14-Year Olds Hack ATM With Default Password


This is actually a pretty good hack and a good use of the word hacking in the original sense, two curious teenagers managed to access the administrator mode of an ATM in Winnipeg, Canada by using the default password they found in a manual they downloaded online.

Ingenious and pretty forward thinking, I like the fact they were responsible about it too and headed to the branch to let them know there was an issue with the security of their ATM machines.

Hack ATM

I’m not surprised the bank staff were originally skeptical of the teenagers claims as it seems pretty unlikely a couple of 14 year olds could hack your ATM machines..

A Winnipeg BMO branch got an unlikely security tip from two 14-year-olds when the pair managed to get into an ATM’s operating system during their lunch break last Wednesday.

The Grade 9 students, Matthew Hewlett and Caleb Turon, used an ATM operators’ manual they found online to get into the administrator mode of an ATM at a Safeway grocery store. They saw how much money was in the machine, how many transactions there had been and other information usually off-limits for the average bank customer.

“We thought it would be fun to try it, but we were not expecting it to work,” Hewlett told the Winnipeg Sun. “When it did, it asked for a password.”

They managed to crack the password on the first try, a result of BMO’s machine using one of the factory default passwords that had apparently never been changed.

They took this information to a nearby BMO branch, where staff were at first skeptical of what the two high-schoolers were telling them. Hewlett and Turon headed back to the Safeway to get proof, coming back with printouts from the ATM that clearly showed the machine had been compromised.


A slightly more advanced hack I remember writing about a few years back was a group Stealing ATM Pin Numbers Using Thermal Imaging Cameras.

Of course back in 2008 there was the famous ATM hacker ‘Chao’ who gave out a bunch of ATM hacking tips.

ATM Hacks have been around for a long time in various forms (skimming being the most common) – and they will continue to be around.

The teens even changed the machine’s greeting from “Welcome to the BMO ATM” to “Go away. This ATM has been hacked.”

The BMO branch manager called security to follow up on what the teenagers had found, and even wrote them a note to take back to school as explanation for why they were late getting back to class.

According to the Sun, the note started with: “Please excuse Mr. Caleb Turon and Matthew Hewlett for being late during their lunch hour due to assisting BMO with security.

Ralph Marranca, a spokesperson for BMO’s head office, said no customer information was exposed when Turon and Hewlett probed the ATM’s system. He did not immediately respond to questions from Postmedia News about what steps the bank is taking to ensure security at its thousands of ATMs across the country.

I just hope this incident gets enough press that it alerts other banks to audit their ATM Security and ensure they aren’t using the default administrator password.

Of course the Retards category sees a fair number of ATM related requests too.

Source: Edmonton Journal

Posted in: Hardware Hacking

, ,


Latest Posts:


Karkinos - Beginner Friendly Penetration Testing Tool Karkinos – Beginner Friendly Penetration Testing Tool
Karkinos is a light-weight Beginner Friendly Penetration Testing Tool, which is basically a 'Swiss Army Knife' for pen-testing and/or hacking CTF's.
Aclpwn.Py - Exploit ACL Based Privilege Escalation Paths in Active Directory Aclpwn.Py – Exploit ACL Based Privilege Escalation Paths in Active Directory
Aclpwn.py is a tool that interacts with BloodHound< to identify and exploit ACL based privilege escalation paths.
Vulhub - Pre-Built Vulnerable Docker Environments For Learning To Hack Vulhub – Pre-Built Vulnerable Docker Environments For Learning To Hack
Vulhub is an open-source collection of pre-built vulnerable docker environments for learning to hack. No pre-existing knowledge of docker is required, just execute two simple commands.
LibInjection - Detect SQL Injection (SQLi) and Cross-Site Scripting (XSS) LibInjection – Detect SQL Injection (SQLi) and Cross-Site Scripting (XSS)
LibInjection is a C library to Detect SQL Injection (SQLi) and Cross-Site Scripting (XSS) through lexical analysis of real-world Attacks.
Grype - Vulnerability Scanner For Container Images & Filesystems Grype – Vulnerability Scanner For Container Images & Filesystems
Grype is a vulnerability scanner for container images and filesystems with an easy to install binary that supports the packages for most major *nix based OS.
APT-Hunter - Threat Hunting Tool via Windows Event Log APT-Hunter – Threat Hunting Tool via Windows Event Log
APT-Hunter is a threat hunting tool for windows event logs made from the perspective of the purple team mindset to provide detection for APT movements hidden in the sea of windows event logs.


4 Responses to 14-Year Olds Hack ATM With Default Password

  1. Cedric June 12, 2014 at 3:49 am #

    This is not hacking and no it was not a hack. Logging in with a default password is what it’s called. “This is actually a pretty good hack and a good use of the word hacking in the original sense” no.

    • Darknet June 12, 2014 at 12:43 pm #

      “In the computer security context, a hacker is someone who seeks and exploits weaknesses in a computer system or computer network.” – yah because using the default password is not a weakness right?

  2. akarta July 10, 2014 at 3:02 pm #

    123456 is the master password for tritron atm & afew other makers, but come on now, but this is all about security or rather the lack there of =)

  3. akarta July 10, 2014 at 3:16 pm #

    and this is technically a hack, the 14year like any one else can use google to do a reconn for atm makers operator manuals, and simply had a read of it, its that simple. go spend 5min and you will come up with results, i did, now the question comes in to play now that you have done this task what do you do?, do you want do be a thief or would you point it out to the bank in question, by doing the right think one could end up with a consultance job, or maybe just being arrested.

    but the more important question to be asking here, WTF are banks not following basic security processes, and why on earth are ATM makers allows such easy access to theses manauls?

    dont the bank customers who already are getting ripped off deserve abit more?