Posted by: Neal OFarrell on August 3, 2010
Ever used one of those stand-alone ATMs, the ones you’ll most often find in restaurants, supermarkets, or gas stations? I try to avoid them, not just because they can charge pretty hefty fees for even the smallest withdrawal, but honestly I’ve just never trusted them. After all, you have no idea who owns the ATM, who has access to it, or even who put it there. And you want to give it your ATM card and PIN?
Seems like you might be right to mistrust them. At a recent hacker conference in Las Vegas, a security expert explained how he figured out to make these ATMs spit out large amounts of cash, without you having to swipe your ATM card first.
The hacker figured out three of the best kept secrets of these ATMs – that someone has to access these ATMs (to refill with cash, for example) and that requires a physical key; all the ATMs used by one manufacturer use the same or similar keys; and copies of those keys are readily available on the black market.
To prove his point, he simply ordered three of these ATMs and had them delivered to his apartment. Not only did he confirm that all three used similar keys, each also had a USB port that allowed him to upload a program that would instruct the ATM to cough up all its dough – and give him a copy of all the ATM cards and PINS recorded by the machine.
Which means if you ever use one of these ATMs, you could be making it very easy for a thief to gain not only access to your ATM card and PIN, but through those directly to your bank account.
Lessons learned?
RELATED STORY: Bunker-busting ATM attacks show security holes
http://finance.yahoo.com/news/Bunkerbusting-ATM-attacks-apf-439535708.html?x=0
Related posts:
IDGuardian reserves the right to remove any comments it deems to be offensive