Hacking an ATM(henryschwarz.blogspot.co.uk)
henryschwarz.blogspot.co.uk
Hacking an ATM
http://henryschwarz.blogspot.co.uk/2012/06/black-hatted.html
13 comments
Its not very nice that the author turns a 'security researcher' (his words) who is effectively helping (if not actually doing) the authors job for him into a pantomime villain.
[edit: I do get that they became 'friends', which gives some levity to these descriptions, but it still strikes me as casting aspersions not just on the individual but more generally on the way he and others like choose to work]
[edit: I do get that they became 'friends', which gives some levity to these descriptions, but it still strikes me as casting aspersions not just on the individual but more generally on the way he and others like choose to work]
If you read it all the way down, the author reveals that he befriended the hacker and was very grateful for helping and co-operating with the fix. The villain part in the beginning was just joking, although I did not particularly enjoy that style of writing either.
It's a joke. He later on describes how they've become friends.
Then he mentions booing him at an event at the bottom. Friends seems to be loosely meant.
If the tables were turned, The Dread Pirate Barnaby would do worse than 'boo'.
Sorry, there's no drama to be found here. The guy's just having fun writing this up.
Sorry, there's no drama to be found here. The guy's just having fun writing this up.
Considering the think layer of sarcasm above, it's pretty clear the booing was joke as well. Same thing for sitting with crossed arms on the front row while everyone else cheered at the jackpot demonstration.
I thought it was part of who the author is. He doesn't strike me as a particularly serious person, so booing the security researched who has become a "star" of Black Hat in the eyes of the rest of the applauding audience sounds like a funny and friendly thing to do to me.
You're almost on your way to an understanding of general idea of Australian "mateship".
If we weren't sarcastically nasty to our friends we might have to talk about emotions to convey our mutual trust and affection with other blokes.
If we weren't sarcastically nasty to our friends we might have to talk about emotions to convey our mutual trust and affection with other blokes.
I couldn't bear reading that article.
The story could've been good, but the style of writing is neither witty nor clever and when I arrived at reserved seats in the front row at Black Hat I closed the tab with a quick sigh of relief afterwards. Horrible.
The story could've been good, but the style of writing is neither witty nor clever and when I arrived at reserved seats in the front row at Black Hat I closed the tab with a quick sigh of relief afterwards. Horrible.
Has HN turned into a literary club? Despite trying to make it a spy novel, I thought this article was one of the better stories read on HN.
I liked it a lot too, and, obviously, I'm on Barnaby Jack's side of the vulnerability research fence, not the ATM vendor's. I even thought the style was amusing.
Agreed. I came here wanting to say I thoroughly enjoyed the writing style. Technical details coupled with great entertaining writing? Count me in. I already read enough dry technical tumblrvomit as it is.
I agree, aside from being interesting, this was a well written story. What's everyone's problem with the writing style? You have to be kidding me.
some geeks seem to have the misconception that you can't be entertained and educated at the same time. I suspect this is the same group who hates analogies.
Typically the vendor side of a publicized security exploit never releases details to this extent, ESPECIALLY in the financial sector. It's a very interesting perspective to get to read in detail.
Obviously my statement was purely subjective (style of writing).
That said: What details did you take away from the article? I'm serious. I just went back and skimmed the rest. It seems this is really a long version of 'someone found an exploit, we fixed it, he presented it in public and we handled the aftermath'. No details at all. The most technical bit was the 'Now we're so much more secure by requiring signed code', and that was it?
That said: What details did you take away from the article? I'm serious. I just went back and skimmed the rest. It seems this is really a long version of 'someone found an exploit, we fixed it, he presented it in public and we handled the aftermath'. No details at all. The most technical bit was the 'Now we're so much more secure by requiring signed code', and that was it?
You can buy an ATM and have it shipped to your house.
Apparently, there is little meaningful verification that an ATM is secure before people start using it.
The target was randomly chosen, and a second company's ATM was breached in a completely separate fashion.
This was simply a publicity stunt for a security research company.
etc.
Apparently, there is little meaningful verification that an ATM is secure before people start using it.
The target was randomly chosen, and a second company's ATM was breached in a completely separate fashion.
This was simply a publicity stunt for a security research company.
etc.
I was mostly interested in hearing what happens on the vendor side after an exploit is disclosed, but you're right.. there wasn't a lot of specifics.
I would estimate that a security coder for an atm doesn't cross over with a good writing style very often. Doesn't mean it wasn't worth the read!
Agreed, after about six paragraphs he dials it down slightly but there's still a lot of text which I found painful to read.
Here's the video of Barnaby Jack hacking ATM at the Black Hat conference in Las Vegas, July 2010: http://www.youtube.com/watch?v=qwMuMSPW3bU
Excruciating, hammy read - wish he'd tone down the dramatic prose and just give us the info.
I really enjoyed the hamminess. I found it a pleasure to read.
Agreed, and I found it quite opposed to the stiff boring technical read it could of been. Which I believe was the exact point the author was trying to make at the end of his story.
I thought it was delightful.
Just wanted to chip in that I thought the article was a great read, informative, and the author's self-deprecating sarcasm was very refreshing. Much preferred to extremely dry and technical stuff.
FWIW Barnaby Jack (or a reasonable facsimile of him) links to this article with the comment "the right way to respond to security vulns...". (http://twitter.com/barnaby_jack/status/210052884497313793)
Found this article quite amusing. I'm not sure why so many people are getting turned off by it.
Its worth noting that the events described occurred in 2010.
Can't find a full length video of the presentation anymore online. Anyone else find a copy of the presentaton?
I don't know about full-length, but there are some >10min videos on youtube. http://www.youtube.com/results?search_query=Black+Hat+2010+b...
I remember watching barnaby's video when it first came online in 2010 and was wowed like the live crowd.
Thank you for such a detailed follow up.
Thank you for such a detailed follow up.
> [My company's ATM] was just the most conveniently available to purchase on the web and be delivered to his home. Note to our salespeople: for security purposes, please make it more difficult to purchase our product.
In this sentence, the author mistakes obscurity for security.
In this sentence, the author mistakes obscurity for security.
In this comment, the author mistakes irony for idiocy.
I beg your pardon. It seemed to me like the author dropped the sarcasm near the beginning of the write up and he actually thought denying individuals access to the equipment would make it more secure.
Well-executed humble-brag marketing.
"Note to our salespeople: for security purposes, please make it more difficult to purchase our product."
This guy still does not get it...
This guy still does not get it...
I'm sure this was meant as a joke.
Really? For more context here is the entire paragraph:
"Barnaby chose my company's ATM arbitrarily, it was just the most conveniently available to purchase on the web and be delivered to his home. Note to our salespeople: for security purposes, please make it more difficult to purchase our product."
"Barnaby chose my company's ATM arbitrarily, it was just the most conveniently available to purchase on the web and be delivered to his home. Note to our salespeople: for security purposes, please make it more difficult to purchase our product."
Yes, really. The whole article is thick with sarcasm and jokey stabs
The whole article is thick with sarcasm? The only other bit of sarcasm/joke in the last nine paragraphs is that the author booed/jeered barnaby when he came to the stage. If "the whole article is thick" with sarcasm why is the last 37% so straight forward and not funny?
It comes directly after the line 'Barnaby is from New Zealand and I'm from Australia, and trans-Tasman friendships are regarded as treasonous', which FYI is also a joke.
Your browser must not support the <sarcasm> tag.
Poe's law strikes again.
http://en.wikipedia.org/wiki/Poes_law
http://en.wikipedia.org/wiki/Poes_law
Jack notified the vendor and (obviously) got his talk accepted and announced at Black Hat. The vendor complained to Juniper, and Juniper had the talk pulled††. Jack left Juniper for IOActive and gave the talk the following year. Last time I checked, I believe he was at McAfee.
† Funny thing about Tranax: they managed to let Google crawl their maintenance manual a couple years ago, and the manual had their default maintenance code in it; a huge number of ATMs were found to be running with that default password, which allowed people to re-denominate the bills in the machine.
†† This was probably a reasonable call, because Juniper has billions of dollars to lose to a negligence suit brought by an ATM company.