Feeds

The Hack in the Box ATM talk that never was...

No vendor threats, 'cos no talk, says researcher

Internet Security Threat Report 2014

A banking security researcher has stepped forward to deny reports that vendor threats forced him to cancel a presentation on ATM security at the Hack in the Box conference in Amsterdam earlier this month.

Many outlets, including El Reg, reported that a presentation on the vulnerabilities and security shortcomings that cyber criminals were using to break into ATMs was cancelled at the last minute due to legal threats against ethical hacker Raoul Chiesa.

Chiesa issued a statement on Monday explaining that the much-trailed talk on Third Generation ATM Frauds didn't happen because he and his firm Mediaservice.net decided 18 months ago to only disclose vulnerabilities that have emerged to "closed sector-specific" associations and not at public events. Secondly, Chiesa had other commitments at home in Rome on July 2, the date he was due to appear at Hack in the Box.

"No manufacturer or systems integrator of ATM, nor banking or financial institution, have ever threatened Chiesa or the company Mediaservice.net," the statement explained.

Chiesa's research team has already presented part of this research in European Union security agency ENISA's report ATM Crime: Overview of the European situation and golden rules on how to avoid it last September, and in greater depth at a closed-door conference of ABI, an Italian banking trade group, around the same time.

The Mediaservice.net team remains committed to responsible disclosure despite what it describes as "insufficient measures" in mitigating vulnerabilities by the banking industry. Without going into details, the team cited the tampering of software in Ukrainian bank ATMs by organised crime as among the new generation of threat the industry faces.

"Everything has been a big misunderstanding with HITB [Hack in the Box] staff," Chiesa told El Reg.

"My original presentation, planned to be given at HITB EU on July 2nd 2010, was on the "Underground Economy". It is a presentation I've already given (CONfidence 2010, Troopers 2009, nullcon India 2010) and does not have anything to do with ATMs.

"A couple of weeks before HITB EU, I was speaking internally at my company, if going for Full Disclosure or not, given the critical topic we were working on. I told to Dhillon from HITB EU - we're discussing this internally, I'd love to go for Full Disclosure. If we ever decided this, I'd love to give the talk at HITB, since the delegates are serious and the speaker's level is quite high."

Although the supposed legal threats against Chiesa have been denied, other security researchers have not been so lucky. For example, a presentation on ATM security by Barnaby Jack was pulled from last year's Black Hat, only to be reinstated for this month's show.

Jack has moved from Juniper Networks to IOActive Labs over the last 12 months, a job change that has allowed him to explain how ATM machines might be fooled into dispensing more cash than recorded during a transaction at this year's Black Hat USA.

The "Jackpotting" presentation, which Jack himself compares to the cash machines hack run by John Connor in Terminator 2, is likely to be one of the highlights of this year's conference. ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Why did it take antivirus giants YEARS to drill into super-scary Regin? Symantec responds...
FYI this isn't just going to target Windows, Linux and OS X fans
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Home Office: Fancy flogging us some SECRET SPY GEAR?
If you do, tell NOBODY what it's for or how it works
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
Syrian Electronic Army in news site 'hack' POP-UP MAYHEM
Gigya redirect exploit blamed for pop-rageous ploy
Astro-boffins start opening universe simulation data
Got a supercomputer? Want to simulate a universe? Here you go
prev story

Whitepapers

10 ways wire data helps conquer IT complexity
IT teams can automatically detect problems across the IT environment, spot data theft, select unique pieces of transaction payloads to send to a data source, and more.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
The total economic impact of Druva inSync
Examining the ROI enterprises may realize by implementing inSync, as they look to improve backup and recovery of endpoint data in a cost-effective manner.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.