text: Scammers Try to Hack Hackers With Crooked Cash Machine | Security | TechNewsWorld
  July 16, 2019 08:15:32 PM PDT
  Aug 3, 2009 12:16 PM PT
  Fraudsters have been using ATM machines to steal money from users for a long time, but they're getting more sophisticated in their attacks.
  Ironically, a scheduled talk on a new ATM security hole was reportedly canceled because of pressure from the researcher's employer, Juniper Networks.
  ATM frauds have been around for a long time, and one of the simplest and most widely used goes by the colorful name of "The Lebanese Loop."
  Essentially, criminals put a strip or sleeve of metal or plastic into an ATM machine's card slot. This prevents the machine from drawing in cards that consumers insert into the slot and sets things up for the next stage of the scam.
  Criminals then learn the victim's PIN number by watching the victim key it in repeatedly. When the victim leaves without the card, which is still in the ATM machine, the criminal retrieves the card and attacks the victim's account.
  In some variants of the Lebanese Loop, the criminals attach a small camera to the ATM to record victims entering their PIN numbers; in others, the criminals attach a fake keypad over the real one, thus capturing victims' PIN numbers.
  "Crooks can copy every single detail of a real ATM," Randy Abrams, director of technical education at ESET, told TechNewsWorld. "You have to pay attention and be alert at an ATM machine."
  "I remember a recent story of ATMs leaving the factory with Trojans preinstalled," McAfee's Marcus said. "You could set them up to capture data."
  Security vendor Trustwave's SpiderLabs recently found malware installed on compromised ATMs in Eastern Europe. The malware captures magnetic strip data and PIN codes from ATMs running Windows XP.
  Barnaby Jack, a staff security researcher, was scheduled to give the talk "Jackpotting Automated Teller Machines," at Black Hat and Defcon.
  "As word spread that Jack would be disclosing vulnerabilities using a real ATM during his demonstration, one unnamed ATM vendor got nervous," wrote Javelin Research's Robert Varnoski in his blog.