303 lines
14 KiB
Plaintext
303 lines
14 KiB
Plaintext
With the North American continent the being the worlds biggest
|
|
consumer of goods and services liquidity of the banking system has
|
|
become an important factor in our everyday lives. Savings accounts
|
|
were used by people to keep money safe and used by the banks to
|
|
provide money for loans. However, due to 'Bankers Hours' (10 AM to
|
|
3 PM) it was often difficult for people to get access to thier
|
|
money when they needed it.
|
|
|
|
|
|
The banking system then created the Checking Account system. This
|
|
system allowed people to have much easier access to thier money.
|
|
Unfortunately the biggest drawback of this system is that people can
|
|
not manage thier own money and accounting procedures. Millions of
|
|
times each day throughout the North American continent people are
|
|
writing checks for more money than they have in thier savings accounts.
|
|
This drawback also causes the already-backed up judicial system to
|
|
become backed up further. The banking system soon reacted to this
|
|
problem by producing 'check verification' methods to prevent people
|
|
from forgery, and overdrawing from thier accounts.
|
|
|
|
|
|
"Money makes the world go 'round" and there are many different ways
|
|
to make this world spin. Today we have checking accounts, credit
|
|
cards, travelers checks, and the most 'liquid' form of money: cash.
|
|
Cash transactions are untrackable and widely accepted, so I feel
|
|
the "Paperless Society" will never happen. Automated Teller Machines
|
|
provide consumers with 24-hour access to cash-sources. By simply
|
|
inserting a plastic card into the machine and keypadding-in the
|
|
owners' "account password", you can access the owners bank account
|
|
and receive cash in-hand. This file will explain some details of
|
|
the automated tellers and the plastic card used by the Teller-system.
|
|
|
|
|
|
The automated teller is connected by wires and cables to a "Main
|
|
Computer". During each transaction the teller sends signals to
|
|
the main computer. The main computer records each transaction
|
|
(a deposit or withdrawl) and updates the card-holders account.
|
|
It also sends 'approval' or 'denial' signals to the ATM in regard
|
|
to the transaction requested. If a card-holder attempts to withdraw
|
|
$150.00 from his account and he has only $100.00 in it, the main
|
|
computer will tell the ATM to deny the transaction.
|
|
|
|
|
|
The ATM has 2 compartments to store cash in. The first is the "deposits"
|
|
compartment. This is a small area that receives the daily deposits.
|
|
It is located in the upper-part of the machine, near all the mechanical
|
|
devices. However, because most ATM transactions are withdrawls the
|
|
complete bottom-half is filled with cash where the withdrawls are
|
|
extracted from.
|
|
|
|
|
|
The plastic card inserted into the machine is the same size as a
|
|
credit card. The front of the card is embossed with information
|
|
about the card-holder. The back-side of the card has a thin strip
|
|
of magnetic tape which also holds some important information.
|
|
|
|
|
|
+--------------------------+ +--------------------------+
|
|
] CIRRUS ] ]--------------------------]
|
|
] INSTANT CASH CARD ] ]/////(magnetic strip)/////]
|
|
] ] ]--------------------------]
|
|
] Acct: 12345675 Exp. ] ] ]
|
|
] Joe Schmoe 01/91 ] ] "card-holders signature" ]
|
|
] ] ] ]
|
|
+--------------------------+ +--------------------------+
|
|
Front-side Back-side
|
|
|
|
|
|
When a cardholder inserts his card into the machine and requests a
|
|
transaction, the machine reads the embossed information from the
|
|
front-side and compares it with the data stored on the magnetic
|
|
strip; looking for a 'match' of the information on both sides.
|
|
|
|
|
|
The information on the front-side is easily readable with your
|
|
eyes. However, you can not read the data on the magnetic-strip
|
|
so easily. You may ask , "What is stored on the magnetic strip ?".
|
|
The answer is; the same information as the embossing plus some
|
|
'confidential' information regarding the cardholders' financial
|
|
status is stored there. The magnetic strip has 3 "tracks" on it.
|
|
The first track can store 210 BPI (Bytes per inch), and the second
|
|
stores 75 BPI, and the third stores 210 BPI. So, we have:
|
|
|
|
|
|
+---------------------------+
|
|
Track 1: (210 BPI density)
|
|
+---------------------------+
|
|
Track 2: ( 75 BPI density)
|
|
+---------------------------+
|
|
Track 3: (210 BPI density)
|
|
+---------------------------+
|
|
|
|
|
|
THE MAGNETIC STRIP
|
|
|
|
|
|
|
|
Now, here's the information stored on each track of the strip in
|
|
my example:
|
|
|
|
|
|
Track 1: " ;B 12345675 ^ Schmoe/Joe ^ ; LRC "
|
|
Track 2: " ;12345675 01/91 ^ 1234 ^ (discriminate data) ; LRC "
|
|
Track 3: " ;12345675 ^ 01/91 ^ 5 (discriminate data) ; LRC "
|
|
|
|
|
|
Here's the decoding of the above information:
|
|
|
|
Track 1: ";" = Beginning of the data character
|
|
"B" = Field-Control Character: I believe this character
|
|
tells the ATM what type of account (or status)
|
|
the user has.
|
|
|
|
"12345675" = This is the account number of the cardholder.
|
|
"^" = Data-field seperator.
|
|
"Schmoe/Joe" = Last/First name of cardholder.
|
|
"^" = Data-field seperator.
|
|
";" = End of data character.
|
|
"LRC" = Longitude Redundancy Check (end of track character).
|
|
|
|
|
|
Track 2: ";" = Beginning of data character
|
|
"12345675" = Account number of the cardholder.
|
|
"01/91" = Month/Year the card expires.
|
|
"^" = Data-field seperator.
|
|
"1234" = Process Identification Number (The cardholders 'password',
|
|
I think... or it could be a number to verify the
|
|
the transaction between the ATM and the Main Computer).
|
|
"^" = Data-field seperator
|
|
"(dscrmn. data)" = Discriminate Data. Not much is known exactly what is
|
|
stored here. Perhaps Bank Identification data or
|
|
bank account type (savings, checking?) ?
|
|
";" = End of data character.
|
|
"LRC" = Longitude Redundancy Check.
|
|
|
|
|
|
|
|
Track 3: ";" = Beginning of data character.
|
|
"12345675" = Account number of the cardholder.
|
|
"^" = Data-field seperator.
|
|
"01/91" = Month/Year the card expires.
|
|
"^" = Data-field seperator.
|
|
"5" = The crypting-digit. When the transaction request
|
|
is sent to the main computer, it is encrypted.
|
|
This digit tells which encryption-key is used.
|
|
"(dscrmn. data)" = A duplicate of the discriminate data stored on
|
|
Track 2.
|
|
";" = End of data character.
|
|
"LRC" = Longitude Redundancy Check.
|
|
|
|
|
|
When the card is being processed the ATM tries to match the
|
|
account number, expiration date and name stored on each track.
|
|
The reason they duplicate data is for verification purposes. But,
|
|
notice that the duplicate data is stored on different tracks, each
|
|
having different recording densities. Once the information on the
|
|
tracks are confirmed to match, the ATM compares them to the embossed
|
|
information on the front-side. If all of the information matches
|
|
then the transaction will proceed. If it doesn't match, then the card
|
|
is considered to be damaged and the ATM will keep the card. It will
|
|
give the cardholder a piece of paper instructing the user to notify
|
|
the bank who issued his ATM-card so he can receive a replacement
|
|
card in the mail (this process takes about 3 weeks).
|
|
|
|
|
|
Now that you know how the ATM-system is designed and what information
|
|
is kept where on the card, what "security defects" does this system
|
|
contain ? I will outline 4 methods of attacking this system that
|
|
have been tried (not by me!).
|
|
|
|
|
|
1) Vandalization: If you want, you can break-in to the ATM.
|
|
However, most ATM's contain 'sensor' devices which sound an
|
|
alarm when this is tried. Therefore, if you're going to try
|
|
this method I do not suggest using a hammer and chisel on the
|
|
ATM because it will take 1/2 an hour to get the machine open
|
|
and by that time the police will be there. You could try a
|
|
much faster way, dynamite; but that might scatter the money
|
|
all-over, making it hard to collect. Also, the bottom-half
|
|
is where most of the money is stored (unless you happen to
|
|
choose a machine that has issued all of its withdrawl-cash)
|
|
so you'll want to break into the bottom-half of the ATM.
|
|
|
|
|
|
In relation to this, you could wait outside the ATM for a
|
|
valid-user to complete his withdrawl-transaction and mug him.
|
|
As far as I know, the bank holds no responsibilty for placing
|
|
the ATM in a 'secure' enviroment. However, usually they will
|
|
have lights nearby and placed in 'reasonable' places where
|
|
people need money (example: Grocery store) and where the chance
|
|
of mugging is slim.
|
|
|
|
|
|
2) Physical Penetration: There are several ways of doing this.
|
|
If you have a stolen card, you could randomly try guessing his
|
|
account-password. But, I feel this is a primitive method.
|
|
If you try too many attempts at guessing the 'password',
|
|
the ATM will return the card to you. But, your attempts
|
|
*might* be recorded in the central computer; allowing the
|
|
bank to decide whether to cancel that card... However,
|
|
this has not been verified by me. If you do get a cash-card,
|
|
you can make counterfeit-cards.
|
|
|
|
|
|
A) Counterfiet ATM-cards: The same method for producing
|
|
counterfiet credit cards applies to ATM-cards. If you
|
|
have a valid ATM-card you can 'clone' it simply by embossing
|
|
a blank-card with the same information. Copying the mag-
|
|
netic strip is also easy. To do this, you place a blank
|
|
strip of the magnetic tape on top of the valid magnetic
|
|
strip. Then, using an iron on low-heat, gently rub the
|
|
iron across the two strips for a few seconds. Lastly,
|
|
peel the new strip apart from the valid one and you've
|
|
got a copy of all the data from the valid ATM-card.
|
|
|
|
|
|
B) Also, I've heard a case where some guys had a machine
|
|
that could read and write to the magnetic strips (probably
|
|
they were employees of a company that produces the ATM-cards).
|
|
Using this machine, they were able to create and change
|
|
existing data on ATM-cards (such as the expiration date
|
|
so they could keep using the same card over a long period
|
|
of time).
|
|
|
|
|
|
In relation to this there are other devices available that
|
|
can read and write to magnetic strips. Using your own
|
|
microcomputer, you can buy a device that allows you to
|
|
read and write to these magnetic strips. It looks
|
|
similar to a disk drive. If you're interested in
|
|
exploring this method, I'll suggest that you contact
|
|
the following company:
|
|
|
|
American Magnetics Corporation
|
|
740 Watsoncenter Road
|
|
Carson, California 90745
|
|
USA
|
|
|
|
213/775-8651
|
|
213/834-0685 FAX
|
|
910-345-6258 TWX
|
|
|
|
|
|
C) WARNING: During each transaction attempted on an ATM a
|
|
photo of the person requesting the transaction is taken.
|
|
How long this film is stored is unknown, but it probably
|
|
is different for each bank (unless there is a federal
|
|
regulation regarding this). Also, it is possible that
|
|
this is not done at all ATMs.
|
|
|
|
|
|
3) "Insider" Theft: The above case also crosses over into this
|
|
section. The biggest 'security leaks' in any company are
|
|
its employees. This is also the easiest way to steal money
|
|
from ATMs. The man who collects the deposits from the machine
|
|
and inserts cash for withdrawls has the easiest and most
|
|
open access to these machines. I was told that this person
|
|
can easily steal money from ATMs and not be detected. Another
|
|
person with access to these machines is the technician. The
|
|
technician who fixes ATMs is the most-knowledgeable person
|
|
about ATMs within the bank, therefore he should be a trust-
|
|
worthy guy and receive a 'comfortable' salary.. otherwise
|
|
he'll begin to collect 'retirement benefits' from the ATM
|
|
and this may go undetected.
|
|
|
|
|
|
However, I have heard of some embezzlement-cases involving ATMs,
|
|
so I think it's not as easy as it seems. It's only common sense
|
|
that a bank would account for every dollar of every transaction.
|
|
Whether the accounting is done inside the ATM or the main
|
|
computer doesn't make a difference... some form of accounting
|
|
is *probably* done.
|
|
|
|
|
|
4) Data-link Intercept: This method has been very successful. What
|
|
you do is 'tap' into the wires that connect the ATM to the Main
|
|
computer. By doing this you can intercept and send signals to
|
|
the ATM. However, some 'inside information' is needed because
|
|
the transmission is encrypted (refer to the Cryptography Digit
|
|
stored on the magnetic strip). But, I think you don't need to
|
|
know *everything* being transferred. You should need to know
|
|
when to send the 'approval' signal to the ATM telling it to
|
|
dispense its' cash. I read a case (it may be in Phrack World
|
|
News; 1985?) where some guys netted $600,000 from various ATMs
|
|
using this method. This seems to be one of the better, and
|
|
more ingenious methods of stealing from these machines.
|
|
|
|
|
|
The information in this file should be 'adequate' to introduce you
|
|
to how ATMs work. How did I get this information? I went into a
|
|
bank and inquired about the computer-technology of ATMs. The man
|
|
who was responsible for the ATMs was a bureaucrat and actually knew
|
|
very little about the 'guts' of ATMs. Luckily the ATM-technician
|
|
was there that day and I agreed to buy him dinner later that evening.
|
|
(Please refer to: "Insider" Theft and the principle of Company-Loyalty).
|
|
During the dinner at "Toppers" (a neat 1950's Burgers/Milkshake/Beer
|
|
restaurant) he provided me with Operation and Repair manuals for the
|
|
ATMs. I feel this information is well-worth the $3.82 dinner and
|
|
will be of some value to its' readers. Some good information was
|
|
screened-out due to its 'delicate nature', but the information I've
|
|
provided has been confirmed.
|
|
|