Eye on ATMs: Pass Code Hacker Fallout, Chase Network Expansion

A security expert says publicity about a hacker who was able to trick a cash dispenser into giving out four times as much cash as it debited may do some good in preventing this type of fraud. “I think awareness will go up because of this, and that's half the battle,” says John Abraham, president at Redspin Inc., Carpinteria, Calif. The awareness he's referring to is of the issue of the default codes set by ATM vendors, which often go unchanged when machines are put into service. In August, a man who had gained access to a default administrative pass code for a Tranax Technologies Inc. Mini-Bank 1500 walked into a Virginia Beach, Va., gas station and reprogrammed the machine to debit his prepaid debit card account only $5 for each $20 bill it dispensed. The incident sparked considerable interest among security experts not only because the default code was apparently available on certain Web sites but also because the machine's deployer hadn't changed the code. “In general, this is a common issue,” says Abraham. “It is the administrator's responsibility to change the password when they deploy the device. There are public data bases, hacker data bases with default passwords. These passwords do leak out.” Abraham recommends vendors do more to educate deployers about the need to change the codes, particularly since many machines are deployed by small businesses that may not be aware of the problem or may lack the resources to attend to it. Tranax, which has an installed base of some 75,000 machines, has gone a step farther and announced it will issue a patch that will require a pass code change. Each deployer will have to install the patch, however. In other ATM news, JPMorgan Chase & Co. said on Monday that customers of Bank of New York's retail-banking unit, which Chase has acquired, have gained access to 2,200 ATMs in New York, New Jersey, and Connecticut, up from 400. The 700,000 customers, which include small businesses, will also have access to Chase's network of 8,300 machines by next spring, the banking giant says. In an acquisition that closed Sunday, Chase took over Bank of New York's consumer, small-business, and middle-market businesses. The acquisition includes some 339 Bank of New York branches, which will be rebranded and converted to Chase's network in the spring. By then, the bank says, customers will have access to more than 750 branches in the Tri-State area and over 3,000 in 17 states.