Search Smart Spending:

Oops: ATM dispenses pepper spray

Posted Jul 14 2009, 06:15 PM by Karen Datko
Rating:

A bank in South Africa equipped 11 of its ATMs with pepper spray to deter crooks from blowing them up or installing a card-skimming device.

Unfortunately, pepper spray was released during routine maintenance on one of the ATMs, necessitating medical treatment for three innocent people, Web site IOL reports.

Readers were not impressed with the new security feature. "Imagine getting sprayed by a malfunctioning ATM. At which point you will be an easy target if any muggers are around," one anonymous commenter wrote.

Reader "MrDickens" said, "Oh man, PLEASE let me get sprayed by mistake. I relish the opportunity to sue a bank. Imagine getting a bank to pay YOU money."

Maybe this remedy to ATM fraud has a few bugs. But banks are increasingly nervous as attacks on the security of ATMs escalate.

A post at Bank Info Security lists seven growing trends in ATM fraud. It's amazing stuff you should know to protect yourself from identity theft.

The No. 1 trend is skimming. The post said:

"A higher percentage of criminals are going straight to a bank and installing a PIN pad overlay and card reader," (Mike) Urban (senior director of fraud solutions at Fair Isaac) says. "This is where the transaction goes through, and the customer doesn't realize that their ATM card or debit card has been compromised. I've seen a steady increase over the last couple years on this type of fraud."

In the South Africa case, a spokesman for the bank explained, cameras are programmed to monitor the ATMs for tampering. "If such suspicious activity was observed, another machine would eject pepper spray, which would disorientate the criminals, giving an armed response unit time to reach the site," IOL said.

Other recent news suggests how real the threats to ATM security are. A scheduled talk at the Black Hat conference about a certain ATM machine in wide circulation was pulled at the request of the vendor.

Wired said, "Barnaby Jack, a researcher with Juniper Networks, was to present a demonstration showing how he could ‘jackpot' a popular ATM brand by exploiting a vulnerability in its software."

Don't want to let the cat out of the bag until the security problems can be fixed.

Related reading:

How to beat ATM ‘skimming' scams

Fraud, identity theft grow at ATMs

Tough times are ripe for ID theft

Comments

 

Reader "MrDickens" said, "Oh man, PLEASE let me get sprayed by mistake. I relish the opportunity to sue a bank. Imagine getting a bank to pay YOU money."

........Sue Sue Sue....Some lazy idiot is always looking for his next free meal.  This person is no better than the criminals the banks are trying to stop from stealing their money. Get a job, and stop trying to get something for nothing.

I AM NOT IMPRESSED.

I WILL BE IMPRESSED IF THE ATM DISPENSES POISONOUS SNAKES. NOW THAT'S

NEWS !!!

JACKPOTTING was done rather successfully a while back in  New

York.

What the culprits did was:

  sever (actually cross over) the line between the ATM and the host.  insert a

  microcomputer between the ATM and the host. insert a fradulent card into

  the ATM.  (card=cash card, not hardware)

What the ATM did was:  send a signal to the host, saying "Hey!  Can I give this

  guy money, or is he broke, or is his card invalid?"

What the microcomputer did was: intercept the signal from the host,

  discard it, send "there's no one using the ATM" signal.

What the host did was: get the "no one using" signal, send back "okay,

  then for God's sake don't spit out any money!" signal to ATM.

What the microcomputer did was:

  intercept signal (again), throw it away (again), send "Wow!  That guy is

  like TOO rich!  Give him as much money as he wants. In fact, he's so

  loaded, give him ALL the cash we have!  He is really a valued customer."

  signal.

What the ATM did:

  what else?  Obediently dispense cash till the cows came home (or very nearly

  so).

What the crooks got:

  well in excess of $120,000 (for one weekend's work), and several years when

  they were caught.

This story was used at a CRYPTOGRAPHY conference I attended a while ago to

demonstrate the need for better information security.  The lines between ATM's

& their hosts are usually 'weak' in the sense that the information transmitted

on them is generally not encrypted in any way. One of the ways that

JACKPOTTING can be defeated is to encrypt the information passing between the

ATM and the host.  As long as the key cannot be determined from the ciphertext,

the transmission (and hence the transaction) is secure.

A more believable, technically accurate story might concern a person who uses a

computer between the ATM and the host to determine the key before actually

fooling the host.  As everyone knows, people find cryptanalysis very exciting

and engrossing subject...don't they?  

The person that accomplished this feat, in Orange County in the

very recent past:

The B of A ATM's are connected through dedicated lines to a host computer.  However, for maintenance purposes, there is at least one

separate dial-up line also going to that same host computer.  This guy

basically bs'ed his way over the phone till he found someone stupid enough to

give him th number.  After finding that, he had has Apple hack at the code.

Simple.

Step 2:  He had a friend go to an ATM with any B of A ATM card.  He stayed at

home with the apple connected to the host.  When his friend inserted the card,

the host displayed it. The guy with the Apple modified the status & number of

the card directly in the host's memory.  He turned the card into a security

card, used for testing purposes.  At that point, the ATM did whatever it's

operator told it to do.

The next day, he went into the bank with the $2000 he received, talked to the

manager and told him every detail of what he'd done.  The manager gave him his

business card and told him that he had a job waiting for him when he got out of

school.

It would be awful expensive to do that over the whole country when only a

handful of people have the resources and even less have the intelligence to

duplicate the feat.  Who knows?

I would think South Africans are accustomed to being pepper sprayed, they probably though it was a new perfume.

I find it kind of funny in a way although it doesn't sound too pleasant to those who got sprayed, of course.  Why would you sue for that though? People are just too sue happy. In all honesty, I hate banks myself but where do you think that money comes from?  Technology will always have its glitches.  You have to practice good maintenance especially with new technology.  Hey, at least they aren't shooting bullets at people. Or did I just give them a new idea? lol

.

All the robert would have to do is wear a mask...what a stupid idea...very unintellegent and a very stupid way of thinking....fools

Some of these comments are so not funny to me.  I was one of the unlucky individuals whose ATM/Debit data got stolen from the WAMU/Chase database.  Someone tried to clean out my account over Palm Sunday weekend.  The joke was on them, because that's an account I don't keep a lot of money in (we sweep it for cash every 2 weeks), but it cost me hundereds in overdraft fees, etc.

Then Chase had the nerve to say that I had deliberately given the thief my card and PIN and refused to honor my losses.  It took some serious pushing on my part before they finally admitted that the ATM in question had been cleaned out by multiple transactions on multiple cards in the space of just a few minutes, but they did eventually come through and restore the lost funds to my account.

when i use any atm, i fart on my card first, so the atm can recognize my scent and magically give me all the money i want. try it next time, i dare ya! you might get a few strange looks at first while you are farting on your card in front of the atm but it is well worth it! just don't smoke while you do that because you might catch your a$$ on fire! i learned this trick from the pope (he secretly does it every thursday night and early early sunday mornings)! ask oprah, she knows...

I guess ATMs just aren't practical anymore.  A large sum of money requires a human to guard it so that robbers have to threaten human life to get the money.  Unless self-defense is involved, you have no legal or moral basis for killing them.

Jack Floyd obviously get out much. The people of SA put us to shame when comparing sense of physical appearance and hygiene. Get up off your fat butt (fair assumption) and learn something about different cultures before you speak.

Send a Comment

Comments must be directly related to the blog entry. Comments with offensive language will be deleted. Your e-mail address won't be displayed.

(please, no HTML tags. Web addresses will be hyperlinked):