60-Second Cash Kiosk Hackers Steal $1 Million: FBI

[mahatmakanejeeves]

Source: Information Week

By Mathew J. Schwartz InformationWeek
October 31, 2012 12:02 PM

The FBI has arrested more than a dozen people on charges that they participated in a gang that stole over $1 million via cash-advance kiosks at 11 casinos and resorts.

According to the FBI, the related indictment, unsealed Friday, said the gang "stole the money by exploiting a gap--which required multiple withdrawals all within 60 seconds--in Citibank's electronic transaction security protocols." The gang predominantly targeted casinos and resorts in Las Vegas and southern California.
....

According to court documents, accused ringleader Ara Keshishyan, 29, recruited other members of the gang to open multiple Citibank checking accounts, which he filled with seed money. "When inside the casino, the conspirators, including Keshishyan, used cash advance kiosks at casinos in California and Nevada to withdraw -- all within 60 seconds -- several times the amount of money deposited into the accounts, by exploiting the Citibank security gap they discovered."
....

Attackers are increasingly using a simple method for finding flaws in websites and applications: They Google them. Using Google code search, hackers can identify crucial vulnerabilities in application code strings, providing the entry point they need to break through application security.

Read more: http://www.informationweek.com/security/attacks/60-second-cash-kiosk-hackers-steal-1-mil/240012604

[corkhead]

1. No honor among thieves

Poor Shitibank

[SoapBox]

3. You said it!

[Ikonoklast]

2. But Republicans that steal BILLIONS can't ever be found.

[cosmicone]

4. It is pretty lousy programming.

When one transaction opens, it should lock the account until it is complete before another transaction can be started whether in 60 seconds or not.

[mikeytherat]

5. Exactly. Whatever happened to record locking?

That's old school.

mikey_the_rat

[DoBotherMe]

7. Can citibank make money in 60 seconds?

That would be a reason to overlook security. Dana ; )

[Doremus]

10. Or security costs money they'd rather funnel to themselves than the 99%. nt

[Kelvin Mace]

9. i'm guessing

based on when I worked installing PCs in banks and got to ask lots of questions of the ATM guys that they are sacrificing security for speed. But, this all begs the question: Why is the source code for ATMs on the net? Didn't Diebold learn anything with the voting machine fiasco?

[htuttle]

12. Comp Sci 101

Writing a simple transaction engine that locks the account and avoids issues like this is often one of the class assignments.

Guess the ATM programmers didn't take that class?

[olddad56]

6. they stole the money that Citibank stole from the taxpayers during the bailout.

[dixiegrrrrl]

8. I want to know more about this "security gap"

( pen and paper at the ready....)

[PopeOxycontinI]

11. I bet we see...

a lot of this shit after Sandy. Lots of people camping out at
unsecured wi-fi spots. Easy for a hacker to get your shit that
way.

[Volaris]

13. I know it's tantamount to supporting vigilante justice,

but honestly, I almost can't feel bad for Citibank. Fuck em.

[KansDem]

14. Time to send in...

Robert De Niro!



Anyone got a hammer?