Sep 22, 2006 10:48 PM

ATM Cash Capers Spotted Last Year

Triton and Tranax — the twin colossi of the storefront ATM pantheon — both say the Virginia Beach caper took them by surprise. And yet … The ATM Industry Association, with which both companies are affiliated, issued this alert in February 2005. (Hat tip: Dave Goldsmith again.) Actual Fraud Risk Scenario In our continuing efforts […]

Triton and Tranax -- the twin colossi of the storefront ATM pantheon -- both say the Virginia Beach caper took them by surprise.

And yet …

The ATM Industry Association, with which both companies are affiliated, issued this alert in February 2005. (Hat tip: Dave Goldsmith again.)

Actual Fraud Risk Scenario In our continuing efforts to minimize risk exposure for our members, we are providing the following information about ATM master passwords. As we all understand, ATMs, in the vast majority of cases, are initially distributed from the factory with master passwords pre-set.
Recently, we have been advised of situations in which Master Passwords for ATMs have been compromised, either by not having these changed from the initial factory settings, or by allowing this information to be available to individuals other than the ISO/ATM deployer directly responsible for the installation. In these examples of fraud, unknown suspect(s) gained access through the master password and reprogrammed the cassettes to lower the cash dispensing denomination indicated below the required denomination, resulting in cash losses to the deployer.
Proposed Preventive Measure
To prevent this kind of compromise from happening, these master passwords should be changed at the time of site installation.
Information related to master passwords should never be divulged.

So, it seems the industry has known this was going on for some time, and took reasonable action to try and prevent it. That action fell far short, however, of what these companies are doing now that the press has tumbled to the issue.

And the guy in Virginia? He really screwed up. Scammers have been getting away with this cash-friendly caper for at least a year-and-a-half, and then this guy leaves an ATM in free money mode for nine days? And gets caught on surveillance tape that winds up on CNN? I'm sure the industry is unhappy with him, but his crime partners are going to be truly peeved. Hopefully he's found a cheap motel to hole up in, or we'll find him floating in Lynnhaven Bay by Sunday.

For its part, ATMIA is ratcheting up its response, according to Lana Harmelink, director of operations. "ATMIA has set up a committee of members from each sector of the industry to review this issue further," she writes.

Also, the programmer/administrator password set at a factory setting is no different than the safe combination being set at a factory setting when shipped from the manufacturer. If the ATM is installed properly then the passwords would be changed.

There is a bit of a difference, since safe dials aren't public-facing. The interesting thing about this ATM discovery is that it reveals a hidden capability that's literally been at everyone's fingertips all along. For one of the ATM models, it even tells us what that mysterious, unmarked key on the PIN pad is for. That's been bugging me for years.

ATMIA is sending out a new Alert Bulletin now that urges operators to audit their machines -- to make sure they're not missing money -- and to "Immediately verify that every ATM operated by your financial institution has security codes that are not original manufacturer default settings. Leaving factory default settings is very common although an un-safe practice."

The new alert also seems to confirm that the Virginia Beach perp used "manufacturer default codes that remained unchanged from the original installation of the equipment."