Juniper postpones ATM hacking presentation

By Robert Westervelt | Jul 2, 2009

0 comments [1]

Facebook [2]

LinkedIn [3]

Digg [5]

[6]

[7]

Thumbnail: 

A Juniper Networks Inc. security researcher who planned to demonstrate a way to hack the software of an ATM at the Black Hat Briefings in Las Vegas had his presentation pulled at the request of the ATM vendor.

Barnaby Jack's"Jackpotting Automated Teller Machines," presentation, which was to take place on July 30, was pulled from the schedule on Monday. Juniper Networks confirmed the cancellation. In a statement the vendor said it received a request to pull the presentation from an ATM vendor.

"Juniper believes that Jack's research is important to be presented in a public forum in order to advance the state of security. However, the affected ATM vendor has expressed to us concern about publicly disclosing the research findings before its constituents were fully protected," Juniper said. "Considering the scope and possible exposure of this issue on other vendors, Juniper decided to postpone Jack's presentation until all affected vendors have sufficiently addressed the issues found in his research."

Jack would have demonstrated a way to attack the underlying software of a line of popular new model ATMs. The presentation would have addressed local and remote attack vectors and finished with a live demonstration on an unmodified stock ATM.

"We are reaching out to other ATM vendors with the offer to assist them with promptly and diligently addressing the security risks and vulnerabilities uncovered in Jack's research," Juniper said.

The hacking technique is unique. Traditional methods to bilk ATMs involve card skimmers or the physical theft of the ATM.

ATM makers have been under increased pressure to lock down their models after several high-profile attacks on machines. Last December, RBS WorldPay, the U.S.-based payment processing division of the Royal Bank of Scotland Group plc, disclosed a security breach in which hackers used millions of stolen cardholder data in a coordinated ATM scam, making off with $9 million. The thieves used stolen and cloned payroll debit cards and reloadable gift cards.

Malware was used in several ATM breaches in Eastern Europe. Earlier this month, security vendor Trustwave Corp. said its researchers uncovered the malware while investigating ATM breaches in Russia and Ukraine over the past few months. Trustwave said 20 ATMs were infected [8] with sophisticated malware that allowed attackers to not only steal and track data and PINs, but also cash. A specialized card could allow an attacker to bilk up to $600,000 on large ATMs.

0 comments [1]

Facebook [2]

LinkedIn [3]

Digg [5]

[6]

[7]