Armed with exploits, ATM hacker hits the jackpot

absurd

WTF are you talking about?

The bad guys already know about this stuff, probably, and the ATM-vendors have basically taken a year to get the most fixes in place.

In the meantime, you (the customer) have been fronting all the losses, together with the losses incurred by ATM-card skimmers etc.

If there were no talks like the one mentioned in the article, vendors could still deny the existence of the problem!

Hold your horses, dude.

Better that the stuff is presented at Black Hat and fixed than used quietly round the world by real black hats, don't you think? It's a fine deal, really. Companies usually /pay/ for penetration testing, and these lucky folks got something useful without even asking. Would you call the police if a harmless, well-meaning person knocked on your door and politely informed you that the lock you use to keep your motorcycle chained to a post is flimsy and easily defeated with a tack hammer?

The guys who /tell/ you that kind of thing are not the ones you should worry about!

Do you think that your silly knee-jerk ideas about outlawing what these researchers did would do a damned thing to stop the people who would do such things to exploit them for profit? Are you just blissfully unaware of the multibillion-dollar underground trade of stolen bank credentials and such? If a real cybercriminal were reading your post, I wonder if he'd laugh or just smirk in quiet amusement at your misdirected, impotent wrath (while he pilfered your bank credentials via some security flaw whose very investigation you would like to be illegal.)

@ Wathend

"If I had a cheap lock on my door and a burglar broke in they would be guilty of break and enter"

Look at your insurance policy. You get a cheaper one if you tell your insurance people your door is locked with a five leaver lock, you have a burglar alarm, etc. Tell them you have a sign reminding the burglar its illegal and you leave your door ajar won't get you anything from the insurers.

Fine, the burglar will get prosecuted if caught, but he might not get caught. He might get caught and have already sold you TV for a bit of blow. You'll never get the money back.

If you can make a cash machine spew money from your neighbours wifi and have your mate walk past with a sack at the time, chances of getting caught and prosecuted are very low.

There's a reason for that

If they required longer PINs, people on average would be more likely to either write them down, or choose something easily guessable e.g. their phone number or date of birth.

@Payne

You're absolutely right that it's all about the money.

An $X loss is justifiable if it costs >$X to repair. But over time it generally makes sense to fix the leak. Considering that the banks haven't eliminating the biggest flaw in banking for several decades now, static CC numbers, it's readily apparent they don't think security is a priority.

Re: Banks never use...

You mean like that well-lighted booth outside the local supermarket that has "Bank of America" blaring from the light box on top and nothing but a pair of wall banks inside?

Sorry laddie, you're likely to lose on that one.

See, my IT work use to take me inside banks and I've seen the insides of the boxes they put those systems in. NT 4.0 at the time as it was "the only security certified networked os" at the time. All the standalone systems I've seen are just as secure, possibly more so since more people are likely to be in the area around the standalone machine.

(untitled)

I didn't NCR ATMs running on OS/2 are not supported anymore by NCR, and haven't been supported since 2000 (they wouldn't guarantee that they were year 2K compliant). I very much doubt whether any NCR ATMs in the UK are running OS/2 anymore.

The NCR Aptra machines are all windows based - Either running Win2K, Windows XP.

Did you tell them?

Did you/will you tell them that there is a bug in their software?

RE: Surely it's the banks' decision

> ... but surely it's up to the banks themselves what level of security they are comfortable with for their ATMs (or credit card systems)? They're the ones who take the loss

Well yes and no. If the banks alone took the loss then you'd be right. But, when there's a problem and the bank disagrees with the customer then they usually expect the customer top **prove** the bank is wrong against authoritative statements that the bank systems are **fully secure**. So if someone manages to hack an ATM so it gives them a load of cash but the machine says it came from your account - the bank will assume that you withdrew it or you gave someone the card and pin. How are you going to **prove** that their so called secure device isn't as secure as they claim ? Until you do, you won't get the missing money credited back to your account.