There is a story circulating about an apparent ATM Hack. This is not a remote hack, but rather one where the culprit is using an admin interface to reprogram the ATM. This allows the thief to reprogram the ATM into thinking that it has all 5 dollar bills instead of 20 dollar bills. That’s a nice payout! The theft occurred at an ATM in Virginia Beach, Virginia. The hacker also left it in this mode so that others also “benefitted” from his handy work – for 9 days! Apparently, the ATM in question is a Tranax 1500 series, as pictured above. The main issue here is an issue you find frequently with other electronic appliances – people keep default admin login credentials.

Dave Goldsmith, of Matasano security, set out to find if this story was true. Certainly this couldn’t be the case. He found the following information from Tranax’s site: “The ATM is programmed with the passwords that the distributor requests when the order is placed to program a new ATM. When special passwords are not requested they are left at the factory default (see your mini-bank operators manual) Every new ATM that is shipped from Tranax has a copy of the print setup included in the ‘open me first’ box or envelope. The master password is hand written at the top of the print setup for the convienence of the installer.” So, in essence, if they didn’t request a special password, it comes with the default. Goldsmith then set out to see if he could legally obtain the manual to get the code to enter the diagnostic mode. In fifteen minutes, he had the manual. If this can happen on an ATM appliance, how many other appliances can this happen on? You might be scared silly to know that answer!

Source: Wired, Matasano blog

[tags]ATM hack, Tranax ATM Hack, ATM security[/tags]

Related Posts:

• No Related Posts