14-year-olds hack BMO ATM using manual found online
A person uses the ATM machine at the Bank of Montreal building located at King Street West and Bay Street on Friday, May 23, 2008 in Toronto.
Photograph by: Nathan Denette/National Post , Canada.com
A Winnipeg BMO branch got an unlikely security tip from two 14-year-olds when the pair managed to get into an ATM’s operating system during their lunch break last Wednesday.
The Grade 9 students, Matthew Hewlett and Caleb Turon, used an ATM operators’ manual they found online to get into the administrator mode of an ATM at a Safeway grocery store. They saw how much money was in the machine, how many transactions there had been and other information usually off-limits for the average bank customer.
“We thought it would be fun to try it, but we were not expecting it to work,” Hewlett told the Winnipeg Sun. “When it did, it asked for a password.”
They managed to crack the password on the first try, a result of BMO’s machine using one of the factory default passwords that had apparently never been changed.
They took this information to a nearby BMO branch, where staff were at first skeptical of what the two high-schoolers were telling them. Hewlett and Turon headed back to the Safeway to get proof, coming back with printouts from the ATM that clearly showed the machine had been compromised.
The teens even changed the machine’s greeting from “Welcome to the BMO ATM” to “Go away. This ATM has been hacked.”
The BMO branch manager called security to follow up on what the teenagers had found, and even wrote them a note to take back to school as explanation for why they were late getting back to class.
According to the Sun, the note started with: “Please excuse Mr. Caleb Turon and Matthew Hewlett for being late during their lunch hour due to assisting BMO with security.
Ralph Marranca, a spokesperson for BMO’s head office, said no customer information was exposed when Turon and Hewlett probed the ATM’s system. He did not immediately respond to questions from Postmedia News about what steps the bank is taking to ensure security at its thousands of ATMs across the country.
© Copyright (c) Postmedia Network Inc.
Why would anyone not change the default password on their ATM machine (computer) or any of their devices (computers)? In this day and age when data is constantly being breached and credit card information is stolen all the time, not changing your default password is like giving the crooks a key to the bank or your network. Let’s not make it too easy for the bad guys; after all they seem to be compromising systems at relative ease. I am not saying that by changing your default password will stop someone from getting into your system, but you need to start somewhere and this is a good as place to start as any. You have to use all your resources to protect your system a strong password is the first step of many. If two 14 year old boys can break the password on the first attempt, and I won’t even go into how they got that far in the first place. This incident could have been disastrous for the bank, but these two teenage boys, just wanted to see how far they could get. I am halfway through my I.T training and even I know changing your default is the first thing you do before you put a piece of equipment online.
ReplyDelete