81 lines
3.8 KiB
Plaintext
81 lines
3.8 KiB
Plaintext
|
Uploaded By: PRIVATE PIRATE
|
|||
|
|
|
|||
|
|
JACKPOTTING: What is it?
|
|||
|
|
By: The Prowler
|
|||
|
|
The Police Station
|
|||
|
|
|
|||
|
|
|
|||
|
|
JACKPOTTING was done rather successfully a while back in (you guessed it) New
|
|||
|
|
York.
|
|||
|
|
|
|||
|
|
What the culprits did was:
|
|||
|
|
sever (actually cross over) the line between the ATM and the host. insert a
|
|||
|
|
microcomputer between the ATM and the host. insert a fradulent card into
|
|||
|
|
the ATM. (card=cash card, not hardware)
|
|||
|
|
What the ATM did was: send a signal to the host, saying "Hey! Can I give this
|
|||
|
|
guy money, or is he broke, or is his card invalid?"
|
|||
|
|
What the microcomputer did was: intercept the signal from the host,
|
|||
|
|
discard it, send "there's no one using the ATM" signal.
|
|||
|
|
What the host did was: get the "no one using" signal, send back "okay,
|
|||
|
|
then for God's sake don't spit out any money!" signal to ATM.
|
|||
|
|
What the microcomputer did was:
|
|||
|
|
intercept signal (again), throw it away (again), send "Wow! That guy is
|
|||
|
|
like TOO rich! Give him as much money as he wants. In fact, he's so
|
|||
|
|
loaded, give him ALL the cash we have! He is really a valued customer."
|
|||
|
|
signal.
|
|||
|
|
What the ATM did:
|
|||
|
|
what else? Obediently dispense cash till the cows came home (or very nearly
|
|||
|
|
so).
|
|||
|
|
What the crooks got:
|
|||
|
|
well in excess of $120,000 (for one weekend's work), and several years when
|
|||
|
|
they were caught.
|
|||
|
|
|
|||
|
|
This story was used at a CRYPTOGRAPHY conference I attended a while ago to
|
|||
|
|
demonstrate the need for better information security. The lines between ATM's
|
|||
|
|
& their hosts are usually 'weak' in the sense that the information transmitted
|
|||
|
|
on them is generally not encrypted in any way. One of the ways that
|
|||
|
|
JACKPOTTING can be defeated is to encrypt the information passing between the
|
|||
|
|
ATM and the host. As long as the key cannot be determined from the ciphertext,
|
|||
|
|
the transmission (and hence the transaction) is secure.
|
|||
|
|
|
|||
|
|
A more believable, technically accurate story might concern a person who uses a
|
|||
|
|
computer between the ATM and the host to determine the key before actually
|
|||
|
|
fooling the host. As everyone knows, people find cryptanalysis tery exciting
|
|||
|
|
and engrossing subject...don't they? (Hee-Hee)
|
|||
|
|
|
|||
|
|
________
|
|||
|
|
| |--<<<<---| |---<<<<---------/-----\
|
|||
|
|
| ATM | microcomputer / host \
|
|||
|
|
| | | | | |
|
|||
|
|
| | | | \ /
|
|||
|
|
|________|--->>>>--| |--->>>>----------\----/
|
|||
|
|
|
|||
|
|
|
|||
|
|
I know the person that accomplished this feat, here in Orange County in the
|
|||
|
|
very recent past:
|
|||
|
|
|
|||
|
|
The B of A ATM's are connected through dedicated lines to a host computer as
|
|||
|
|
the Bishop said. However, for maintenance purposes, there is at least one
|
|||
|
|
separate dial-up line also going to that same host computer. This guy
|
|||
|
|
basically bs'ed his way over the phone till he found someone stupid enough to
|
|||
|
|
give him th number. After finding that, he had has Apple hack at the code.
|
|||
|
|
Simple.
|
|||
|
|
|
|||
|
|
Step 2: He had a friend go to an ATM with any B of A ATM card. He stayed at
|
|||
|
|
home with th`ppple connected to the host. When his friend inserted the card,
|
|||
|
|
the host displayed it. The guy with the Apple modified the status & number of
|
|||
|
|
the card directly in the host's memory. He turned the card into a security
|
|||
|
|
card, used for testing purposes. At that point, the ATM did whatever it's
|
|||
|
|
operator told it to do.
|
|||
|
|
|
|||
|
|
The next day, he went into the bank with the $2000 he received, talked to the
|
|||
|
|
manager and told him every detail of what he'd done. The manager gave him his
|
|||
|
|
business card and told him that he had a job waiting for him when he got out of
|
|||
|
|
school.
|
|||
|
|
|
|||
|
|
Now, B of A has been warned, they might have changed the system. On the other
|
|||
|
|
hand, it'd be awful expensive to do that over the whole country when only a
|
|||
|
|
handful of people have the resources and even less have the intelligence to
|
|||
|
|
duplicate the feat. Who knows?
|
|||
|
|
---------------------------------------
|
|||
|
|
|