At the 2010 Black Hat conference, Barnaby Michael Douglas Jack, or better known as Barnaby Jack, gave a live presentation on stage about "jackpotting". This is exploits to ATMs to make them dispense cash without having the person in front of them to withdraw the money from a bank account using a bank card.
He showed how he could connect to an ATM via a telephone modem and, without using a password, withdraw all the machine’s cash.
"I've always liked the scene in Terminator 2 where John Connor walks up to an ATM, interfaces his Atari to the card reader and retrieves cash from the machine. I think I've got that kid beat," said Jack.
At the event, Jack gave demonstrations of different kinds of attacks that involved both physical access to the machines and completely automated remote attacks. On both, he injected malware to the machine's operating system in which he could dispense cash fraudulently on his will.
During the physical attack on an ATM, Jack demonstrated an attacker that takes advantage of having a physical access to the machine. The hacker can use a flash drive loaded with malware to gain unauthorized access to the machine. This would allow the hacker to control the dispensing mechanism.
During the remote attack, malware is installed onto the target system via exploited vulnerabilities in the remote management system (notably the use of default passwords and remote management TCP ports). The attacker then can execute the malware, prompting the target ATM to dispense a given amount of money.
His research started in 2008 when he bought two ATMs from the internet for $2,000 each, and had them delivered to his apartment in San Jose, California. For the next two years before the presentation, he analyzed their software codes, finding inherent weaknesses that would allow the machines to be controlled by unauthorized people. Eventually, he succeeded in bypassing the demands for passwords and serial numbers, and he was then able to access his ATMs remotely. He could then withdraw all the cash - a process that became known as "Jackpotting". During his research, he was also able to access information about bank accounts from the magnetic strips on bank and credit cards, and steal other ATM users' passwords.
"I demonstrated two different attacks. One was a walk-up attack, where I would literally walk up to an ATM, [and] within about two minutes it would just start spitting out its entire dispenser. Of course you had to be at the ATM for that one to work. The other attack was completely remote, so I could do it from a laptop in a hotel room or your bedroom... But I also had it harvesting people's credit cards and pin numbers, which I could then retrieve remotely as well. It was 100 per cent anonymous, and bypassing all authentication.”
Barnaby Jack was a New Zealand white hat hacker, programmer and computer security expert. He was best known for his ATM hacking presentation among other things like wireless hacking of insulin pumps. Jack died at the age of 35, a week before he was meant to give a presentation about hacking on heart implants at the Black Hat 2013 conference.
