ATM Hack Round-Up: Report From the Field

The (possibly illegal, and certainly not encouraged by 27B Stroke 6) field tests have begun.

A computer security professional of known reliability says he tried out the very first ATM he ran across -- a Triton. He used the key sequence and default code published in the company's manuals, which are available right on the Triton website.

I just confirmed that this does in fact work. We hit the market down from the office, I put the machine into admin mode with holding down ---, picked administration menu, and entered in the default --- and voila. By this time I was shitting myself and decided to walk away. So I exited out of the mode leaving the machine's settings unchanged. What I also noticed is that you can easily get a list of customer transactions as well as it is a menu option when you hold down ---.

This machine was a Triton but owned/managed by E-Trade (at least that's the sign that was on it.). So yeah ... it works.

(The dashes are my own censorship.)

I called Triton a few hours ago. They haven't called back.

Meanwhile, our readers have proven better at crime calculus than I. David Bork points out that my earlier calculation that a crook could net only $600 in a transaction can be improved upon, because the criminal can set the denomination to less than $5.00.

On the upper limit, you can change the denomination to $1, so a thief could change a $20 cartridge to $1, withdraw $40, and get $800, allowing a net $760 instead of what you have at $600. It goes even higher if the machine is set up with $50 or $100 bills, but I doubt that is very common.

Vegas, baby! Sin City's cash machines spit out more Benjamins than Warren Buffett at an orphan factory.

But crime is for punks. Over at Digg, a poster named "cosmospring" listed his less-larcenous plans for the next vulnerable machine he sees, complete with corresponding page references from the Tranax manual.

Awesome! Rather than risk the illegitimate transaction being linked to the only ATM card I have (mine), here's why I'll be on the lookout for a Tranny 1500: Step one: Turn off the damn surcharge (pg. 3.23) I hate that shit.

Step two: Change greeting (3.25) to something questionably witty (All your ...)

Step three: Set fast cash to an extremely high amount. C'mon people, do you really need to save the extra TEN SECONDS it takes to complete a full ATM transaction? Is pressing the buttons a workout? You suck.

Final step: Create "value coupon" (3.30) to be received by next ATM customer for "half off your pwned-ass ATM"

And if you think it'll take me too long to do this, I'm just going to dress up as an old person. Those people take forever at the cash machine anyway, and then I can act senile, too, so it won't look conspicuous when I am trying the default num-code for the cash box.

Finally, eWeek also wrote something about the ATM hacking, but blamed Google.