Googling for ATM Master Passwords

default DOLLAR writes to mention an eWeek article following up on the ATM reprogramming scam pulled in Virginia Beach last week. A security researcher in New York has used a YouTube video, a few Google searches, and other legal methods to discover the master passwords to thousands of ATMs across the country. From the article: "Dave Goldsmith, founder and president of penetration testing outfit Matasano Security, in New York, did not say how he obtained the operator manual--which contains master passwords and other sensitive security information about the cash-dispensing machines--but an eWEEK investigation shows that a simple Google query will return a 102-page PDF file that provides a road map to the hack."

Giddy-up!

[Logiksan (947439)]

*runs off to Google and YouTube as fast as his little fingers will take him*

Re:Giddy-up!

[russ1337 (938915)]

Well you can always find more interesting things by doing a Google search for: [Confidential "not for public release"] Like this [google.com]

This technique was posted on Boing Boing and Bruce Schneier a couple of weeks ago. Still. Plenty of good stuff out there.

Re:Giddy-up!

[Marxist Hacker 42 (638312)]

Besides, I was wrong- only the PDF for THAT SPECIFIC MODEL has been removed. Operators manuals for hundreds of other ATMs still are up....

Re:Giddy-up!

[dan828 (753380)]

Kids these days got it easy. In my day you had to spend hours digging though dumpsters, now you just click a couple of buttons. What is the world coming to?

Trivial search - and the password is....

[rblum (211213)]

12345

Oh wait. That's my ATM PIN.

Re:Trivial search - and the password is....

[1010110010 (1002553)]

1 2 3 4 5? That's the combination an idiot would have on his luggage!

Re:Trivial search - and the password is....

[JesseL (107722)]

That's the combination to my luggage!

Casino

[Enderandrew (866215)]

I recently did IT for the largest casino company on the planet. I was dual-property and responsible for two casinos. The master code that would open the keyboxes and get you keys to anywhere in the casino was 654321. And people told each other all their passwords and such all the time.

I couldn't believe it.

Re:Casino

[TopShelf (92521)]

That's a perfect illustration of how technological devices are only a small part of security. Having solid policies that are actually followed means every bit as much, if not more. From TFA:

"This isn't a vulnerability," Goldsmith explained. "It's someone exploiting a policy weakness, where ATM owners install these things and never change the default password."

All that's in the PDF is the default password, following a warning in BIG BOLD TYPE saying that you need to change the default password before deploying the machine. Would they put in a new combination lock on their vault and leave a combo of 1-2-3? I should hope not...

Re:Casino

[Enderandrew (866215)]

Very true. The only inch of that casino not covered by cameras was the IT offices. Survailence wasn't allowed to look over my shoulder, because they could see passwords and sensitive data that way. We had cops, investigators and state regulators on property.

Casinos prosecute is you steal $5 from them.

Aha!

[The Grey Clone (770110)]

We've finally found that mysterious step 2!

We're rich!! We're rich!!!

[queenb**ch (446380)]

Phhhtttt!!!

That's to all of you who made fun of us geeks!

*Rude Hand Gesture*

That's for every bully who ever shoved someone into a locker during PE.

Due to our superior ability to manipulate poorly secured cash dispensing devices, we shall now rule the world!

First the treasury...then the military. World domination cannot be far behind.

2 cents,

QueenB

Re:We're rich!! We're rich!!!

[lomedhi (801451)]

2 cents,

Please enter a multiple of $5 or $20.

Nine Days....

[Mr.Scamp (974300)]

The machine gave $20's for $5's for NINE days after it was reprogrammed before someone commented on it. God Bless America.

Re:Nine Days....

[geekoid (135745)]

Yes.

It's called honesty and ethics.
But if you leve your car door unlocked, and someone takes it, I'm sure you won't mind, since it was your 'fault'.

WOW

[Anon-Admin (443764)]

Wow that is cool, it was a quick search and I found it!

It says that to enter the management screen you hold the key and press one. Then the default UID is 00 and the default password is 12345 so you should enter 0012345 into the prompt.

I am off to the ATM down stairs. I could use a little extra cash.

"Gawd, Idiots!"

[patrixmyth (167599)]

Here I was thinking that the problems with voting machines had to be intentional, since ATM's were so much better secured. Now that I find out that a keystroke combination on the interface of an ATM will bring up a GUI to reprogram the machine, protected only by a default password, I can rest assured that the world is not as shrouded in conspiracy as I feared. It's just full of very very very (very very very very very) stupid people. Now, watch as one of these aforementioned idiots elected to public office blames this on Google.

there's enough clues in the article.....

[nblender (741424)]

For this one you have to carefully RTFA. You actually have to do it. Not just pretend. A simple google search, plus some whois sleuthing to confirm you have the right one, will turn up a company that currently has it's "support.html" disabled (404), but the wayback machine has an old (2005) copy of "support.htm" which has a list of error codes, FAQ, etc, for the machine in question. It's not too much of a stretch to believe that someone put the manual up for download at some point.

No, I don't have the manual. I don't really care either, it was an interesting academic exercise.

ATM Industry Association warned them.

[gurps_npc (621217)]

Back in Feb 2005, the ATM Industry Association released a memo or press announcement, found here:

http://www.gasa-cognito.com/media/GASA-ATMIA%20Fra ud%20Alert1.pdf#search=%22atm%20master%20password% 22 [gasa-cognito.com]

It specifically warned the industry that their passwords were getting out and to tell the banks to CHANGE them.

Frankly, I have zero sympathy for the bank that lost cash.

And not much respect for the idiots that did not report it. What, did they think the banks would never find out what happened? That when they did find out, they would not 'correct' the accounts?

Either report it, or get yourself an untraceable card and return.

Re:The default password is...

[Talondel (693866)]

Close. Actually it apears that it's 001234. http://www.tritonatm.com/en/service/manuals/07103- 00013C%20(FT5KUsrMan(3.0))file.pdf [tritonatm.com]

Re:The default password is...

[jenkin sear (28765)]

I thought it was up, up, down, down, left, right, left, right, B, A, Start ...

Re:The default password is...

[CastrTroy (595695)]

However, should ATMs even come with a default password so that they can be hacked? Shouldn't reprogramming them require using some sort of physical/electronic key thats more difficult for people to get ahold of? If you can reprogram an ATM by walking up to it and typing in any code, regardless of whether it's the default password or not, then the ATM security is terrible. It's one thing to put a default password on a digital cable box for blocking channels, it's another matter entirely to put a default password on an ATM.

Ready-Set -Go

[Analogy Man (601298)]

However, should voting machines even come with a default password so that they can be hacked? Shouldn't reprogramming them require using some sort of physical/electronic key thats more difficult for people to get ahold of? If you can reprogram a voting machine by walking up to it and typing in any code, regardless of whether it's the default password or not, then the voting machine security is terrible. It's one thing to put a default password on a digital cable box for blocking channels, it's another matter entirely to put a default password on a voting machine.

Which one gets fixed first!

Re:The default password is...

[Tumbleweed (3706)]

But to be fair it also stated in very big bold type that this default master password should be changed. The fact the master password remains unchanged is a user error in the setup and not a design flaw.

I would say that's incorrect. It should be a trivial matter for the software to be written to REQUIRE the default password to be changed before the machine will actually give out money. Rather like having to immediately change your password when you first login to an account. It's not a difficult concept, and while this is technically a 'lack' of a feature rather than a bug, it's certainly a flaw in design, and a pretty basic one at that.

Re:Has to be said

[szembek (948327)]

No but this one is: http://www.diebold.com/ficcdsvdoc/TechPubs/books/T P-820327-001/tp-820327-001-1.htm [diebold.com] that one is. Diebold actually makes really good atms in my opinion. At least as far as the end user interface is considered. The ones my bank uses have a lot of nice features: - can dispense change to the penny - can scan/cash/deposit checks - doesn't make you hit OK after you put in your pin (aren't they all 4 chars long?) - doesn't keep your card until the end of the transaction so you forget it