Googling for ATM Master Passwords

Using clues obtained from a YouTube video and a simple four-word search engine query, a criminal can find step-by-step instructions on how to hack into and take control of thousands of cash-dispensing ATMs.

Using clues obtained from a YouTube video and a simple four-word Google search engine query, a criminal can find step-by-step instructions for how to hack into and take control of thousands of ATMs scattered around the United States.

Following up on a CNN report out of Virginia Beach, Va., here as a YouTube video, that a man reprogrammed an ATM at a gas station to dispense $20 bills instead of $5 bills, a New York-based security researcher did some old-fashioned online sleuthing and discovered that the operator manual for that specific model of ATM could be legally obtained in about 15 minutes.

Dave Goldsmith, founder and president of penetration testing outfit Matasano Security, in New York, did not say how he obtained the operator manual—which contains master passwords and other sensitive security information about the cash-dispensing machines—but an eWEEK investigation shows that a simple Google query will return a 102-page PDF file that provides a road map to the hack.

Goldsmith, a respected researcher who co-founded @Stake and previously led Symantecs Security Academy, said he traced clues from the video to identify the make and model of the ATM, a Tranax Mini-Bank 1500 Series, and started an experiment to see how easy it would be to legally obtain an operator manual.

In an interview with eWEEK, Goldsmith said he first dug around on Tranax Technologies Web site and found a knowledge base article that mentioned that the ATM is programmed with passwords that can be found in the operators manual.

"If you get your hand on this manual, you can basically reconfigure the ATM if the default password was not changed. My guess is that most of these mini-bank terminals are sitting around with default passwords untouched," Goldsmith said.

Resource Library:

For advice on how to secure your network and applications, as well as the latest security news, visit Ziff Davis Internets Security IT Hub.

Officials at Tranax did not respond to eWEEK requests for comment. According to a note on the companys Web site, Tranax has shipped 70,000 ATMs, self-service terminals and transactional kiosks around the country. The majority of those shipments are of the flagship Mini-Bank 1500 machine that was rigged in the Virginia Beach heist.

In the operator manual freely available on the Web site of a Canadian reseller, a section titled "Programming" provides the specific key sequence that will pop up a screen on the ATM that asks for the master password. It then lists three default passwords—master, service and operator—that could be used to hijack and possibly rig a machine.

The manual also contains instructions on how to enter the diagnostic mode, how to program the ATMs number keys to spit out cash withdrawals and how to change the passwords to take future ownership of the machine.

"This isnt a vulnerability," Goldsmith explained. "Its someone exploiting a policy weakness, where ATM owners install these things and never change the default password."

Thieves steal $700,000 by hacking ATMs. Click here to read more.

"If you maintain one of these devices, make sure that you are not using the default password. If you are, change it immediately," Goldsmith wrote in a blog entry that details some of his findings.

A section of the manual titled "Transaction Setup" provides a walk-through of how to configure the ATM to dispense cash and set up the cassettes within the machine that stores the cash.

According to Tranax, the Mini-Bank 1500 can dispense a maximum of 40 notes per transaction, limiting a criminals withdrawal at a single machine and using a single card.

However, as Goldsmith noted, a criminal with access to machines with default passwords could launch a major crime spree.

It is also likely that operator manuals for other ATM brands are readily available, Goldsmith said.

A quick Google search for several other mini-ATM machine models also produced user manuals with default passwords, although some require that the attacker have physical access to the power settings on the machine.

The episode underscores how easy it is to use the power of search engines to find sensitive security information. In the past, Google queries have been used to find security flaws in Web-facing applications, default passwords in Oracle databases and even live malware samples seeded on forums and other malicious sites.

Check out eWEEK.coms for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzers Weblog.

Reader Comments: Googling for ATM Master Passwords >>> Post your comment now! my pass word 6220180091400098025 Posted At: 11-24-09 By: S.PARVATHI >>> Post your comment now!

>>> More Network Security & Hardware Articles          >>> More By Ryan Naraine