Researcher shows how to hack ATMs with "Dillinger" tool | VentureBeat

Barnaby Jack showed a live demonstration of how he hacked two different Windows CE-based ATMs on stage during a talk this afternoon at the Black Hat security conference in Las Vegas. Jack was scheduled to give the talk a year ago, but it was canceled after an ATM vendor objected to his then-employer, Juniper Networks. This year, Jack switched jobs to IOActive. The ease with which he hacked the machines should be a wake-up call for banks.

Jack showed how you could walk up to an ATM, break into it using a common universal key, and then use a universal serial bus (USB) stick to load a rootkit, or hacking software, that could compromise the machine’s security. On stage, he showed how he could run a program that could talk over the machines and get them to display “jackpot!” on the ATM screen and then spit out bills.

The User’s Manifesto: in defense of hacking, modding, and jailbreaking


There’s a trend that’s been disturbing me lately. When the topic of modding or jailbreaking comes up — say, in the wake of the iPad announcement, or Sony’s restrictive PS3 update — there is an outcry. Who am I to tell Apple what’s best for their devices? How can I in good conscience urge others to void their warranties or break license agreements? And why should anyone care when only a small proportion of people hack or jailbreak their devices?

These questions are natural, because a few years ago they wouldn’t even be possible. What reason would you have for breaking open an first-generation iPod, or hacking an original Playstation? The question of “unauthorized software” on System 9 and Windows XP was plainly moot. But as the capabilities of the PC, console, and phone have expanded, so have their magisteria. And as their power grew, so did their chains. These chains were so light before that we didn’t notice them, but now that they are not only visible but are beginning to truly encumber our devices, we must consider whether we are right to throw them off. The answer, to me at least, seems obvious: no company or person has the right to tell you that you may not do what you like with your own property.