move into the era of big data management and the adoption of BYOD.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?