start	end	text
12640	14700	I thank you.
15400	21740	This will be a technical talk, but it's a technical talk being delivered at DefCon.
22200	24720	So, you take your chances.
26580	28520	Am I close enough?
30460	32240	I don't know.
40860	42860	I think it works.
43340	44800	Does it work?
45500	47100	Great, okay.
47100	54280	What I said was, this will be a technical talk, but it is a technical talk at DefCon.
54720	58420	So that makes it a little bit special.
59500	64880	I'm going to talk about the ATM machines.
66220	71260	That's where I get all my money. I don't know about you, but if I need some money...
71260	72500	Louder?
74360	77260	I think, well, okay.
82740	88140	The ATM machines and the ATM system.
88460	90880	I'll be talking about vulnerabilities.
90880	94140	Now, this is going to be good. Pay attention.
95700	100540	I'm going to tell you how to avoid being cheated by the ATM system.
100540	104180	People lose an amount of money that you just wouldn't believe.
104180	107900	It isn't just millions per year. It's more than that.
109460	114180	I don't have an accurate figure, but then I'm not a bank, so I don't care much.
116820	119760	Of course, the other banks don't care much either.
121120	127320	Now, here I am. I'm standing in front of one of these here ATM machines.
128800	131920	And, louder again, oh Lord.
134240	144400	Well, okay. I'm standing at an ATM machine in the little town of Kirkenes, Norway.
145140	152180	Now, most of you have probably never heard of Kirkenes, but it is the furthest north city in the world.
153000	160080	It is an amount above the Arctic Circle that I just don't even know.
160740	170080	A story about Kirkenes. It's hard to get any sleep there because if you visit in June, the sun never goes down.
170540	177380	Well, around midnight, I was walking around the town and talking louder and louder and louder.
177380	185740	I was talking to a lady who I suppose lived there, and I asked her, what country is this?
186300	188220	And she said, well, I'm not sure.
190220	196680	And went on to say, well, Norway plows the snow. Does that answer your question?
196780	200080	Well, partly it did, and partly it did not.
200280	212200	But the point is that I wanted some money, and I went to an ATM machine in this, not God forsaken, that wouldn't be right to say that,
212200	220920	but a little town in extreme northern Norway, not very far from North Cape.
221000	227540	North Cape, in fact, is the furthest north land in Europe.
229080	231040	I wanted some money.
231200	233450	Okay, so I go up to... yeah, hey.
234600	239470	You've got to continually, during this, remember Willie Sutton.
239470	244310	Willie Sutton was asked, why do you rob banks?
245370	247010	And you know the answer.
247010	248390	Because it's there!
248590	250670	Yeah, you got it.
251770	258830	Well, that's changed a little bit, and I'm talking about the slightly changed arrangements nowadays,
258830	264310	in that it's not any longer really true that the money is in the bank.
264310	267270	The money is actually in the ATM machine.
267270	275730	And if you go up to a bank on Friday afternoon before a three-day weekend,
276150	284610	you will find that the ATM machines at the bank have a lot more money than the bank had at any time during the week.
284730	287970	The amounts tend to be really enormous.
288490	296610	For a three-day weekend, having $10,000 in the ATM machine is simply not enough at most banks.
297650	303410	Okay, so what I do is, I stick a card into the ATM machine.
303570	305030	And this is a card...
306110	307790	You're going to say it louder.
312020	313940	I may need help.
315400	318800	I'll appeal for help if this gets much worse.
319320	321820	So I stick a card in the machine.
321820	327820	And this is a card that was issued to me by my own bank somewhere in central New Hampshire.
327820	336780	Now the connection between extreme northern Norway and central New Hampshire is not particularly obvious.
337380	341760	They are distant from almost any point of view that you take.
344180	348720	The card that I was issued has a magnetic stripe on the back.
348720	365500	And as it turns out, what's in that magnetic stripe is simply an address for the bank and some other information about the bank and the account associated with that card.
367900	370800	That's on that magnetic stripe on the back.
370800	379160	Which you ought to learn more about from somebody else because there are some real problems associated with these stripes on the backs of cards.
379380	385220	The machine then asks me for a pin and asks me how much money do I want.
385860	391000	Hey, being a fairly honest guy, I'll tell them I want a reasonable amount of money.
391420	395020	If I was different, I would say, well, just give me all of it.
396100	397720	Some people do that.
401560	410380	Now, the machine, after it's got the pin, gurgles for a while.
410380	422140	And then in a surprisingly short period of time, usually of the order of 10, 20, 30 seconds at most, delivers the money to me.
422740	429960	Since I was in Norway, of course it delivers Norwegian kroner, whatever a kroner is.
431900	436580	I suppose in English it would be called a crown, but it's not that big a deal.
438380	456760	So after I put my card in the machine, type in the four-digit pin, I walk away and the machine is now happy and the transaction is completed after it delivered me my money.
456760	474860	Now, one question I have is that in this whole transaction, where I inserted a card into the machine, typed in a pin, and undoubtedly there were messages going back and forth between various banks and things of that sort,
475800	478200	a real question is, what happened?
478520	484380	And to some degree, I'm going to leave that as a homework exercise for you, it's not easy.
484380	500520	A surprising amount of attention has to be paid to actually who knew what at the beginning of this process and what they found out, what information they sent and what information they received.
500700	504300	Which I'll sum up by saying, what happened?
504300	519740	It is not particularly easy. In fact, obviously the bank in extreme northern Norway never heard of a bank in the boondocks of central New Hampshire.
519860	532340	So somehow or other, messages had to be transferred back and forth between these two entities, which are not, from any other point of view, close to each other in any possible sense.
532340	543820	And so you have to remember that it's not clear with these messages just who is sending it to who and what information is being sent.
543820	548560	That's the thing you have to think about. And I will help with that.
549760	569740	Now, the parties to this overall transaction are me, that's the guy standing in front of the ATM machine, the bank in Norway that owns the ATM machine and the bank in New Hampshire of which I am a customer.
570680	577420	This is all not supposing, nobody was telling any lies or anything of that sort. It's all straight stuff.
579480	589240	Now, there are a number of requirements that are particularly obvious as this transaction goes on.
589720	597560	And the parties to this transaction have their own needs that may well not intersect to any degree.
598080	610840	The customer, that's me, wants some money and does not want, obviously, the system to drain his checking account, which is the kind of thing that might happen.
610840	626820	I mean, you guys know about identity theft. Well, this is the same general kind of thing, differently detailed, but about the same in the general sense that you wind up with a heck of a lot less money and somebody else winds up with a heck of a lot more money.
628740	636700	But the other... so I just want the money and I don't want the system to drain my checking account.
637060	652700	I also probably don't want my PIN to be broadcast all over the world. The PIN is something I care about and I would prefer to keep that a little bit close to the chest.
653860	671120	The bank in Norway has just distributed a thousand dollars or so, I'm sorry, a thousand kroner or so, and it wants some assurance that it's going to get back its money.
674060	682420	And that's about it. I am not a customer of this bank, so it doesn't care about me very much. It knows that I'm not a customer.
682700	687800	It mostly cares about its own customers, not about me.
689460	703580	The bank in New Hampshire, I am a customer of that bank. They want to keep me reasonably happy, but they've got some other problems facing them.
703580	716920	They have to make sure that I am really who I say I am and that I've actually got the money in the account to pay this amount out.
720560	732180	So it doesn't want any responsibility, for example, of a customer. A customer is actually not the person that he claims he is or she.
734960	745300	The bank in Norway simply wants the whole transaction to settle down with it not either gaining or losing any money.
745300	758760	Again, I'm not a customer of that bank, but it mainly wants to make sure that it is someday reimbursed for the money it gave me.
758760	767600	It gave me a thousand something or others, a thousand kroner, and it wants to get that back somehow from the ATM system.
767600	781940	Now the ATM system is a very large, very widespread system that exists all over the world, in fact, and I have used it in quite a few foreign countries, including Norway.
784860	798920	So there are three pieces here. There's the ATM machine that you're standing in front of, the ATM system that in some sense is worldwide or very nearly worldwide.
799120	808580	I know that it works in almost any European country. I was in Hungary last week. I didn't try it there. I don't know what would have happened.
808580	823400	I guess. When I was staying in Budapest, I asked, is the hotel air-conditioned? The answer was, well, it has Hungarian air-conditioning.
824680	839840	Nice place, very pretty place. It does... and it's not a third world country by any means, but it is not quite up to our standards for high range hotels.
840800	860720	Okay. We have these parties to the transaction. Me, the ATM that I'm in front of, the bank that owns the ATM, and then some network that I'm not going to describe.
860720	872600	It would bore you to tears. It actually connects all this together in a worldwide sense. And I'll call that just the ATM network. It is important.
872600	884160	Without that, you wouldn't be able to use the ATM card in a whole lot of places without the ATM network existing.
888980	896860	Well, what does one have to do to make all this work out?
898560	919800	When you type the PIN into the ATM that you're standing near, right behind you, over your right or left shoulder, there is a person who is busily writing down the PIN you typed, which you can easily see over your shoulder. Fine.
919800	938620	It's called shoulder surfing. And that is actually a major loss to the financial system because that kind of thing happens much more than you would believe. It is not just millions of dollars, it is more than millions of dollars.
941080	949480	And that is the first vulnerability I'd like to talk about, and it is a serious vulnerability.
949880	962420	I would advise you when you're at an ATM and about to punch in your PIN, just look over your shoulder, both shoulders, and see who is there copying it down.
963400	978760	This is not unusual. It has not happened to me, but it has, for example, happened to my wife, where someone managed to see what PIN she was typing in and used it to extract quite a lot of money from the system.
978760	995380	There is normally some limit of the amount that you can get out of ATMs per day, and that limit is designed so that you don't go broke if somebody steals your PIN or your card. You just get a little bit poorer.
996400	1000260	So that is the first vulnerability.
1003100	1012060	There are others. I was in... why am I talking about Norway? Well, because I spent a lot of time in Norway last year.
1012060	1035340	I walked up to an ATM machine in Bergen, that's in Norway, and I put in my card. It told me to punch in my PIN. I punched in the PIN. It gurgled for a while, and then said, sorry, we can't pay you.
1035880	1049420	Eh? It's got all the information on my card, which tells it all about my bank account. It's got my PIN, and now it tells me it's not going to complete the transaction.
1049420	1075940	What I did may seem a bit extreme to you, but I called the police, told them, and also pointed out to the bank, which arrived just behind the police, that right near my right hand was a fire axe, and if it didn't give me my card back, I was going to use that fire axe.
1077140	1093760	Actually, they came in and gave me the card back, and in fact, no money had been withdrawn, so the whole transaction ended just fine. But still, a fire axe did enter the negotiations.
1103220	1129790	What does this say? Why do my notes say, at this point, forklift truck? Forklift truck? Give that man a prize. Definitely.
1130750	1151890	Forklift truck deserves to be at this point in the presentation, because it is the principal tool for cheating ATM machines. You slide it in, lift, slide it back, put it in the truck, drive away, and at home, all you need is an acetylene cutting torch, and you have the thing open in 20 minutes.
1153610	1174990	So, forklift trucks are part of... by the way, I have promised, and I will tell you before the end of this talk, important things you should do and not do when dealing with ATM machines, because I mean to send you away knowing a good deal more about the down-to-earth vulnerabilities of ATM machines.
1174990	1208770	None of this high-flown theoretical stuff, just things like forklift trucks. It's important, and people do that. I can't estimate what the losses are to forklift trucks, but they do exist, and it is mainly, in fact, an American habit.
1208770	1216250	I have a slightly different habit, and that is... why am I all of a sudden louder? Somebody turn me up.
1224020	1235540	The best deal at this point is you want to get money out of an ATM machine.
1235540	1245120	You go to eBay, and on eBay you buy an ATM machine.
1245800	1257500	Hey, they'll sell it to you. They really are there, and they don't cost very much. It's actually in the general range of $10,000 for an ATM machine.
1257500	1271740	Now what you do is you install that ATM machine right over there in some obvious place where people pass by, and the ATM machine is reprogrammed.
1271740	1274720	It's not a difficult reprogramming job.
1274720	1282360	When somebody puts their card in, punches it in the pen, it says, sorry, try again tomorrow.
1284120	1287780	If you don't happen to have a fire axe, you've got a problem.
1289500	1296200	But that is probably more the British scheme than the U.S. scheme, though it doesn't matter very much.
1298740	1306480	So what you have with this scheme is just you have a new machine.
1307280	1317900	And I would advise you that if you see an ATM in a place where you've never seen one before, don't use it.
1321660	1327760	Well, again, I'm giving advice, but what can I say?
1328020	1340680	You want to take a look. In fact, in the town I live in, several times in the last month, in stores and restaurants that I normally go in, I've seen new ATM machines.
1340700	1343080	I don't have any reason to believe they're fraudulent.
1343080	1347480	On the other hand, I also don't have any reason to believe that they're honest.
1347480	1350020	So I typically do not use them.
1352200	1364540	So pay some attention to the place that the machine is, and if you run into a machine that you haven't seen before, it would be wise not to use it.
1364540	1376680	Another problem associated with the whole business of ATM machines, and it includes problems with debit cards and things of that sort also, is banks.
1377080	1386360	Big deal, honest banks all over the world, but I mainly know it from the U.S. and U.K.
1387120	1401300	If you point out to them that they did not give you the money that you deserved, and you've got fraudulent charges on your debit card or checking out through the ATM machine,
1401300	1406800	they will simply lie about what has happened.
1406800	1419020	There's several famous cases, both in the U.S. and in the U.K., where it was perfectly clear that the problem was solved by the bank software,
1419020	1443480	and the bank denied that it possibly could happen, and simply said that if the customer is claiming to have lost money through an ATM machine or a debit card, that the customer is lying.
1443480	1450520	One of these cases actually came to court and was well defended, and the bank lost very big.
1450520	1461260	They still try to do that, but they do it with much less success now, because after one big case has gone against them, it makes it more difficult.
1461260	1473400	What they did in the first case was actually filed a criminal complaint against the person that was complaining about the loss of money in the ATM system.
1473760	1476360	And that seems a little bit outrageous.
1482670	1488810	I better finish all this technical stuff so I can give you all this valuable advice that you want.
1498020	1524600	The way that the system works, the first thing that happens when you begin an ATM transaction is that the bank associated with the ATM machine you are using sends a message to the bank that issued the ATM.
1524600	1532740	And there is not much that needs to be said at that point, and in fact, essentially nothing is said.
1532800	1540600	The message that goes from the ATM machine through the ATM network to the issuing bank simply says,
1540600	1543520	Hello, I've got a message for you.
1543700	1557940	The response is that the bank dreams up an encryption key and sends that key back to the customer.
1558380	1562560	This is fairly standard stuff nowadays in cryptography.
1562560	1581800	There are any number of ways associated with cryptographic schemes where encryption and decryption, one is much more difficult than the other.
1582800	1595130	So that all you need to do is send one party to send a key to the other, and now transmissions in the other direction become much, much easier.
1595640	1602140	And this is not only a common but almost universal practice in cryptography nowadays.
1609090	1616000	Okay, look over your shoulder when you type in the PIN. Important.
1621130	1632470	Pay some attention to the place where you see the machine, and if you recognize something as being a new machine, go somewhere else.
1641170	1661150	A stolen card is not a terribly big deal. I don't know about you generally, but my bank will only let me withdraw $200 per day through the ATM system, which means that the amount of loss is relatively limited.
1661150	1664130	I mean, that's annoying, but not absolutely disastrous.
1665730	1683930	Another piece of advice, though, is the ATM machines, mostly after they give you your money and that kind of good stuff, and give you your card back, one hopes, give you information in the form of a receipt.
1684130	1690090	The receipt talking about what the account was, what the amount was, what the date was, things of that sort.
1690090	1698590	And my advice about that piece of paper, that receipt, is don't leave it next to the machine.
1698590	1703830	Don't simply drop it. Take it with you. Take it away from the machine, take it with you.
1703830	1716290	Because that plus the four-digit key, which the same guy has just read over your shoulder, is enough for him to drain a good deal of money out of your account.
1716290	1723190	So, when and if a receipt appears, take it with you, don't leave it at the machine.
1723670	1731210	And that makes it much more difficult and much more inconvenient for anyone to drain the account.
1734390	1740570	The other advice is, I assume that some of you are going to need money in the next few days.
1740570	1752610	Yeah, almost certainly. I recommend that when you want money, tomorrow and the day after, please get it from the ATM machine in the lobby of this hotel.
1754830	1762230	And I don't need to talk anymore. Does anyone want to ask any questions? Or should I talk about something?
1762230	1772150	I didn't talk at all about cryptography, really. And one of the reasons is that cryptography does not really come up as a prime problem.
1772370	1781470	What the prime problem is, in fact, is key distribution. It's not the algorithm that you use to do the encryption.
1781470	1788290	It's who's got the key and where did that entity get the key is the problem.
1788290	1793870	That's work that Scott's been talking about. And I've run out of data. Thank you for coming.
1794050	1800270	Unless there's any questions. I see no questions. Have a good day.