JACK: Hey, what’s up? DADE: Not much, just reading.
JACK: Cool. What are you reading? DADE: I’m reading Exploding the Phone.
It’s about phone phreaking, kind of the history of it.
JACK: Sounds interesting. DADE: Yeah.
JACK: This is Dade. That’s not his real name; that’s just his online name. I met him at a BSides
conference once and was just really impressed with his knowledge of security and hacking.
So I’d chat him up sometimes and ask him questions on things that I’m researching. Hey,
I’m calling ‘cause I want – I’m trying to think. Are there any old movies that have like a hacker
getting into an ATM and dispensing cash? DADE: Yeah, so there’s a couple. It’s kind of a
trope in hacking movies, most prominently I think in Hackers. They’re all sitting around
the table at Cyberdelia and Joey’s really trying to get all of his friends’ attention.
He’s talking about how he hacked this bank. JOEY: Right? Okay wait, okay, so it’s a bank. So
this morning, look at the paper. Some cash machine in Bumsville, Idaho spits out $700
into the middle of the street. CEREAL: That’s kind of cool.
JOEY: That was me. That was me. I did that. DADE: Then Joey takes credit for it
and he’s really bragging. JACK: Wait, wait, hold on. How do you know
this much about that one scene in Hackers? DADE: I watched it a lot. I picked my
hacker handle because of that movie. It’s what inspired me
to get into computers in the first place. JACK: Do you know every scene of Hackers?
DADE: I know almost every scene of Hackers. I can find myself quoting
it unintentionally quite frequently. JACK: That’s impressive. That’s really crazy.
Alright, so what year was Hackers? DADE: That was 1995. There was actually a couple
of ATM hacks before that as well. In 1985 a movie called Prime Risk was basically all about finding
out ways to rip off ATM machines. TONI: Got over twenty frequency
codes today. LEE: What is that?
TONI: It’s a spectrum analyzer. It reads the electromagnetic environment and creates magnitude
readings for the proper frequencies. LEE: Oh. What are you doing with it in your
car? TONI: Well,
it’s just an experiment for now but if we’re lucky we should be able to
pick up oh, $200 from each account. LEE: You know you can get into a lot of trouble
fooling around with the banks. TONI: Would you relax?
LEE: I’m relaxed. You’re talking about ripping people off.
TONI: Look, it’s a banking system. We aren’t stealing from people.
DADE: Then again in 1991 a young John Connor in Terminator 2 hooks up his little laptop
into the card reader slot of an ATM. JOHN: [BEEPS] Please insert your stolen card
now. DADE:
He hits a couple buttons. Some Hollywood hacking appears on screen, you know, numbers flying down
the screen, changing really fast. JOHN: Go baby, go baby, go baby. Alright.
Pin number… DADE: Eventually he’s cracked the pin.
JOHN: Withdraw 3-0-0 bucks. Come on baby, come on, come on. Yes!
TIM: Hey, it worked. JOHN: Easy money.
JACK: Huh. Alright. So if Hollywood is doing this in the 80s and 90s
I think I’m gonna look into where we are with ATM hacking today and do an episode on that.
DADE: Yeah, that sounds great. JACK: Alright, this information has been
great. Thanks so much. DADE: Yeah, no problem.
Thanks for reaching out. JACK: Alright, see you later.
DADE: Hack the planet. JACK (INTRO): [INTRO MUSIC]
These are true stories from the dark side of the internet.
I’m Jack Rhysider. This is Darknet Diaries. [INTRO
MUSIC ENDS] JACK: ATMs are an obvious target for criminals.
It’s just a hunk of metal holding a bunch of cash. There can be anywhere from $3,000 all the way up
to $250,000 in each ATM. Getting into one of these could be a big win for someone. At its core an ATM
is just a computer, often a Windows computer with an input device like a touch screen or buttons.
Then there’s the cassettes that hold the cash. The cassettes are the crown jewels of the ATM since
they hold all the money. One tactic is to steal the cassettes. [MUSIC] Smash and grab is still a
common ATM hacking technique. This is a simple as smashing a window of the store, running in,
grabbing the whole ATM, drag it outside, throw it in your truck, and drive off.
To defend against this shop owners and banks have securely fastened the ATM to the ground,
often with huge bolts right into the concrete.
But criminals will still smash the window, throw a rope around the ATM, attach it to their truck and
pull it out with the truck to knock it loose and then grab the whole ATM and drive off.
But then there are ATMs built right into the walls of the bank where you can’t knock it over
or pull it loose. What some criminals do here is they’ll run up to it, create a hole in the
ATM [00:05:00] somehow like jamming a crowbar right into it or under it, and then they’ll
load up that hole with explosives and blow up the ATM itself. Usually the cash box that holds
the money is knocked loose from the explosion and a thief can run off with just that box of money.
But all these techniques are messy and very destructive. There’s even one video of a guy
driving a forklift right through a convenience store window, knocking over all the shelves,
and making a ton of damage just to get the ATM loose and out of there.
It’s shocking and there’s just much more elegant ways of stealing money out of an ATM.
A little over a decade ago, a story came out that said a master admin password was
configured for many ATMs. Some thieves got ahold of this password and used it to access the ATM.
However, the admin access didn’t let them dispense money so they couldn’t just steal the money.
The hackers poked around at what they had access to. Inside the ATM are a number of cassettes with
different denominations. Maybe there are three cassettes with $5 bills, $10 bills, and $20
bills. With admin access you could assign which cassette was which denomination. The hackers told
the ATMs that all the cassettes have just $1 bills in them. When they went to withdraw $20, it gave
them twenty $20 bills. Their balance only went down by twenty bucks but they actually got $400.
These criminals did this a few times and got a whopping $1,540 from this attack.
The admin password has since been fixed and that attack is no longer valid.
Around 2009 a security researcher named Barnaby Jack was interested in seeing what kind of hacks
he could do on ATMs. He bought a few and had them delivered to his house.
BARNABY: I remember when one of the ATM delivery guys came in. He wheeled the
ATM into my place and he’s just like why on earth do you need an ATM in your house for?
[LAUGHTER] I was feeling a bit cheeky that day so I just looked at him and was like oh, I just don’t
like the transaction fees, mate. [LAUGHTER] JACK: This is Barnaby Jack speaking at Defcon 18,
the largest hacker convention in the world. Once he got the ATMs into his house he took
them apart and analyzed how they worked. [MUSIC] He started looking for vulnerabilities in the ATM
he had. He found the ATM had two different keys; one key opens a door to the cassettes
where the cash is but these were high-security keys and each ATM had a different key. But there
was another key which opened up the cabinet. The cabinet holds the computer that controls the ATM.
He found a serious problem with this key. BARNABY: One key will open all the models from
that same manufacturer, the cabinet. JACK: Yeah, that’s right. One key opens the
ATM up for all ATMs that that manufacturer makes. This only gave you access to the
motherboard in the ATM, not the cash. But Barnaby Jack being a security researcher,
he tried to figure out how he could attack the motherboard to dispense cash. Sure enough,
he found a way. He was able to load a custom firmware onto a USB flash drive. Now that he
has access to the motherboard he can plug that USB drive into the motherboard, reboot the ATM,
and it would load his custom firmware. This firmware pretty much let him do anything.
BARNABY: I placed hooks at the card reader, the pin pad, and the parts of the handles
the remote configuration commands. With those hooks we can add some fairly handy features,
save the track data, capture the pin pads, and a few customer commands. The track data remotely
saw remote jackpot and might as well. JACK: With the USB drive plugged into the
motherboard and new firmware installed, he closed up the lid and the ATM looked and operated just
like normal except he had programmed a hidden menu to let him control it however he wanted.
He could read and store any cards that were swiped on that machine and the pins that were entered.
The most astonishing thing he could do was dispense all of the cash from all
the cassettes which he called jackpotting. He demonstrated how he could do this live,
right there on the stage at Defcon 18. BARNABY: [BEEPING] Okay so it pops up my
hidden menu there. It will let me dispense fifty notes from A, B, C,
or D which are the four cassettes on the ATM. Let’s just try dump fifty bills from the first
cassette. [MUSIC] [LAUGHING, APPLAUSE] JACK:
This is unbelievable. I was there for that and I’m still blown away by how crazy this
was to see this live on stage. It just blew my mind. But physical attacks on ATMs might seem a
little too risky. I mean, you’ve gotta actually go there and lift the cover up to get into it.
There may be cameras watching you, too. But ATMs are sometimes found in gas stations or bars
and they’re often tucked away, sometimes hidden like by the bathrooms or cigarette machine.
And we give people privacy when they’re using the ATMs so it’s entirely possible to do this
in broad daylight and nobody would notice. [MUSIC] But Barnaby wanted to take this a step
further and see if he could figure out a way to gain remote access to an ATM over the network. He
plugged in the ATMs to his home network and began trying to see what he could get into.
Well, there was a remote login to the ATM but it had a username and password.
But Barnaby found a [00:10:00] vulnerability in the software to let him bypass that authentication
altogether, allowing him to get right into the ATM. From there he couldn’t do much
other than check the system, see how much cash was there, and basic troubleshooting.
No way to actually dispense cash, but Barnaby had already made a custom firmware that could give him
extra access. He was able to connect all these exploits together which allowed him to…
BARNABY: Upload rootkit. That’s not a bad feature; bypasses authentication,
initiates the software upload which lets me replace the firmware so, awesome.
JACK: Awesome it was. Barnaby could now remote-control an ATM with his
own custom firmware that allowed him to do whatever he’d want such as dispensing cash
out of an ATM on the other side of the world without even touching it. [MUSIC, LAUGHING]
Again, unbelievable. The research that Barnaby Jack did with ATMs was just amazing. He didn’t
stop there. He had a passion for finding vulnerabilities in embedded devices. There are
electronic imbedded devices in so many products we interact with, devices like a washing machine,
your thermostat, a refrigerator, dishwasher, your phone, video games, printers, and medical devices.
After Barnaby demonstrated to the world how you can hack into ATMs live on stage at Defcon,
he turned to researching the electronics within medical devices. He found that he
could gain remote access to insulin pumps that were actually strapped onto people
and worn about. On stage at the RSA convention in 2012 he demonstrated what he found.
BARNABY: From a hundred meters away I can scan for any insulin pumps in the vicinity. I will return
those insulin pump IDs and then I can have them dispense their entire 300 units of insulin which
for a Type 1 diabetic, will easily prove fatal. JACK: This guy really wasn’t messing around. I
mean, first robbing banks, now killing people? The point he was trying to make is that medical device
manufacturers really need to take security a lot more seriously than they already were.
BARNABY: I’m trying to go as public with this research as I can just to show how easily these
pumps can actually be attacked and hopefully change the mind of the FDA and of Medtronic,
and of the public that maybe a recall could be in order.
JACK: Barnaby then began looking to see if he could remote-control a pacemaker.
This is a device used to keep your heart beating regularly. Sure enough, he figured out a way in.
See, Barnaby was an amazingly good security researcher. He had a keen ability to find
weaknesses and security holes in so many systems. When he found a way to remote-control a pacemaker
implanted into a human, he took his findings on the road to a security conference in Melbourne,
Australia. He demonstrated this hack live on stage to show how someone could send a lethal shock to
a human through hacking a pacemaker. This news of this vulnerability, again, was a big deal.
Barnaby refined his demonstrations and was accepted to speak at Black Hat, the security
conference in Las Vegas to demonstrate this medical device hacking live on stage.
But he never did give that talk because he died a week before the conference. His girlfriend found
him lying on the floor in their San Francisco apartment. [MUSIC] The coroner examined his
body and ruled that the cause of death was an overdose of drugs. He was thirty-five years old.
Barnaby had a lot of talent and potential
and opened our eyes to a lot of things. Losing him was a tragedy and he will be missed immensely.
Alright, so if you could start out by telling me your name and what do you do.
JORNT: My name is Jornt v.d. Wiel. I’m a security researcher within the Kaspersky Lab.
JACK: [BACKGROUND CONV.] Kaspersky Lab is based in Moscow, Russia and makes antivirus software
amongst many other things. They need to keep their finger on the pulse of what the security
threats are in the world so they can develop ways to detect and defend against these threats.
Okay, so Jornt, what were you saying after Barnaby Jack demonstrated how to hack into ATMs?
JORNT: Yeah, so he introduced it and he showed that it was possible. What we saw after that
was people started copying him, [MUSIC] especially in Russia and the surrounding countries.
JACK: Surely Barnaby Jack wasn’t the first person to have figured out how to hack an ATM. But he was
the first to demonstrate it live on stage. After he did demonstrate it, banks and ATM vendors did
improve the security of their machines but ATM hacking started gaining in popularity after the
talk. There was an ATM hack in particular that Jornt will always remember.
JORNT: Yeah, it’s one of our colleagues. He got a call or an
e-mail from somebody that he knew. JACK: It was an e-mail. It was from an
IT guy working at a bank in Ukraine. JORNT: He told us that he had a problem and
he didn’t really want to disclose what it was. He said that you guys just have to come.
JACK: Jornt and his team were like well, going to Kiev is far and it’s not easy to get to. Just
tell us what the problem is. We’ve probably seen it before and we’ll just tell you how to fix it.
But the bank was insistent on telling [00:15:00] them they must fly to Ukraine to see the problem
themselves. Jornt and his team hopped on a plane and flew to Kiev to visit this bank.
[MUSIC] They took him into a room which had all the surveillance footage for the bank.
JORNT: We went there and then they showed us video footage.
JACK: Okay, so the scene in the video is this; there’s a bank with ATMs. Okay,
but it’s three a.m. so the bank is closed. The ATMs are in this little
foyer lobby something of the bank. JORNT: Like a portal, kind of.
JACK: Yeah, but the doors are locked so you have to swipe your debit card on the door in order to
get into that portal to use the ATMs. But you can’t get into the rest of the bank. Jornt
watches this video footage. JORNT: In the video you see a
guy walking towards the bank. JACK: This guy is wearing a big black hoodie,
he’s got a long scarf but he wraps it around his face so you can’t see what he looks like,
and he’s holding a big black duffel bag. He opens up his jacket, takes out his debit card,
and swipes it on the doors, which lets him into the lobby where the ATMs are.
JORNT: As soon as he got in the ATMs started to blink. He walked towards the first ATM and
then this whole pack of money came out. JACK: Literally the moment he enters the lobby
the ATMs suddenly start spitting out all kinds of cash in all of the cassettes. He didn’t even
touch a single button on the ATM. JORNT: Then the money just kept on coming
out so he just kept on filling his sports bag. Then he went to the next ATM and to
the next one, and to the next one. JACK: There were four ATMs in this lobby
and all four of them are blinking wildly and they’re spewing out thousands of Hryvnia, the
Ukrainian money. As fast as they’re popping out of the ATM, this guy is shoving them into
his duffel bag. The operation seemed very precise and was done very quick.
JORNT: When all four ATMs were empty he left and without even
touching the ATMs he was able to rob them. JACK: The bank said there was around $250,000 in
each of the ATMs he just stole from which meant he took about a million US dollars in just a few
minutes, [MUSIC] somehow magically emptying all the ATMs without even touching them. This isn’t
a hack; this is a superpower of some kind. Forget about the team at Kaspersky to solve this. You
need Batman or someone on this one. JORNT: Yeah but come on, it’s not
something that is… JACK: Hollywood movie magic?
But seriously, no matter how weird a hack may seem there is always an explanation for it.
Jornt and his team began trying to think of what this could be.
JORNT: First we thought that this was a modified version of another malware that we already knew
about that was called Toucan. JACK: Yeah, Toucan is pretty slick.
It first requires hackers to remotely access the ATM over the network.
JORNT: For your information an ATM is just a computer running Windows so it’s possible
to install malware on it. JACK: Once a hacker gets into the
ATM over the network they plant this Toucan malware on it.
JORNT: This malware, it was active between twelve o’clock and three o’clock in the night. When you
entered a special code… JACK: This is a special code
you just put right on the pin pad of the ATM, then you get access to the Trojans
menu. From here you can see how many cassettes there are and how many bills are in each one.
Then there’s a little special code at the bottom of the screen which is called a challenge.
JORNT: Then you get the challenge. You send it to your boss and he calculates
response. You enter the response. JACK: Whoever is at the ATM sends this code back
to the hacker and then they generate another code so that you enter it back into the ATM.
JORNT: Then you basically get into the god-mode menu because you can choose
from which cassettes you want the money. JACK: Then you literally get to say ‘give me the
money from cassette one’ and money just comes right out. It’s a pretty slick attack and it
works really well when set up correctly. JORNT: Back at the time it was one of the first
ATM malware versions that was there, you know? Now there are dozens, way more, but back then
it was one of the first. Because of the modus operandi, you enter in the middle of the night.
We thought that this was a modified version so we asked the bank for hard disks of the
ATM so we could search for malware. JACK: Jornt took these disks back to the lab
and investigated them thoroughly. JORNT: We couldn’t find anything.
JACK: [MUSIC] The trail went cold. Jornt was stumped. He had absolutely no clue how this
attack happened. There was no sign of any malware or suspicious activity on the ATMs.
How could this be? Months go by; no progress.
Jornt just stopped investigating, thinking it was just some really weird anomaly. Maybe magic,
who knows. But then out of nowhere… JORNT: We got a call
from one of an account manager. JACK: But this wasn’t an ordinary
call. The account manager was calling him at three a.m.
JORNT: It was in the middle of the night and the guy just said that
we have to call this number. We were like man, it’s in the middle
of the night. We’re sleeping. JACK: Jornt was like can’t you just tell
me what this is for? But the account manager was insistent that he just call this number.
Jornt and a few of his colleagues [00:20:00] got out of bed, splashed some water on their face to
wake up a little, and called the number.