Hackers Study Vulnerabilities as ATMs Spit Cash

[Elmore Furth]

Hackers are demonstrating their technical skills and scaring the hell out of the rest of us at a hacker's conference in Las Vegas. I knew there was a reason why I didn't do online banking or use ATMs.

A security expert showed off techniques for breaking into ATMs, causing machines to spit out cash to a cheering crowd at an annual gathering of hackers.

"I hope to change the way people look at devices that from the outside are seemingly impenetrable," Barnaby Jack, director of research at security consulting firm IOActive Labs, told a standing-room-only crowd before launching the demonstration using equipment he purchased over the Internet.

He spent over a year learning to break into stand-alone automated teller machines found at gas stations, bars and retail establishments.

At the annual Black Hat conference, Jack showed how he could upload his home-brewed piece of software dubbed Dillinger -- named after the infamous bank robber -- to an ATM made by privately held Tranax Technologies. After he infected the ATM, he approached the machine and instructed it to start dispensing cash.


Hackers Study Vulnerabilities as ATMs Spit Cash

[Mnpaul]

1. I don't think this will take money from bank customers

Just the bank. It sounds like he hacking the ATM software, not someone's account.

[Elmore Furth]

2. Online Banking Fraud Statistics

I don't think the following statistics should reassure you, even if you will be reimbursed by the bank. It turns into a real mess. Phishing and bots that steal passwords are ubiquitous. The Mariposa Botnet, for example, was built with a computer virus known as “Butterfly Bot” and was used to steal passwords for websites and financial institutions. It stole computer users’ credit card and bank account information, launched denial of service attacks, and spread viruses. Industry experts estimated the Mariposa Botnet may have infected as many as 8 million to 12 million computers.

http://www.fbi.gov/pressrel/pressrel10/mariposa072810.htm

http://www.mementosecurity.com/bankfraudforum/index.php/memento_blog/tags/tag/identity+theft

http://www.symantec.com/avcenter/reference/threats.to.online.banking.pdf

http://www.fraudwatchinternational.com/phishing/individual_alert.php?fa_no=238583

Times are tough -- even for cybercriminals. Online merchants in the U.S. and Canada report a dramatic 18 percent drop in fraud, down from $4 billion in 2008 to $3.3 billion this year, according to a survey by the security firm CyberSource. Meanwhile, the fraud rate of 1.2 percent of all sales is the lowest in the 11-year history of the survey. Even among international orders, traditionally the bane of Web sites, fraud rates plummeted by 50 percent.

Despite the apparent success, there's little cause for celebration, Schwegman warned. This year's cybercrime dip could be an anomaly.

"It's kind of an arms race. It could be things will bounce back next year (for criminals),” he said.

And there is another more discouraging explanation for lower e-commerce fraud rates: Serious computer criminals have moved beyond basic credit card fraud to more sophisticated account creation fraud that allows them to steal money directly from banks. So-called "new account fraud is not counted in the CyberSource survey, Schwegman said.


SURPRISE! MERCHANTS SAY WEB FRAUD IS DOWN

According to a representative of Apacs, a UK firm handling online payments, online banking fraud in 2008 amounted to £52.5 million. During the previous year, this amount was less than half that at £22.7 million. There is even a greater amount of online fraud when you compare the amounts with that of 2004, which was £12.2 million.

One of the reasons for this increase in the amount of online banking fraud is that more and more people are taking advantage of online banking for paying their bills and for shopping online. They are able to conduct their financial affairs from home on their personal computers rather than have to adhere to banking hours. Along with the advances in technology that allows this convenience comes the availability of more advanced software making it easier for the computer literate con artists.

Online Banking Fraud is on the Rise in the UK

One in 10 Australian internet users have lost money to online identify fraud over the past year with losses totalling $1.286 billion, according to the VeriSign Online Fraud Barometer figures released today.

The findings represent a significant increase on the figures reported in June by the Australian Bureau of Statistics, which surveyed Australians in 2007 and found that just over 800,000 had been victims of personal fraud. Back then, combined losses were $977 million.

VeriSign's figures suggest 1.37 million Australians, or 10 per cent of internet users, have fallen victim to online fraud in the past year. The results are based on a survey of 2510 Australians aged 18 years and over conducted in June this year by Galaxy Research.

The survey found that those affected had lost an average of $1000 over the last 12 months and that 18-24 year olds were most at risk, losing on average $1619.


Online ID fraud losses explode to $1.3bn a year (in Australia)

[bemildred]

3. This is a Windoze hack based on physical access.

It has nothing whatsoever to do with the internet.