Feeds

Armed with exploits, ATM hacker hits the jackpot

'Game over' vulns spew cash on demand

Secure remote control for conventional and virtual desktops

Black Hat A startling percentage of the world's automated teller machines are vulnerable to physical and remote attacks that can steal administrative passwords and personal identification numbers to say nothing of huge amounts of cash, a security researcher said Wednesday.

At the Black Hat security conference in Las Vegas, Barnaby Jack, a security researcher with IOActive, demonstrated attacks against two unpatched models from two of the world's biggest ATM makers. One exploited software that uses the internet or phone lines to remotely administer a machine made by Tranax Technologies. Once Jack was in, he was able to install a rootkit that allowed him to view administrative passwords and account PINs and to force the machine to spit out a steady stream of dollar bills, something the researcher called “jackpotting.”

“It's time to give these devices an overhaul,” Jack told a standing room-only audience during day one of the two-day conference. “There hasn't been a secure development methodology from the get go. The simple fact is companies who manufacture the devices aren't Microsoft. They haven't had 10 years of continued attacks against them.”

In a second attack against a machine from Triton Systems, Jack used a key available for sale over the internet to access the model's internal components. He was then able to use a install his rootkit by inserting a USB drive that was preloaded with the malicious program.

Both Triton and Tranax have patched the vulnerabilities that were exploited in the demos. But in a press conference immediately following his talk, Jack said he was confident he could find similarly devastating flaws – including in machines made by other manufacturers as well.

Jack said he wasn't aware of real-world attacks that used his exploits, but this foiled attack from earlier this year appears to involve many of the same techniques.

“Every ATM I've looked at, I've found a game-over vulnerability that allows me to get cash from the machine,” he said.

To streamline his work, Jack developed an exploit kit he calls Dillinger, named after the 1930s bank robber. It can be used to access ATMs that are connected to the internet or the telephone system, which Jack said is true of most machines. The researcher has developed a rootkit dubbed Scrooge, which is installed once Dillinger has successfully penetrated a machine.

Jack said vulnerable ATMs can be located by war-dialing large numbers of phone numbers or sending specific queries to IP addresses. Those connected to ATMs will send responses that hackers can easily recognize.

Jack called on manufacturers to do a better job securing their machines. Upgrades for physical locks, executable signing at the operating system kernel level and more rigorous code reviews should all be implemented, he said.

The talk came one year after a similar one was pulled last year. Jack said the cancellation came because there weren't patches in place for the vulnerabilities he planned to demonstrate.

He said he was grateful for the extra year to research the vulnerabilities. ®

New hybrid storage solutions

More from The Register

next story
Google recommends pronounceable passwords
Super Chrome goes into battle with Mr Mxyzptlk
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
Snowden, Dotcom, throw bombs into NZ election campaign
Claim of tapped undersea cable refuted by Kiwi PM as Kim claims extradition plot
Reddit wipes clean leaked celeb nudie pics, tells users to zip it
Now we've had all THAT TRAFFIC, we 'deplore' this theft
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
TorrentLocker unpicked: Crypto coding shocker defeats extortionists
Lousy XOR opens door into which victims can shove a foot
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.