Two Arrested For Reprogramming ATMs To Provide Extra Cash

from the this-is-still-doable? dept

Almost exactly two years ago, a story made the rounds of how easy it was to reprogram ATMs to believe it had a different denomination. Thus, if it actually had $20 bills, you could convince it that it really had $1 or $5 bills. Then when you took out money from the machine, you would get the $20 bills, making a tidy profit. The reason this hack was so easy was that many ATM owners simply left the default passwords on the machines -- and those passwords were easily found online. Last year, we noted that, despite the publicity around this easy hack, many ATM owners still had not changed the default password. Apparently, that's still the case, as two men have been arrested for using the hack to steal thousands of dollars. Still, it's worth noting that the only reason they seem to have been caught was they hit the same store multiple times (and, apparently, the owner of that store still hadn't changed the default password).

Filed Under: atms, security, theft

ATMs Aren't So Secure Either

from the transparency dept

Back in March, I responded to the common argument that since automatic teller machines are widely used and seem to be secure, secure electronic voting must be doable as well. I pointed out a couple of problems with this argument, but I took as a given that ATM machines are in fact, secure. But Matt Blaze recently discovered that ATMs aren't that secure either. When Blaze tried to withdraw cash from a Philadelphia cash machine, he encountered a bunch of problems. The information on the screen was screwed up, the machine gave him $10 more than he'd requested, and the machine failed to give him his receipt. Even more worrisome, when he went into the bank to suggest that they check out the machine and see what might have been wrong with it, the assistant manager actually argued with him, assuring him that the machine was working just fine and Blaze must be imagining things. Incredibly, when he tried to show her a screenshot he had taken with his cell phone, she cut him off by pointing out that photography isn't allowed in the bank.

Obviously, part of the problem here is a bank employee who has a bad attitude. But it also illustrates a couple of additional problems with the "ATMs work so why can't e-voting?" argument. First, people have a habit of trusting machines more than people. When elections are conducted with pencil and paper, everyone understands that some of the human beings might have hidden agendas and need to be watched closely. In contrast, people tend to assume that machines are completely objective and unbiased, and so they're less likely to notice problems with machines even when (as in the case of this bank manager) the evidence is staring them in the face. Second, if it turns out that the ATM screwed up, Blaze will at some point get a statement from his bank telling him how much money the bank thinks he withdrew, and he can object if it differs from what he actually got. There isn't (and due to voter privacy concerns, can't be) a similar process for e-voting. If a paperless voting machine screws up, there's no way to double-check the results after the fact.

Filed Under: atms, reliability, security, verification