{"id":3855,"date":"2015-01-08T20:20:36","date_gmt":"2015-01-08T12:20:36","guid":{"rendered":"https:\/\/www.darknet.org.uk\/?p=3855"},"modified":"2015-09-09T19:36:41","modified_gmt":"2015-09-09T11:36:41","slug":"atm-hacked-using-samsung-galaxy-s4-usb-port","status":"publish","type":"post","link":"https:\/\/www.darknet.org.uk\/2015\/01\/atm-hacked-using-samsung-galaxy-s4-usb-port\/","title":{"rendered":"ATM Hacked Using Samsung Galaxy S4 &#038; USB Port"},"content":{"rendered":"<p>A pretty interesting black box daughter board attack on ATM via USB, the crowd cry ATM Hacked! Yah it was, and it was triggered using a mobile phone to actually activate the attack, showing it&#8217;s fairly complex and also abstracting the actual attacker from being physically there.<\/p>\n<p align=\"center\"><img decoding=\"async\" src=\"https:\/\/farm8.staticflickr.com\/7472\/16042341758_6a5c4cf6cf.jpg\" alt=\"ATM Hacked Using Samsung Galaxy S4 &#038; USB Port\" \/><\/p>\n<p>The guy carrying the black box can&#8217;t actually perform the attack without whoever has the phone trigger letting it lose.<\/p>\n<blockquote><p>Carders have jackpotted an ATM by inserting a circuit board into the USB ports of an ATM, tricking it into spitting out cash.<\/p>\n<p>The technique was thought to have emulated the cash dispenser of the ATM so the brains of the machine thought everything was normal, buying additional time for the brazen crooks to make off with the cash.<\/p>\n<p>A Samsung Galaxy S4 was then used by a remote attacker to issue commands to the dispenser, cybercrime scribe Brian Krebs reported.<\/p>\n<p>NCR global security manager Charlie Harrow said the circuit board gives crime lords control, but the folks who install it are not necessarily the real perps.<\/p>\n<p>&#8220;&#8230; you have the Mr. Big back at the hideout who&#8217;s sending the commands, and the mules are the ones at the ATMs,&#8221; Harrow said.<\/p>\n<p>&#8220;So the mule who has the black box is unable to activate the attack unless he gets the command from the Mr. Big, and the mobile phone is the best way to do that.\u201d<\/p><\/blockquote>\n<script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-3033787195489589\"\r\n     crossorigin=\"anonymous\"><\/script>\r\n<!-- Darknet Responsive Post Ad Links [previously link ad unit] -->\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block\"\r\n     data-ad-client=\"ca-pub-3033787195489589\"\r\n     data-ad-slot=\"5456620019\"\r\n     data-ad-format=\"auto\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\n<p>It really reads like something from the movies, some lacky with a black box and a mysterious Dr. Evil somewhere on a desert island triggering the attack from his mobile phone causing the ATM to endlessly spit out $100 bills.<\/p>\n<p>I doubt it was so obvious, but it would be fun wouldn&#8217;t it? The black box basically fooled the ATM into thinking the cash dispenser was still attached, pretty clever stuff.<\/p>\n<blockquote><p>The amount of cash stolen was not revealed.<\/p>\n<p>The mobile phone component also made it difficult for investigators to piece together how the attackers pushed commands through to the cash dispenser.<\/p>\n<p>Investigators were unsure what commands were sent to the dispenser only that they were funneled through the phone.<\/p>\n<p>The type of attacks were increasing, NCR said. Most logical USB port attacks involved malware and only one other had used the type of black box equipment used here.<\/p>\n<p>ATM owners have been urged to avoid stand alone machines where possible, as they are more easily attacked. NCR has updated its encryption scheme so that a key is exchanged between the brains and dispenser after a specific authentication sequence, and hardened firmware preventing thieves from downgrading. <\/p><\/blockquote>\n<p>I&#8217;m assuming this happened in the US as NCR is quoted (formerly National Cash Register) a US-based computer hardware\/software company that provides ATMs and the like.<\/p>\n<p>More details in Krebs article here: <a href=\"http:\/\/krebsonsecurity.com\/2015\/01\/thieves-jackpot-atms-with-black-box-attack\/\">Thieves Jackpot ATMs With \u2018Black Box\u2019 Attack<\/a><\/p>\n<p>Interesting stuff, will have to see if they manage to pop any more ATMs with this technique (if it gets reported that is).<\/p>\n<p>Source: <a href=\"http:\/\/www.theregister.co.uk\/2015\/01\/07\/atm_jackpotted_with_samsung_s4\/\">The Register<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>A pretty interesting black box daughter board attack on ATM via USB, the crowd cry ATM Hacked! Yah it was, and it was triggered using a mobile phone to actually activate the attack, showing it&#8217;s fairly complex and also abstracting the actual attacker from being physically there. The guy carrying the black box can&#8217;t actually [&hellip;]<\/p>\n","protected":false},"author":25,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"","_seopress_titles_title":"","_seopress_titles_desc":"A pretty interesting black box daughter board attack on ATM via USB, the crowd cry ATM Hacked and it spat out money too just like in the movies!","_seopress_robots_index":"","_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[10,22],"tags":[3303,6223],"featured_image_src":null,"featured_image_src_square":null,"author_info":{"display_name":"Darknet","author_link":"https:\/\/www.darknet.org.uk\/author\/darknet\/"},"_links":{"self":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/3855"}],"collection":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/comments?post=3855"}],"version-history":[{"count":0,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/3855\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/media?parent=3855"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/categories?post=3855"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/tags?post=3855"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}