==Phrack Classic== Volume Three, Issue 32, File #6 of 12 +----------------------------------+ ] Exploration of: ] ] Automatic Teller Machine Cards ] ] ] +----+-------------------------+---+ ] Written by: ] ] Jester Sluggo ] ] ] ] Released: May 13, 1989 ] ](to Black-Ice:For Review)] ] Released: Jan 12, 1990 ] ] (to Phrack Inc.) ] ] Released: Nov, 10, 1990 ] ] (to Phrack Classic) ] +-------------------------+ With the North American continent the being the worlds biggest consumer of goods and services liquidity of the banking system has become an important factor in our everyday lives. Savings accounts were used by people to keep money safe and used by the banks to provide money for loans. However, due to 'Bankers Hours' (10 AM to 3 PM) it was often difficult for people to get access to thier money when they needed it. The banking system then created the Checking Account system. This system allowed people to have much easier access to thier money. Unfortunately the biggest drawback of this system is that people can not manage thier own money and accounting procedures. Millions of times each day throughout the North American continent people are writing checks for more money than they have in thier savings accounts. This drawback also causes the already-backed up judicial system to become backed up further. The banking system soon reacted to this problem by producing 'check verification' methods to prevent people from forgery, and overdrawing from thier accounts. "Money makes the world go 'round" and there are many different ways to make this world spin. Today we have checking accounts, credit cards, travelers checks, and the most 'liquid' form of money: cash. Cash transactions are untrackable and widely accepted, so I feel the "Paperless Society" will never happen. Automated Teller Machines provide consumers with 24-hour access to cash-sources. By simply inserting a plastic card into the machine and keypadding-in the owners' "account password", you can access the owners bank account and receive cash in-hand. This file will explain some details of the automated tellers and the plastic card used by the Teller-system. The automated teller is connected by wires and cables to a "Main Computer". During each transaction the teller sends signals to the main computer. The main computer records each transaction (a deposit or withdrawl) and updates the card-holders account. It also sends 'approval' or 'denial' signals to the ATM in regard to the transaction requested. If a card-holder attempts to withdraw $150.00 from his account and he has only $100.00 in it, the main computer will tell the ATM to deny the transaction. The ATM has 2 compartments to store cash in. The first is the "deposits" compartment. This is a small area that receives the daily deposits. It is located in the upper-part of the machine, near all the mechanical devices. However, because most ATM transactions are withdrawls the complete bottom-half is filled with cash where the withdrawls are extracted from. The plastic card inserted into the machine is the same size as a credit card. The front of the card is embossed with information about the card-holder. The back-side of the card has a thin strip of magnetic tape which also holds some important information. +--------------------------+ +--------------------------+ ] CIRRUS ] ]--------------------------] ] INSTANT CASH CARD ] ]/////(magnetic strip)/////] ] ] ]--------------------------] ] Acct: 12345675 Exp. ] ] ] ] Joe Schmoe 01/91 ] ] "card-holders signature" ] ] ] ] ] +--------------------------+ +--------------------------+ Front-side Back-side When a cardholder inserts his card into the machine and requests a transaction, the machine reads the embossed information from the front-side and compares it with the data stored on the magnetic strip; looking for a 'match' of the information on both sides. The information on the front-side is easily readable with your eyes. However, you can not read the data on the magnetic-strip so easily. You may ask , "What is stored on the magnetic strip ?". The answer is; the same information as the embossing plus some 'confidential' information regarding the cardholders' financial status is stored there. The magnetic strip has 3 "tracks" on it. The first track can store 210 BPI (Bytes per inch), and the second stores 75 BPI, and the third stores 210 BPI. So, we have: +---------------------------+ Track 1: (210 BPI density) +---------------------------+ Track 2: ( 75 BPI density) +---------------------------+ Track 3: (210 BPI density) +---------------------------+ THE MAGNETIC STRIP Now, here's the information stored on each track of the strip in my example: Track 1: " ;B 12345675 ^ Schmoe/Joe ^ ; LRC " Track 2: " ;12345675 01/91 ^ 1234 ^ (discriminate data) ; LRC " Track 3: " ;12345675 ^ 01/91 ^ 5 (discriminate data) ; LRC " Here's the decoding of the above information: Track 1: ";" = Beginning of the data character "B" = Field-Control Character: I believe this character tells the ATM what type of account (or status) the user has. "12345675" = This is the account number of the cardholder. "^" = Data-field seperator. "Schmoe/Joe" = Last/First name of cardholder. "^" = Data-field seperator. ";" = End of data character. "LRC" = Longitude Redundancy Check (end of track character). Track 2: ";" = Beginning of data character "12345675" = Account number of the cardholder. "01/91" = Month/Year the card expires. "^" = Data-field seperator. "1234" = Process Identification Number (The cardholders 'password', I think... or it could be a number to verify the the transaction between the ATM and the Main Computer). "^" = Data-field seperator "(dscrmn. data)" = Discriminate Data. Not much is known exactly what is stored here. Perhaps Bank Identification data or bank account type (savings, checking?) ? ";" = End of data character. "LRC" = Longitude Redundancy Check. Track 3: ";" = Beginning of data character. "12345675" = Account number of the cardholder. "^" = Data-field seperator. "01/91" = Month/Year the card expires. "^" = Data-field seperator. "5" = The crypting-digit. When the transaction request is sent to the main computer, it is encrypted. This digit tells which encryption-key is used. "(dscrmn. data)" = A duplicate of the discriminate data stored on Track 2. ";" = End of data character. "LRC" = Longitude Redundancy Check. When the card is being processed the ATM tries to match the account number, expiration date and name stored on each track. The reason they duplicate data is for verification purposes. But, notice that the duplicate data is stored on different tracks, each having different recording densities. Once the information on the tracks are confirmed to match, the ATM compares them to the embossed information on the front-side. If all of the information matches then the transaction will proceed. If it doesn't match, then the card is considered to be damaged and the ATM will keep the card. It will give the cardholder a piece of paper instructing the user to notify the bank who issued his ATM-card so he can receive a replacement card in the mail (this process takes about 3 weeks). Now that you know how the ATM-system is designed and what information is kept where on the card, what "security defects" does this system contain ? I will outline 4 methods of attacking this system that have been tried (not by me!). 1) Vandalization: If you want, you can break-in to the ATM. However, most ATM's contain 'sensor' devices which sound an alarm when this is tried. Therefore, if you're going to try this method I do not suggest using a hammer and chisel on the ATM because it will take 1/2 an hour to get the machine open and by that time the police will be there. You could try a much faster way, dynamite; but that might scatter the money all-over, making it hard to collect. Also, the bottom-half is where most of the money is stored (unless you happen to choose a machine that has issued all of its withdrawl-cash) so you'll want to break into the bottom-half of the ATM. In relation to this, you could wait outside the ATM for a valid-user to complete his withdrawl-transaction and mug him. As far as I know, the bank holds no responsibilty for placing the ATM in a 'secure' enviroment. However, usually they will have lights nearby and placed in 'reasonable' places where people need money (example: Grocery store) and where the chance of mugging is slim. 2) Physical Penetration: There are several ways of doing this. If you have a stolen card, you could randomly try guessing his account-password. But, I feel this is a primitive method. If you try too many attempts at guessing the 'password', the ATM will return the card to you. But, your attempts *might* be recorded in the central computer; allowing the bank to decide whether to cancel that card... However, this has not been verified by me. If you do get a cash-card, you can make counterfeit-cards. A) Counterfiet ATM-cards: The same method for producing counterfiet credit cards applies to ATM-cards. If you have a valid ATM-card you can 'clone' it simply by embossing a blank-card with the same information. Copying the mag- netic strip is also easy. To do this, you place a blank strip of the magnetic tape on top of the valid magnetic strip. Then, using an iron on low-heat, gently rub the iron across the two strips for a few seconds. Lastly, peel the new strip apart from the valid one and you've got a copy of all the data from the valid ATM-card. B) Also, I've heard a case where some guys had a machine that could read and write to the magnetic strips (probably they were employees of a company that produces the ATM-cards). Using this machine, they were able to create and change existing data on ATM-cards (such as the expiration date so they could keep using the same card over a long period of time). In relation to this there are other devices available that can read and write to magnetic strips. Using your own microcomputer, you can buy a device that allows you to read and write to these magnetic strips. It looks similar to a disk drive. If you're interested in exploring this method, I'll suggest that you contact the following company: American Magnetics Corporation 740 Watsoncenter Road Carson, California 90745 USA 213/775-8651 213/834-0685 FAX 910-345-6258 TWX C) WARNING: During each transaction attempted on an ATM a photo of the person requesting the transaction is taken. How long this film is stored is unknown, but it probably is different for each bank (unless there is a federal regulation regarding this). Also, it is possible that this is not done at all ATMs. 3) "Insider" Theft: The above case also crosses over into this section. The biggest 'security leaks' in any company are its employees. This is also the easiest way to steal money from ATMs. The man who collects the deposits from the machine and inserts cash for withdrawls has the easiest and most open access to these machines. I was told that this person can easily steal money from ATMs and not be detected. Another person with access to these machines is the technician. The technician who fixes ATMs is the most-knowledgeable person about ATMs within the bank, therefore he should be a trust- worthy guy and receive a 'comfortable' salary.. otherwise he'll begin to collect 'retirement benefits' from the ATM and this may go undetected. However, I have heard of some embezzlement-cases involving ATMs, so I think it's not as easy as it seems. It's only common sense that a bank would account for every dollar of every transaction. Whether the accounting is done inside the ATM or the main computer doesn't make a difference... some form of accounting is *probably* done. 4) Data-link Intercept: This method has been very successful. What you do is 'tap' into the wires that connect the ATM to the Main computer. By doing this you can intercept and send signals to the ATM. However, some 'inside information' is needed because the transmission is encrypted (refer to the Cryptography Digit stored on the magnetic strip). But, I think you don't need to know *everything* being transferred. You should need to know when to send the 'approval' signal to the ATM telling it to dispense its' cash. I read a case (it may be in Phrack World News; 1985?) where some guys netted $600,000 from various ATMs using this method. This seems to be one of the better, and more ingenious methods of stealing from these machines. The information in this file should be 'adequate' to introduce you to how ATMs work. How did I get this information? I went into a bank and inquired about the computer-technology of ATMs. The man who was responsible for the ATMs was a bureaucrat and actually knew very little about the 'guts' of ATMs. Luckily the ATM-technician was there that day and I agreed to buy him dinner later that evening. (Please refer to: "Insider" Theft and the principle of Company-Loyalty). During the dinner at "Toppers" (a neat 1950's Burgers/Milkshake/Beer restaurant) he provided me with Operation and Repair manuals for the ATMs. I feel this information is well-worth the $3.82 dinner and will be of some value to its' readers. Some good information was screened-out due to its 'delicate nature', but the information I've provided has been confirmed. +---------+ ] CREDITS ] +---------+ The Mentor (Phrack #8, File #7; "Fun with Automatic Tellers") Deserted Surfer Hyudori Lex Luthor Please distribute this file in its complete form. _______________________________________________________________________________ Downloaded From P-80 International Information Systems 304-744-2253 12yrs+