ATM Maker Publishes Password; Thief Appreciates The Courtesy

Written by Evan Schuman
May 6th, 2010

The popular IT directive to “RTFM” was taken to heart by one cyberthief, who read the manual from an ATM manufacturer to learn its machines’ default password and the key sequence to access that machine’s programming. Having gained that access, according to an FBI affidavit, the cyberthief was going to tell the machine it was loaded with one-dollar bills—instead of the 20s it really held—which would allow him to boost his original investment 20-fold.

The man arrested, Thor Alexander Morris, said he worked at a Food Lion in North Carolina as a manager. Morris used Wal-Mart Green Dot Pre-Paid cards ($400 each) and a false ID to purchase those cards.

The FBI said Morris’ plan was to attach GPS tracking devices on the vehicle of an ATM maintenance person working for ATM manufacturer Tranax and hit some 35 ATMs in Houston while wearing a wig, a goatee and different clothing as a disguise. For added protection, he was using a police scanner to get an early heads-up if Houston police patrols got too close.

As if this scenario isn’t already too James Bond-like, Morris had a suit jacket altered “with the pocket deepened to conceal large amounts of money,” the federal affidavit said.

By the way, the false name he successfully gave to Wal-Mart for the Green Dot cards? Barack Obama. Morris also used the actual White House address. He even accessed the site—to complete the form—from someone else’s unsecured wireless Internet connection for added security. The connection Morris chose was from an apartment building, having bypassed open wireless access points at Wal-Mart, McDonald’s, Pizza Hut and the International House Of Pancakes, among others.

If Morris hadn’t been plotting this attack with an FBI informant and an undercover FBI agent, the plan would likely have resulted in a more profitable outcome.

With the government along for the show, Morris approached his first ATM and pressed the Enter, Clear and Cancel buttons and then the 1, 2 and 3 keys before typing in the default password. But bank officials, tipped off by the feds, had already changed the password.

The frightening thing about this hack attempt—beyond the fact that this ATM approach could be tweaked for many other retail devices—is that all the GPS tracking, goatee-wearing and scanner-monitoring tactics would have done nothing had Morris not had the machine’s default password and access sequence. And that information was generously provided to all who bothered to read the manual. Granted, this courtesy needed to be matched by another courtesy from the retailers and banks housing the ATMs: namely that they not change the default password. Fortunately for thieves everywhere, there’s not much chance of that happening.


5 Comments | Read ATM Maker Publishes Password; Thief Appreciates The Courtesy

  1. Greg Litchfield Says:

    Are you sure it wasn’t the real Barack Obama, perhaps researching a new revenue stream for the IRS?

  2. Sean McDermott Says:

    I thought this sounded familiar so I quickly googled tranax default password and found the same thing happened in September 2006. Back then, Tranax promised a software patch for their ATMs that would force a default password change. Guess that didn’t go too well…

  3. Wilson Says:

    This article makes it sound like the manual shouldn’t have the default password. The duty, clearly and simply, is people should NEVER USE A DEFAULT PASSWORD, it is just that simple, and that virtually any ATMs are left with a default password is absolutely beyond me as it seems quite clear that is fundamental security for such an important device.

  4. Me Here Says:

    Would be even funnier if the thief actually wore a Barak mask… Just another way the government steals your dough. Banks are allowed to make too much money. Literally!!!

  5. cestmoi Says:

    and THAT IS WHY folks that applications nowadays must come with a forced password default change upon first log-in… to prevent laziness… all apps should follow the PCI requirement of minimum of 7 characters alphanumeric and cannot reuse the last 4 passwords.


StorefrontBacktalk delivers the latest retail technology news & analysis. Join more than 60,000 retail IT leaders who subscribe to our free weekly email. Sign up today!

Most Recent Comments

Why Did Gonzales Hackers Like European Cards So Much Better?

I am still unclear about the core point here-- why higher value of European cards. Supply and demand, yes, makes sense. But the fact that the cards were chip and pin (EMV) should make them less valuable because that demonstrably reduces the ability to use them fraudulently. Did the author mean that the chip and pin cards could be used in a country where EMV is not implemented--the US--and this mis-match make it easier to us them since the issuing banks may not have as robust anti-fraud controls as non-EMV banks because they assumed EMV would do the fraud prevention for them Read more...
Two possible reasons that I can think of and have seen in the past - 1) Cards issued by European banks when used online cross border don't usually support AVS checks. So, when a European card is used with a billing address that's in the US, an ecom merchant wouldn't necessarily know that the shipping zip code doesn't match the billing code. 2) Also, in offline chip countries the card determines whether or not a transaction is approved, not the issuer. In my experience, European issuers haven't developed the same checks on authorization requests as US issuers. So, these cards might be more valuable because they are more likely to get approved. Read more...
A smart card slot in terminals doesn't mean there is a reader or that the reader is activated. Then, activated reader or not, the U.S. processors don't have apps certified or ready to load into those terminals to accept and process smart card transactions just yet. Don't get your card(t) before the terminal (horse). Read more...
The marketplace does speak. More fraud capacity translates to higher value for the stolen data. Because nearly 100% of all US transactions are authorized online in real time, we have less fraud regardless of whether the card is Magstripe only or chip and PIn. Hence, $10 prices for US cards vs $25 for the European counterparts. Read more...
@David True. The European cards have both an EMV chip AND a mag stripe. Europeans may generally use the chip for their transactions, but the insecure stripe remains vulnerable to skimming, whether it be from a false front on an ATM or a dishonest waiter with a handheld skimmer. If their stripe is skimmed, the track data can still be cloned and used fraudulently in the United States. If European banks only detect fraud from 9-5 GMT, that might explain why American criminals prefer them over American bank issued cards, who have fraud detection in place 24x7. Read more...

Our apologies. Due to legal and security copyright issues, we can't facilitate the printing of Premium Content. If you absolutely need a hard copy, please contact customer service.