Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

‘Jackpotting’ Attacks Hit U.S. ATMs

krebsonsecurity.com

Post reply on HN
Print view View original

31–40 of 174 posts

Re: ‘Jackpotting’ Attacks Hit U.S. ATMs

#31

Post by dtech »

pferde wrote: post #28

Several years ago, I've had an ATM crash and reboot after pressing one of the screen side buttons when the machine was waiting for PIN entry via the numeric pad. It rebooted, and I could see that it was running MSDOS, not even Windows. Luckily, after the reboot completed and the ATM frontend program started, it spit out my card again. With one of offices of my bank being nearby (to be able to block my card if I could…

I'd rather have a ATM running MS-DOS than Windows. At least the attack surface is small. God nows how many ATM's are running Windows 98 and XP, which contain major security holes which will never be patched.

Re: ‘Jackpotting’ Attacks Hit U.S. ATMs

#32

Post by shaunpud »

p1mrx wrote: post #12

Wow, I always thought the ATM scene from Terminator 2 seemed unrealistic, but now people are literally doing that: https://www.youtube.com/watch?v=3cfQKxUffqA

How does it work with posting short scenes from a movie on YT, and possibly monetising? Is it just a case of the Studio not reacting or there's a grey area where you're able to do it?

Re: ‘Jackpotting’ Attacks Hit U.S. ATMs

#33

Post by Symbiote »

StudentStuff wrote: post #30
eikenberry wrote: post #25

I assume this will end with there being fewer ATMs. That they will become more expensive to run in due to costs of hardened physical devices and insurance. If they become too rare it could result in a reduction of cash usage, maybe significantly.

Good luck with that, outside of a handful of Nordic oddballs, cash is still king in most of the world (US included). We have a massive unbanked population that isn't going to start using banks or digital payments anytime soon, no matter what politicians or economists may desire.

If they don't have a bank account, presumably they also don't use ATMs.

Re: ‘Jackpotting’ Attacks Hit U.S. ATMs

#34

Post by rorykoehler »

StudentStuff wrote: post #30
eikenberry wrote: post #25

I assume this will end with there being fewer ATMs. That they will become more expensive to run in due to costs of hardened physical devices and insurance. If they become too rare it could result in a reduction of cash usage, maybe significantly.

Good luck with that, outside of a handful of Nordic oddballs, cash is still king in most of the world (US included). We have a massive unbanked population that isn't going to start using banks or digital payments anytime soon, no matter what politicians or economists may desire.

There is a huge push in SE Asia to get these people banked asap. Startups like Grab are leading the way. I don't think it will be long as much of the other low hanging fruit is already picked. This is literally one of the last untapped markets.

Re: ‘Jackpotting’ Attacks Hit U.S. ATMs

#35

Post by netsharc »

Simulacra wrote: post #18

It seems the ATM has not evolved very much over the past 20 years. Any ideas why?

Why should it? Its function is to spit out money and it functions well enough for that.

Obviously they do add features, like topping up phone credit or bill paying. But I would guess nowadays the bankers would rather pay smartphone app developers rather than the ATM developers...

Re: ‘Jackpotting’ Attacks Hit U.S. ATMs

#36

Post by sytelus »

The details:

The attackers typically use an endoscope so they can attach a cord to the computer and install malware. This makes ATM remotely controllable!

In previous Ploutus.D attacks, the ATM continuously dispensed at a rate of 40 bills every 23 seconds. Once the dispense cycle starts, the only way to stop it is to press cancel on the keypad. Otherwise, the machine is completely emptied of cash.

Jackpotting it is.

Re: ‘Jackpotting’ Attacks Hit U.S. ATMs

#37

Post by chrischen »

netsharc wrote: post #35
Simulacra wrote: post #18

It seems the ATM has not evolved very much over the past 20 years. Any ideas why?

Why should it? Its function is to spit out money and it functions well enough for that. Obviously they do add features, like topping up phone credit or bill paying. But I would guess nowadays the bankers would rather pay smartphone app developers rather than the ATM developers...

By that definition you can say it's doing it's job even better now!

Re: ‘Jackpotting’ Attacks Hit U.S. ATMs

#38

Post by ipince »

shaunpud wrote: post #32
p1mrx wrote: post #12

Wow, I always thought the ATM scene from Terminator 2 seemed unrealistic, but now people are literally doing that: https://www.youtube.com/watch?v=3cfQKxUffqA

How does it work with posting short scenes from a movie on YT, and possibly monetising? Is it just a case of the Studio not reacting or there's a grey area where you're able to do it?

The studio (content-owner) is who receives the proceeds of monetization, even if they didn't upload the video themselves.

Re: ‘Jackpotting’ Attacks Hit U.S. ATMs

#39

Post by smnscu »

shaunpud wrote: post #32
p1mrx wrote: post #12

Wow, I always thought the ATM scene from Terminator 2 seemed unrealistic, but now people are literally doing that: https://www.youtube.com/watch?v=3cfQKxUffqA

How does it work with posting short scenes from a movie on YT, and possibly monetising? Is it just a case of the Studio not reacting or there's a grey area where you're able to do it?

Perhaps not entirely applicable in this case, but check out this humorous but informative video on fair use https://www.youtube.com/watch?v=H5ZmVheuxpo

Re: ‘Jackpotting’ Attacks Hit U.S. ATMs

#40

Post by ZenoArrow »

p1mrx wrote: post #12

Wow, I always thought the ATM scene from Terminator 2 seemed unrealistic, but now people are literally doing that: https://www.youtube.com/watch?v=3cfQKxUffqA

That was possible in the 1990s:

https://www.theregister.co.uk/2005/10/21/phantoms_and_rogues...

I also remember seeing a report that was aired on UK TV by Channel 4 back in the 1990s that showed how easy ATM fraud was. I can't seem to find the clip, but if anyone has better luck than me I'd be interested to see it again. The only other clue I can think of was that I believe the report was presented by Krishnan Guru-Murthy, but I think it might have been on a different show than the Channel 4 News.

Post reply on HN