Secrets have a habit of becoming non secrets

[Duke_Nukem]

Never rely on a secret for your security or at least one you never change

As charged, the caper is an unusually successful example of a low-tech ATM hack that’s been used for minor pilfering in the past, and a reminder of the security weaknesses that have troubled kiosk ATMs. Vulnerabilities in the most popular machines made by Tranax Technologies and Trident were showcased in a now-legendary “ATM jackpotting” demonstration delivered by security researcher Barnaby Jack at the Black Hat conference in 2010. Jack (who died last year) showed that the Tranax machines could be hacked into and reprogrammed remotely over dial-up, and the Trident ATMs could be physically opened and then reprogrammed through a USB port. The companies responded to Jacks’ research by closing those holes.

But at the street level, criminals have exploited a simpler vulnerability that requires no hacking software or gear: Unlike the machines deployed at brick-and-mortar bank locations, kiosk ATMs could be placed into a privileged “operator mode” simply by pressing a special sequence of buttons on the ATM keypad.

From that mode, you could manipulate a number of variables—one of which sets the denomination of the bills loaded into the machine’s currency cartridges.

A supposedly secret six-digit numeric password protects the Operator Mode, but in the Nashville case, one of the defendants, Fattah, was a former employee of the company that operated the machines, says the Secret Service’s Mays, so he knew the code.

Two Dudes Prove How Easy It Is to Hack ATMs for Free Cash

I so wish I could find my ‘Stupid ATM Scams’ photos from my ‘security’ days as some of them were unbelievable.

[ianlee74]

You’ve got to keep your eye on those Nashville hackers