Bank Employee Plants Malware on ATMs 171
Wired's Threat Level has a piece on a Bank of America employee, Rodney Reed Caverly, who has been charged with installing malware on ATMs in North Carolina. Caverly, who worked on the bank's IT staff, allegedly withdrew cash untraceably from the ATMs over a period of 7 months last year. "The charges were filed the same day that credit card company Visa warned the banking industry that Eastern European ATM malware recently showed up in America for the first time. That code, initially spotted last year on some 20 ATMs in Russia and Ukraine, was designed primarily to capture PINs and bank card magstripe data, but also allowed thieves to instruct the machine to eject whatever cash was still in it... At least 16 versions of the East European malware have been found so far and were designed to attack ATMs made by Diebold and NCR, according to the April 1 Visa alert. There is no information tying the malware found in Russia with the malware allegedly used by Caverly."
hmm... (Score:2)
I RTFA, and maybe I just missed it...but did they detail how they caught the guy?
Re:hmm... (Score:5, Interesting)
who has been charged with installing malware on ATMs in North Carolina. Caverly, who worked on the bank's IT staff, allegedly withdrew cash untraceably from the ATMs over a period of 7 months last year.
Wait - so if they caught the guy, how the hell is that untraceable?
Just because you don't follow the money doesn't mean you aren't tracing.
Re: (Score:3, Insightful)
Because stupidity and arrogance is traceable.
Somehow the money has to get from the hopper to the guys home, then from the guys home to buy stuff. My guess would be the guy was caught spending beyond his means, then they started following him to ATM's where he was then recorded withdrawing the money. Then when they go looking for what account he withdrew money from, and it couldn't be found. Then again he may have just bragged about it to his girlfriend, then when he dumped her...
Re: (Score:2)
I think that was the plot to Superman III
Ummm.... (Score:2)
Oh, I dunno; maybe he showed up to work one day driving a car worth ten times his annual salary?
Just because someone can write code doesn't necessarily mean they're not dumber than a turnip.
Re:hmm... (Score:5, Funny)
Poor Diebold ATM programming (Score:5, Interesting)
To put a long story short, those things are not well-programmed.
Re:Poor Diebold ATM programming (Score:5, Funny)
Re: (Score:2, Informative)
I worked for them at one point as a systems engineer and was friends with the engineering group - I was told that they have a "fair" fail rate on the device that you feed the envelope into. On some of the older ATM models there was a gap where it was possible for the envelope to thread downwards instead of into the deposit bin, and you had to take the ATM apart to get those envelopes back.
That was one of the chief complaint
Re: (Score:3, Funny)
Never, ever deposit money into an ATM in that manner, especially a Diebold ATM.
If you don't deposit any money, will it still count your votes?
Re: (Score:2, Funny)
Re: (Score:2)
Silly goose, your money is your vote!
Re: (Score:2)
Re: (Score:2)
Never, ever deposit money into an ATM in that manner, especially a Diebold ATM.
The ATM the poster refers to does not accept envelopes. In fact, it does a count of the cash right then and there and asks for approval. Then, it rights the bill count and total right into the receipt. If it's before 8pm (at least at BofA) you get immediate access to those funds.
However, I agree about depositing envelopes full of cash into the old-style ATMs. Not so much because of mechanical errors, but because of bank workers pocketing the cash and then say "Gee, the customer deposited an empty envelo
Untraceable and Diebold (Score:2, Insightful)
UNfortunately (Score:5, Insightful)
This fellow will serve more time than any of the bank CEOs responsible for the huge mess in America's economy.
Re:UNfortunately (Score:5, Insightful)
Yes I see your point, but what he did was ILLEGAL. What bank CEOs did was idiotic and a byproduct of Greenspan's Randian/laissez faire outlook on "self-regulation". They weren't violating the law, this guy was. He was deliberately engaged in an act of theft, which doesn't compare to the cluster-fuck of idiocy that caused the last recession. Bank CEOs were reckless, the government was allowing it to happen, and a bunch of toxic assets were being rated as AAA bonds.
With that said, the real outrage is that some of the CEOs of failed banks made millions off there own failures. When you become CEO you should sign a contract saying "I will return 100% of my bonuses if my fuckups cause this company to fail".
Re:UNfortunately (Score:5, Informative)
Re: (Score:2)
That's a good point, and I'll bet the Lehman officers will never do even a second of jail-time. But to go back to the parent-post (or gandparent post, I'm lost at this point)... The poster points out that what this loser did was "illegal" and what the banks did to fuck the economy wasn't "illegal".
I'd like to point out that "duh" -- OF COURSE, it's designed that way. Laws in this country ARE DESIGNED to make everything done by a "citizen" illegal, while anything done by large, faceless corps are legal. This
Re: (Score:2)
Wouldn't customers be much more likely to know what exactly the banks were doing with their deposits?
Would they not then move their money to institutions that were more conservative and careful with those deposits?
Which I think might make banks that were smart and careful more successful and more profitable in the long run than banks that take huge chances. With people less protected and more aware
Re: (Score:3, Informative)
I think that True market forces can do a better job at regulation than the US Government can.
Until greed, credit, and gullibility enter into the equation. What do you think causes the Great Depression? Unregulated securities markets and overvalued stocks fueled by the credit of your average citizen. What do you think causes the last recession? Under-regulation in the securities markets, and overvalued bonds fueled by the credit (mortgages) of your average citizen. For fucks-sake, my 20 year old friend had a $150,000 mortgage on $30,000 of income for a house that is now worth $40,000. He defaulted,
Re: (Score:2)
For fucks-sake, my 20 year old friend had a $150,000 mortgage on $30,000 of income for a house that is now worth $40,000.
One thing that I never see in these discussions is the lack of financial literacy of the general public. Who the fuck buys anything that is worth a) more than 5 times their yearly income, and b) was worth 50% the price paid for about 2-3 years ago?
I don't care what the interest rate is that you pay the first 6 months. If you make x per year and something costs 5x, you're not going to pay it off, ever. Unless you make about 10 million a year and have a golden parachute for 50 million. But then, the rules don
Re: (Score:2)
Lots of people./
BTW 150K house would be under 700 a month at 5%.
Walking away may have just been a prudent financial decision. I suspect if it dropped to 100K he wouldn't have walked away.
You are looking at it wrong. It's not pay 700 a month, or payu nothing.
It's pay 700 dollars a month in a home you might get equity for, vs 700 a month for an apartment.
Why pay that kind of money for a house that is no longer worth it? Better to walk, wait a couple of year and the purchase again.
Historically what would have
Re: (Score:2)
no. There was a time of no regulation. It led to massive financial and class failure.
When the people at the top of the market lie, how is a consumer supposed to know?
Yes, we are conservative with your money. right up until the time you loose everything and we leave with pockets full of cash.
People, such as yourself, seem to forget that the regulations stem from past abuses that caused financial crisis.
True market forces is a myth. You can only have true market forces in a world where all actions and informa
Re: (Score:2)
People, such as yourself, seem to forget that the regulations stem from past abuses that caused financial crisis.
Yes, "something had to be done", of course.
Never mind that it doesn't actually fix the problem so, sooner or later, "something has to be done" again. And again.
Re: (Score:2)
Any sufficiently advanced incompetence is indistinguishable from malice.
--
BMO
Re: (Score:2, Insightful)
You spelled "laissez faire" properly and then screwed up "there"? FAIL
Re: (Score:2)
Actually the CEO shouldn't get any bonuses at all and only have a % of the profits/losses of the company. If all you get is 0.1% of the bottom line, you try your best that it doesn't become a negative value.
Those failed banks CEOs would actually OWE money to the USA government at this point.
Re: (Score:3, Informative)
Yes I see your point. Let's make what those CEOs did ILLEGAL.
Oh wait, borrowing from each other to make unsecured wagers on other people's debt positions was illegal. Until it wasn't.
(For you amateur politicians: The retraction of the Bucket Shop laws was added onto a spending bill in 2000. Bill Clinton signed it, because it was a couple of lines in a thousand-page bill, but it was the banking industry's paid-for congresscriminals who stuck it there. Moral: Never allow the GOP to hold power in congress
Re:UNfortunately (Score:5, Insightful)
Moral: Never allow the GOP to hold power in congress again. When they abuse parliamentary tactics, it costs us $700 billion off the top, and millions of jobs.
I don't see how you ended up with that moral. Shouldn't the excuse you used for Bill Clinton be equally applicable to the GOP in Congress? or even the few Democrats in Congress? After all, if a Democrat in Congress had seen the couple of lines added in there, wouldn't he have told the Democrat President? Or are you implying that the lines were inserted in the bill between the time it was voted in and the time it was driven to the White House (which is possible granted, but I don't think that's what you said)?
Disclaimer: I did vote for Bill Clinton. I just think that this attitude of "That my party can do no wrong, and if they did wrong, there must be a good reason for it." is precisely what's wrong with our current political system.
Re: (Score:2)
What's wrong with your political system goes far deeper than that.
For example: Why don't you have two runs in the presidental elections if no candidate gets more than half of the votes?
I'm sure there are several other technical issues like this that has made and continues to make it a two party state.
Now, I'm not aware of representative democracy working particularly well anywhere, but two party states are a bit worse than, say, five party states, right? On the other hand, maybe a 34665 party state is worse
Re: (Score:2)
Yes I see your point. Let's make what those CEOs did ILLEGAL.
Make no mistake. What happened with the banking system, the endless bubble-crash cycles, the bad mortgage lending, the massive bailouts, was on purpose and by design. The CEOs aren't stupid. When they say that no one could have seen this coming, they're lying. When they say that they made a mistake, they're lying. When they say that a bank is too big to fail, and society will collapse if you don't give them billions of taxpayer dollars, they're lying. Big banks stealing from taxpayers is not illegal be
Re: (Score:2)
We were talking about this on a couple of forums where I regularly participate in 2002 By 2005 most of the participants were agreed about what was coming, just not sure whether it would happen in time to prevent the Rethugs making their position permanent in 2009. Fortunately it started to come apart early enough that the GOP essentially bailed on the presidential race and let McCain take the nomination since they knew they were go
Re: (Score:2)
Also the majority in congress said they would override his veto. What he did do is get change made so the middle class wouldn't get left out.
Re: (Score:2)
Clinton and Greenspan could have stopped it at any time by raising interest rates and vetoing GLBA changes.
Moral of the story: never allow a liberal president into power that cares more about getting his cock sucked than the US economy.
This was a bipartisan fuckup. Don't kid yourself. The Clinton administration was asleep at the wheel and democrats voted for it en masse too. They'd have done whatever clinton wanted them to. In case your memory is fuzzy, here's the numbers
House Democrats: 75% yay (155-51)
Hou
Re: (Score:2)
When Congress can and wants to override a presidential veto (hint: that can be done) then it doesn't matter what you do from the Executive chair.
Re: (Score:2)
What bank CEOs did was idiotic and a byproduct of Greenspan's Randian/laissez faire outlook on "self-regulation".
I am curious what you see that is "Randian" or "laissez faire" about Greenspan or his actions. Sure, he was a free-marketeer back in the 60s, but the dude had absolute power over the monetary policy of the entire country. There is nothing laissez-faire about that. Rand was in favor of ending the Federal Reserve altogether - the Greenspan of the last decade was out for gaining political power, not acting on principle.
With that said, the real outrage is that some of the CEOs of failed banks made millions off there own failures.
That is definitely true. Those companies should have gone into bankruptcy, not be rescued fr
Re: (Score:2)
He blocked efforts to regulate the derivatives market, saying it would "self-regulate". He believed that allowing market-correction was the best way to deal with fraud/over-valuation.
Calling Greenspan "Randian" was a bit of hyperbole.
Re: (Score:2)
"s/was allowing/caused/"
Weren't those toxic assets created due to bad legislation and wasn't it Fannie Mae and Freddy Mac that bundled those assets with solid ones in order to get them a AAA rating?
Agreed (Score:2)
They do. It used to be called "bankruptcy". Sadly, we have a serious aversion to that under the current administration because it might be uncomfortable for many people living beyond their means.
GM, GMAC, GE, countless banks, many insurance companies --- all of them "bailed out" of bankruptcy.
And yes, I am bitter and pissed, as are MANY other business owners. My comp
Re:Agreed (Score:5, Insightful)
Do you know what a corporation is? A corporation going bankrupt is not the same as a proprietorship going bankrupt; this is the whole reason that you start a corporation... to shield your salary/earnings in case the company goes under. The trade-off is that you essentially pay income tax twice (it is wayy more complicated though).
Re: (Score:2)
My point still stands: the moral hazard created by removing bankruptcy changes behavior at all participant levels and leads to perverted incentives that lead to disastrous results. If there is no risk for the owners, then they have n
Re: (Score:2)
Re: (Score:2)
Its a violation of the law to commit fraud. Most, if not all, of the major banks engaged in fraudulent accounting, at the very least. They used this fraudulent accounting to show excess paper profits, and used those profits as a justification to pay very large bonuses. Then, when the winds turned, none of these banks had enough cash on hand to weather the storm.
There should be a Pecora Commission, and a perp walk, to say the least. These banks did exactly what Enron did. Enron saw its comeuppance, so should
Re: (Score:2)
Because it was God Himself who ordered the banks to give loans to people with low income, bad credit, and no down payment. Or maybe it was Barney Frank [nytimes.com]... Just stop. Stop blaming capitalism. If you hate capitalism, there are about 100 socialist countries you can go suck off of.
Question.... (Score:5, Interesting)
Re: (Score:2)
When ever a transaction doesn't go correctly at the bank you should contact the bank immediately. If it takes your money and doesn't credit your account, this is what receipts are for. If you receive counterfit cash, I'd park my car at the atm window and make sure you call the bank ASAP. It's a direct CYA move. The longer you wait to contact a bank the more difficult it is to fix the problem. If you have a bank ATM card, it's good to put their phone number on your cell, so if you card is lost or stolen
Re:Question.... (Score:4, Informative)
Re: (Score:2)
OTOH, if you withdraw from the ATM you're liable to the sort of things you mention (I'm still out U$ 300 from the Bank Boston - now Banco Itaú in Uruguay, and will never do business with them again whenever possible, from an ATM failure that resulted on withdrawal from my account without me receiving the money, and even appealing to the bank didn't work)
Re: (Score:2)
wait a second (Score:5, Funny)
Is this the dude who put that "This bank charges a $3 fee for you to get your own money" exploit on there?
I hate that.
Hang him.
Will not use BoA atms! (Score:4, Interesting)
And I suggest you do not use them either. They just operate and behave wrongly, even when they don't have malware installed.
They're slow. -- ATM's in the 80's were faster.
They're obviously running window XP. -- The standard windows sounds are used.
Re: (Score:2)
They should run Linux (Score:5, Funny)
This is why banks should use Linux. That way it would be impossible to install the same malware on all systems. Because each slightly different model, released on slightly different dates, would have different versions of incompatible libraries
“Why GNU/Linux Viruses are fairly uncommon” from Charlie Harvey [gnu.org]
Re: (Score:3, Funny)
ATMs used to be run on OS/2. I would very rarely see one stuck at the Presentation Manager startup screen.
Nowadays, seeing an ATM stuck at the XP boot screen or BSOD isn't reeally novel.
But the entire concept of running ATMs in XP is indeed troubling. A custom distro based on Debian would seem a good way to do it.
Watch that the first Linux ATMs run Mandriva. Ugh. At least they should run Gentoo just to mess with 'us'.
I Wonder How Many Bosses He Has.... (Score:2)
Caverly, who worked on the bank's IT staff, allegedly withdrew cash untraceably from the ATMs over a period of 7 months last year.
Someone watched Officespace one too many times.
Who in their right mind... (Score:2)
... sends out an alert on the 1st April? Seriously?
Article mentions ATM fraud in Ukraine and Russia (Score:3, Interesting)
Re: (Score:2)
Another nail in the coffin (Score:3, Insightful)
for electronic cash transactions.
I expect to be back to only using cash in about 20 years.
If the economy keeps... (Score:3, Funny)
I expect to be back to only using cash in about 20 years.
If the economy keeps heading in the direction it's going, I expect to be using the barter system within 20 years.
Like as in: Hey Mr. Blacksmith, I'll swap you 3 dozen fresh hen's eggs for a pound of nails and this here yearling billygoat for welding up my broken plow blade.
Untraceably? (Score:2)
Um, apparently not.
Re: (Score:2)
He was at this for seven months. My gut's telling me it wasn't the malware that caught him in the end.
Re:Great (Score:4, Interesting)
Although I hear diebold does better with ATM's, I can't help but wonder how much effort they put into ATM security versus the voting machine fiasco.
Meanwhile, ATM's have always been pretty shoddy on security. It's a given. People essentially have physical access to the device.
I wonder if it would be better to have ATM's running a virtual or other remote hosted ATM client so that nothing is hosted on the ATM directly? Or is this already being done in some places?
Re:Great (Score:5, Insightful)
> Although I hear diebold does better with ATM's, I can't help but wonder how
> much effort they put into ATM security versus the voting machine fiasco.
Probably completely unrelated. They got into the voting machine business by purchasing a company that was showing a prototype and then rushing the prototype into production without bothering to develop an actual product. That says a lot (none of it good) about their top management, but nothing about the people in their ATM division.
They eventually dumped the voting machine business, and it is possible that they learned from the experience.
Re: (Score:2)
yeah, that's why I was hesitant to type up what I did. It was mostly a question if "is it linked", but that kinda implies that it is, and I didn't know which way the ATM division versus voting machine division sits.
windows (Score:2)
The last place I want Windows is where I stick my bank card.
Re: (Score:2, Informative)
Now I'm not saying that it is 100% safer and full-proof as I hate the fact that it is Windows-anything, but its definitely better than stock XP.
Re:WinXP (Score:4, Interesting)
Re:WinXP (Score:5, Informative)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2, Insightful)
"I can't say how I know, but trust me I know."
Now there is a security issue right there.......
Re: (Score:2)
if you've ever worked for a bank (I have, and have relatives in the IT side), you'd know that the poster above is correct. It's a branded but stock version of XP.
I thought most companies were trying to replace that, though.
Not to say you can't make that more secure, I don't know if diebold does or not, but I do know for certain that terminals running XP run it stock.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re:WinXP (Score:4, Funny)
Windows-anything handling your money is Just Not a Good Idea.
http://www.flickr.com/photos/27159137@N08/3186737368/ [flickr.com]
Re: (Score:2)
Re: (Score:2, Informative)
Although I hear diebold does better with ATM's, I can't help but wonder how much effort they put into ATM security versus the voting machine fiasco.
I went to a Bank of America branch here in Eastern NC one day last year, and saw a Windows XP error screen on the ATM. I then saw a Diebold guy coming out of the bank, and asked him about it. He says that the BoA ATMs are now running XP on them. How safe do you feel knowing that?
A lot of ATMs have been running Windows for years. I remember 10 or so years ago after I finished my transaction the ATM rebooted. On the green monochrome screen was the POST check, followed by a Windows NT splash screen. I've also seen various Windows errors over the years on ATMs. Some were still NT4.0 errors, even recently. A lot of kiosks run Embedded version of Windows. As do cash registers.
I've also seen my fair share of Linux based kiosks sitting with an error, or in an endless reboot cycle, so Windo
Re: (Score:2)
I've also seen my fair share of Linux based kiosks sitting with an error, or in an endless reboot cycle, so Windows isn't alone in this regard.
Both of them (actually any OS) will suffer from hardware problems. My last PC started first developing reboots and bluescreens on the Windows side, and eventually Mandiva as well. The problem was the power supply, which finally croaked; its voltages had been undstable for some time, causeing the problems in both OSes.
Re:WinXP (Score:5, Insightful)
When you don't change the default password, it doesn't matter if you're running XP, 95, OS/2 or SELinux.
When you can overlay a fake cardreader over the top of the device's real reader, it doesn't matter if you're running XP, 95, OS/2 or SELinux.
When the criminal behind it is also a device admin, it doesn't matter if you're running XP, 95, OS/2 or SELinux.
How safe do you feel knowing that?
Re: (Score:2)
How safe do you feel knowing that?
Answer 1: Perfectly safe. I keep my money in my mattress.
Answer 2: I feel much better about keeping my money in the stock market. Even during a crash.
Re: (Score:2)
So what haveyou done? Tripled your fire insurance? What happens when you fall asleep with a hooker over? Does she just helpherself on theway out?
Re: (Score:2)
What used to be a fairly simple and standard ATM setup all of the sudden grew all sorts of push-advertising for additional services and "value" "added" features. And they slapped at least six stickers on the front, each with enough text for a EULA. It really made it hard to find the usual basic transactions quickly when you're leaning out of your car window trying to just grab some cash.
Re: (Score:3, Insightful)
Re: (Score:2)
Then go inside and work with a bank employee.
Or what, do you want me to stand next to you quietly and watch everything you type?
Re: (Score:3, Insightful)
OK, that came out ruder than I wanted it to.
My point is that a blind person using an ATM is dangerous. Unless he has echolocation, he can't know that nobody is watching. Also, how can he tell that he's at a real ATM?
Re: (Score:2)
True. I wasn't thinking of that - just complete blindness.
Re: (Score:2)
Many moons ago, my brother-in-law was an ATM tech. He told me that ATMs were the last major users of BeOS. Waddayaknow.
Re: (Score:2, Insightful)
Who did he kill? How many children did they find in his basement?
Re: (Score:2)
And which "junk" would that be ?
I'm all for "Life without Parole" for DUI, how does that sound to you?
And since our prisons are all filled to the brim, we need to start executing. A LOT.
I'm all for executing drug dealers, child porn people, rapists and murderers.
We need to put an end to this junk, so if we send the message that the POLICE STATE will KILL YOU for just about anything, that should put citizens in their place. After all, if you're not cop, you're little people.
Re: (Score:2)
Cough: http://en.wikipedia.org/wiki/Justice_(TNG_episode) [wikipedia.org]
Re: (Score:2)
When the system admin is the one planting malware, it doesn't matter what OS it's running.
When the default passwords aren't changed, it doesn't matter what OS it's running.
The real questions are:
1st, why isn't the system state verified? It's an ATM. It should be static. Anything new installed should force a crash if it's not properly vetted.
2nd, why is stuff even allowed to install on it? It's an ATM. See above.
Windows did not fail, BoA's IT policies failed.
Re: (Score:2)
Yeah, guess it doesn't matter he had physical access and passwords to the device.
Security through obscurity is not the solution. Proper IT policies are the solution. This is an ATM; not something that needs to play dancing bunnies. It should not have been possible to alter the system state away from a trusted environment without forcing a crash.
And, by the way, you can do that on Windows.
Re: (Score:2)
Re: (Score:2)
You would be hard pressed to get the death penalty for kidnapping a person you didn't harm.
If you kidnap a school bus of children and bury it in the desert, well that's a different matter.
Re: (Score:2)
What makes you think the Bank manager can do that undetected and alone?
What makes you think you won't be identified? You don't seriously think bank parking lots don't have security cams?
It does happen all that often because security measures have been put in place so it's no worthwhile or practical.
Re: (Score:2)
they probably didn't have a manufacturer of custom hardware, so when the OTS hardware changed with time, OS/2 didn't support the newer hardware and they had to update to a OS that could.