Default ATM passcodes still exploited by crooks

net-security.org Once again, ATMs have been "hacked" by individuals taking advantage of default, factory-set passcodes. This time the passcode hasn't been guessed, or ended up online for everyone to know because it was printed in the ATM's service manual - the individual who, with the help of an accomplice, managed to cash out $400,000 in 18 months was a former employee of the company that operated the kiosk ATMs they targeted. Tennessee-based Khaled Abdel Fattah had insider knowledge of the code that, when typed in, set the machines into Operator Mode, which allowed him and accomplice Chris Folad to reconfigure the ATM to dispense $20 bills when asked for $1 dollar ones. They would do this, then ask the machine to dispense, for example, $20, and they would get away with $400. After this, they would revert back the change so that the theft would go unnoticed. And it took 18 months for this to happen - the owner of one the businesses where one of these kiosk ATMs was set up noted that there was a problem when the machine was running out of money. What ultimately led the Secret Service to the two fraudsters was the fact that their faces were captured by surveillance cameras and they used their own debit cards to make withdrawals. They also stuck to a rather limited set of ATMs, all located in Nashville. to read more: net-security.org