3 +-------------------------------+ | | | A. T. M. Fraud Made Easy | | | | summary and research by | | Count Zero | | | | (A CHiNA Info-Net Prod) | | | +-------------------------------+ Have you ever looked longingly upon the sight of your local PULSE machine and thought, "There must be some way that I can make some money REAL easy here."? Well, there is. But it won't be easy. Protection methods can be overcome, but the technology involved must be understood IN ITS ENTIRETY before an [PAUSE] attempt at illegal access is to be made. There are hundreds of people, guests of the state, that figured their plans infallible, only to fall victim to a well-hidden camera. This article will not be a lesson on HOW to break into the machine, it is merely a summary of the operations involved with a normal ATM transaction. This information is being presented on a "for information's sake"-only basis. I, Count Zero, do not promote nor remotely condone any illegal acts of any sort. So there. I. MAGNETIC STRIP FORMAT This would seem to be the most efficient method of trying to access illegal sums of cash. You could: a. steal somebody's card and PIN code b. synthesize a card c. attempt to "jackpot" the system We will only look at option B. As "A" is up to your own devices and "C" has several good text files written about it already. So "B" it is. [PAUSE] Let's look at the format of the data written to the magnetic strips. This has been taken from a recent HARTWELL, INC manual. [ XX XX XX XX XX XX XX XX ] [ YYYY ] [ - 20 CHARS - ] [ ZZ ZZ ZZ ] [ CC CC ] \-----------------------/ \------/ \--------------/ \----------/ \-------/ Your individual acct. PIN Name of card Bank route CHKSUM number/serial code Code issuee code/rem. access # For validation, each entry is written twice but not written here for ease of typing. But it is repeated in the form of: "ACCT NUM" "ACCT NUM" "PIN CODE" "PIN CODE" etc... These codes may be examined by building a simple code-reader as many have done which can be easily interfaced to your IBM-PC. Full plans to be put into a future CHiNA newsletter. If you were to attempt to write a magnetic strip or change a currently existing one, you would need to be using a head-write circuit based on the popular Motorola BCX119221-A...C series of head control chips. NOTE: Make sure to change the last 2 values! They constitute the checksum of the entry. Merely add all existing characters written (only the first entry, not both [PAUSE] of them) using the following chart: CHARACTER VALUE -------------------------------- 0..9 0..9 A..Z 10..36 EOL 37 EOT 38 CLR 39 HMX 40 PTT 41 RIA-1 42 RIA-2 43 I doubt anyone in the communications biz needs an explanation of these terms so I'll move on. II. ATM HARDWARE Usually consists of: ------------------------------------ | | [PAUSE] \-----\ | B | | A | | | \-----\ ------------------------------------ | | | ----------- /---/ E | | / / / / ---- | | / C / / D / F | | / / / / ---- | | ------------ /---/ | | | ------------------------------------ A. Camera Mount B. Hidden Voice-Activated recorder & printout link C. Display Monitor D. Options buttons E. Card Slot F. Receipt Slot Your machine may vary slightly. But the concept will almost always hold true. Simple rules for each. A. Wear a paper bag or mask. See also Part II A [PAUSE] B. Do NOT speak. This is the most crucial part! See also Part II A C. Nothing D. Wear gloves E. See Part I F. TAKE YOUR RECEIPT AND BURN IT!! One of the neat flaws in many machines made prior to 1989 involved the use of the "CANCEL" button. This button was made to be pressed when the user decided, at any time during the transaction, that he didn't wish to continue. The display would jump immediately to: "TRANSACTION CANCELLED - CHOOSE ANOTHER?" This was all well and good, but the machines did not disable this feature between the time your cash was dispensed and you were prompted for your next activity. In effect, you could push the "CANCEL" button after your money has been withdrawn and it would not be added to your account record! THIS STILL WORKS IN MANY PLACES! OVER 85% OF ALL MACHINES MADE BEFORE MAR. 1989 STILL HAVE NOT BEEN UPGRADED. Although most machines of that period would only work if you were withdrawing amounts larger than $20 (usually $25 is the next possible choice!) [PAUSE] This is ideal if you are using another's card! II A. CAMERA/SOUND HARDWARE You can go other routes when dealing with camera systems. You do not have to wear a bag on your head (unless the cosmetic improvement is quite large) Thin alloy metal such as common aluminum/tin foil, which are full of impurities, react in a bizarre way when photographed through the special lenses that are commonly used. The effect is to "blur" or "bleed" the image, rendering it indestinguishable from an accident in your local Sherwin-Williams store. Most people prefer to make a "headband" of this metal, lined with copper wire in a sine wave pattern when accosting a machine. You should seriously consider this possibility! For further reading on this subject, consult: BANKER'S WORLD - Apr 1989 "Where Have All the Dollars Gone?" pp 24-29 P. I. - Apr 1989 "The Last Straw" pp 37-41 (p 38 in particular has a nice [PAUSE] diagram. Fig 1) Sounds, these articles also suggest an indirect method of dealing with the voice-activated recording device. Oddly, a pure square wave tone (roughly around 3100 hz) will cause a major screwup in the sound-sensing abilities of the recorder. It usually will have to be replaced. Suggested volume, given at 6" range is 8.5+ db. Obviously, anything louder will do. An interesting side-note is that this has become a past-time of suburban teenagers! Well, hope this gets you started! More will be coming in the next exciting file! ---------------------------> OVER AND OUT! -----------> COUNT ZERO HAHAHAHA NAPPA IS A BUNCH OF FLY-BY-NIGHT LOSERS, EH CONFLICT?! Call us on: HYPERCARD BBS (406) 538-2101 1200/2400 BAUD (CHiNA Node #3) SYSOP: GEORGE VON JUNGLE [PAUSE] FAWLTY TOWERS (202) 781-6420 2400 BAUD ONLY (CHiNA Node #9) SYSOP: BASIL FAWLTY A big hello to: Rubix the Cube, The Conflict, Monalisa Overdrive /e +- Shamelessly Leeched from The Mudd Club -+ Press a key... CHiNA Discussion [5]: 2 of 2 [Message Bases [5-2/ Which G-file (Q=Quit) ? X-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-X Another file downloaded from: NIRVANAnet(tm) & the Temple of the Screaming Electron Jeff Hunter 510-935-5845 Burn This Flag Zardoz 408-363-9766 realitycheck Poindexter Fortran 510-527-1662 My Dog Bit Jesus Suzanne d'Fault 510-658-8078 New Dork Sublime Demented Pimiento 415-864-DORK The Shrine Tom Joseph 408-747-0778 "Raw Data for Raw Nerves" X-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-X