Hacking ATMs (week 7)

In 2014, two ninth-grade boys, Matthew Hewlett and Caleb Turon, discovered an online operators manual for an ATM. During their lunch hour, they decided to try using this information at an ATM at a Bank of Montreal ATM. The entered the ATM in to ‘operator mode’ which displayed sensitive information such as customer charges, cash available, and the transaction history. The ATM was password protected, but the boys were able to find the correct code based on information in the manual. At this point, the boys realized that this situation looked incriminating and they reported their findings to the bank. (Lyne, 2014)

When they reported the breach, the bank employees did not believe them. The boys then performed a live demonstration. When interviewed about the event, the boys said “I started printing off documentation like how much money is in the machine, how many withdrawals have happened today, how much it’s made off surcharges. Then I found a way to change the surcharge amount, so I changed it to one cent.” The boys also changed the ATM’s welcome message to say “Go away. This ATM has been hacked”. (Lyne, 2014)

This is not the first attack against ATMs and it is not the last. There is a new method of hacking ATMs called ‘jackpotting’. It is called jackpotting due to the attack resulting in the ATM ‘spitting cash like a winning slot machine’. The most common target is Diebold Nixdorf ATMs which are the stand-alone models at drive-throughs or pharmacies. It has also been reported that ATMs have been remotely infected or had their hard drives completely swapped out. At the 2010 Black Hat Convention, researchers brought two infected machines on stage. One machine immediately sent their personal information and credit card info to a separate machine. The second machine was given a command and then displayed a flashing ‘Jackpot!!’ on the screen before spitting out money. (Selk)

References

Lyne, J. (2014, June 11). 14 Year Olds Hack ATM in Lunch Hour - How it Happened. Retrieved from Forbes: https://www.forbes.com/sites/jameslyne/2014/06/11/14-year-olds-hack-atm-in-lunch-hour-how-it-happened/#254513874dff

Selk, A. (n.d.). Hackers are making U.S. ATMs spit out cash like slot machines. Retrieved from The Washington Post: https://www.washingtonpost.com/news/business/wp/2018/01/27/hackers-are-making-u-s-atms-spit-out-cash-like-slot-machines-report-warns/?noredirect=on&utm_term=.09ca9778dc46