ATM Hack Gives Cash On Demand

angry tapir writes "Windows CE-based ATMs can easily be made to dole out cash, according to security researcher Barnaby Jack. Exploiting bugs in two different ATMs at Black Hat, the researcher from IOActive was able to get them to spit out money on demand and record sensitive data from the cards of people who used them. Jack believes a large number of ATMs have remote management tools that can be accessed over a telephone. After experimenting with two machines he purchased, Jack developed a way of bypassing the remote authentication system and installing a homemade rootkit, named Scrooge."

I see what you did there...

[fuzzyfuzzyfungus]

This is clearly just a slashvertisement for Microsoft's expansion of their "Cashback" promotion from Bing to WinCE "The Product that Needs it More Than Bing"...

Editorial standards these days... I ask you...

Pretension

[aliddell]

Exploiting bugs in two different ATM machines

'ATM machines'? Really?

Re:MSFT Fanboys HURRY!

[Anonymous Coward]

Only need one: he didn't hack the OS, only the applications running on top of the OS.

Re:Redundancy

[betterunixthanunix]

Something has to build the ATMs! Clearly, this hacker has discovered that the robots that build ATMs also create money.

Re:Pretension

[Spad]

And he didn't even need a PIN Number

Re:Redundancy

[prionic6]

But who makes the ATMMs?

It's machines all the way down!

Re:Pretension

[Darth_brooks]

Yeah, ATM Machines. Those things that you put your PIN Number into.

Re:Interesting Hacks...

[RMS Eats Toejam]

... all the ATMs were running OS/2.

There was never a time when all ATMs ran OS/2. Besides, OS/2 had its own problems [wikipedia.org].

Re:scrooge?

[fuzzyfuzzyfungus]

A good rootkit tries to blend in with its environment...

Re:Pretension

[davidbrit2]

I think that would be the machine operating the machine that's operating the ATM. It brings the level of automation to where you only have to subconsciously think of money, or anything that rhymes with money in order to make a withdrawal.

Re:Redundancy

[TheRaven64]

Since the post above you says exactly the same thing, I couldn't decide whether you should be moderated redundant or funny.

'M' is for Machine

[ricosalomar]

The summary refers to 'ATM machines.'

I haven't read TFA article, but I wonder if you need a PIN number, or if the exploit uses a VM machine?

Has someone notified the federal FBI bureau?

Re:Pretension

[RulerOf]

Rumor has it that if the hacker can find the MAC controller address for the NIC card in the ATM machine, he can use specially crafted TCP/IP protocol and also expose your SSN number.

Re:Interesting Hacks...

[Zerth]

AV on machines that shouldn't need them? yay...

Relevant xkcd [xkcd.com]

Re:Pretension

[need4mospd]

But only ATM machines with specific UPC codes and LCD displays will do this. And you should make sure your PC computer has enough RAM memory and is setup to run on AC current using only RF frequencies to communicate. Always back up these transactions to a DAT tape or CD disks. If you do this right, you should be able to avoid any VAT taxes so you can afford more KFC chicken.

Re:Really?

[Anonymous Coward]

Tell me: at these 'restaurants', do the 'waitresses' take off their clothes while dancing on a stage?