Hacking an ATM

http://henryschwarz.blogspot.co.uk/2012/06/black-hatted.html

by rlpb • 14 years ago

203 45 14 years ago

henryschwarz.blogspot.co.uk

Its not very nice that the author turns a 'security researcher' (his words) who is effectively helping (if not actually doing) the authors job for him into a pantomime villain.

[edit: I do get that they became 'friends', which gives some levity to these descriptions, but it still strikes me as casting aspersions not just on the individual but more generally on the way he and others like choose to work]

Lewton2• 14 years ago

It's a joke. He later on describes how they've become friends.

robk• 14 years ago

Then he mentions booing him at an event at the bottom. Friends seems to be loosely meant.

exDM69• 14 years ago

If you read it all the way down, the author reveals that he befriended the hacker and was very grateful for helping and co-operating with the fix. The villain part in the beginning was just joking, although I did not particularly enjoy that style of writing either.

Fuzzwah• 14 years ago

You're almost on your way to an understanding of general idea of Australian "mateship".

If we weren't sarcastically nasty to our friends we might have to talk about emotions to convey our mutual trust and affection with other blokes.

andyjohnson02• 14 years ago

Its worth noting that the events described occurred in 2010.

joelhaasnoot• 14 years ago

Can't find a full length video of the presentation anymore online. Anyone else find a copy of the presentaton?

andyjohnson02• 14 years ago

I don't know about full-length, but there are some >10min videos on youtube. http://www.youtube.com/results?search_query=Black+Hat+2010+b...

dfc3• 14 years ago

"Note to our salespeople: for security purposes, please make it more difficult to purchase our product."

This guy still does not get it...

ssdsa• 14 years ago

I'm sure this was meant as a joke.

dfc3• 14 years ago

Really? For more context here is the entire paragraph:

"Barnaby chose my company's ATM arbitrarily, it was just the most conveniently available to purchase on the web and be delivered to his home. Note to our salespeople: for security purposes, please make it more difficult to purchase our product."

darklajid2• 14 years ago

I couldn't bear reading that article.

The story could've been good, but the style of writing is neither witty nor clever and when I arrived at reserved seats in the front row at Black Hat I closed the tab with a quick sigh of relief afterwards. Horrible.

smcl• 14 years ago

Agreed, after about six paragraphs he dials it down slightly but there's still a lot of text which I found painful to read.

etherealG• 14 years ago

I would estimate that a security coder for an atm doesn't cross over with a good writing style very often. Doesn't mean it wasn't worth the read!

arthurgibson• 14 years ago

Has HN turned into a literary club? Despite trying to make it a spy novel, I thought this article was one of the better stories read on HN.

Fando• 14 years ago

I agree, aside from being interesting, this was a well written story. What's everyone's problem with the writing style? You have to be kidding me.

tptacek3• 14 years ago

I liked it a lot too, and, obviously, I'm on Barnaby Jack's side of the vulnerability research fence, not the ATM vendor's. I even thought the style was amusing.

gravitronic2• 14 years ago

Typically the vendor side of a publicized security exploit never releases details to this extent, ESPECIALLY in the financial sector. It's a very interesting perspective to get to read in detail.

darklajid2• 14 years ago

Obviously my statement was purely subjective (style of writing).

That said: What details did you take away from the article? I'm serious. I just went back and skimmed the rest. It seems this is really a long version of 'someone found an exploit, we fixed it, he presented it in public and we handled the aftermath'. No details at all. The most technical bit was the 'Now we're so much more secure by requiring signed code', and that was it?

splatzone• 14 years ago

Excruciating, hammy read - wish he'd tone down the dramatic prose and just give us the info.

pferdefleisch• 14 years ago

I really enjoyed the hamminess. I found it a pleasure to read.

edkennedy• 14 years ago

Agreed, and I found it quite opposed to the stiff boring technical read it could of been. Which I believe was the exact point the author was trying to make at the end of his story.

nollidge• 14 years ago

I thought it was delightful.

adnam• 14 years ago

Here's the video of Barnaby Jack hacking ATM at the Black Hat conference in Las Vegas, July 2010: http://www.youtube.com/watch?v=qwMuMSPW3bU

merlish• 14 years ago

Found this article quite amusing. I'm not sure why so many people are getting turned off by it.

epaga• 14 years ago

Just wanted to chip in that I thought the article was a great read, informative, and the author's self-deprecating sarcasm was very refreshing. Much preferred to extremely dry and technical stuff.

GigabyteCoin• 14 years ago

I remember watching barnaby's video when it first came online in 2010 and was wowed like the live crowd.

Thank you for such a detailed follow up.

follower• 14 years ago

FWIW Barnaby Jack (or a reasonable facsimile of him) links to this article with the comment "the right way to respond to security vulns...". (http://twitter.com/barnaby_jack/status/210052884497313793)

tptacek3• 14 years ago

Some backstory that isn't in this article: Barnaby Jack (who goes all the way back to the original eEye research team in the last '90s early '00s) did this ATM research while working as a researcher for Juniper Networks. I believe the original vendor he targeted was Tranax; they make the crappy free-standing ATMs you see in bodegas†.

Jack notified the vendor and (obviously) got his talk accepted and announced at Black Hat. The vendor complained to Juniper, and Juniper had the talk pulled††. Jack left Juniper for IOActive and gave the talk the following year. Last time I checked, I believe he was at McAfee.

† Funny thing about Tranax: they managed to let Google crawl their maintenance manual a couple years ago, and the manual had their default maintenance code in it; a huge number of ATMs were found to be running with that default password, which allowed people to re-denominate the bills in the machine.

†† This was probably a reasonable call, because Juniper has billions of dollars to lose to a negligence suit brought by an ATM company.

MiguelHudnandez2• 14 years ago

> [My company's ATM] was just the most conveniently available to purchase on the web and be delivered to his home. Note to our salespeople: for security purposes, please make it more difficult to purchase our product.

In this sentence, the author mistakes obscurity for security.

waqf• 14 years ago

In this comment, the author mistakes irony for idiocy.

MiguelHudnandez2• 14 years ago

I beg your pardon. It seemed to me like the author dropped the sarcasm near the beginning of the write up and he actually thought denying individuals access to the equipment would make it more secure.

JabavuAdams• 14 years ago

Well-executed humble-brag marketing.

Hacking an ATM

Related Stories