Web Extra: Hacking the ATMs
November 8, 2009 5:00 PM
Former State Department official Jim Lewis with extreme--and illegal--examples of getting money from an ATM.
Recent Segments
Scroll Left Scroll Right
-
Web Extra: Bomb Squad Training 3:15 November 15, 2009
-
Web Extra: The Deadliest Job 2:01 November 15, 2009
-
Web Extra: 5 Bombs in Two Days 1:21 November 15, 2009
-
Sabotaging The System 18:36 November 8, 2009
-
Web Extra: Hacking the ATMs 1:32 November 8, 2009
-
Web Extra: The Holy Grail 2:16 November 8, 2009
this guy was pulling some chains big time on this report..and CBS fell for it.. 'a grocery store where.. blah blah..' (never mentioned which).. 'and the money was sent to Pakistan..' from an ATM.. listen to this drivel..
I refer those of you old enough to recall the book "The Peter Principle" to the basic premise of the author; "In any hierarchy, people tend to be promoted to their level of incompetence." In other words, the mnechanic now promoted to Service Supervisor may have been excellent at repairing cars, but now has to deal with customer relation and management issues, things they are unable to do nearly as well. Hence, they have reached their "Level of Incompetence." They may continue to do a (barely) competent job as Service Supervisor, and retain that position, but will receive no further promotions in the organization. A corollary of the Peter Principle is that, the longer any hierarchy exists, the more likely it becomes that the majority of positions within it will be staffed by individuals who have reached their "Level of Incompetence."
Regretably, I consider it very likely that this is what we are witnessing, in terms of our Homeland Security agencies being unable to actually perform the tasks entrusted to them.
There is also the tendency, within any defense-oriented organization, to "fight the last war." We can only hope that as our cyber vurnerabilities become clear to us, we act to correct them before our enemies learn to exploit them...
The company I work for got a call about a year ago from an individual who wanted to buy some sophisticated card printers, ribbons and cards. We sell all varieties of POS products, scanners and such, so this was a welcome inquiry. He wanted to pay with a credit card and requested overnight shipment. That the quantities he was ordering was huge didn't raise a concern for us...we, in fact, were thrilled to land such a big order. All this took place on a Friday late in the day. We processed 3 of the credit cards he gave us to cover the order, and each was 'authorized' by our card merchant machine.* We shipped the order to the address provided, which was in Florida. He called again on Monday to place another order....this one to ship to an address in Texas. As we were about to process the order, we were contacted by our supplier's loss prevention department, who flagged our orders as being out of the ordinary. " No one ever orders THIS kind of quantity", we were told. They suspected credit card fraud. Now we were concerned. We stalled the customer on shipping his 2nd order, while we tracked the first shipment. We discovered it wasn't a business address it had shipped to, but a storage facility. We contacted the office there and they told us they had rented space to this 'individual' whom they never met, but just followed their instructions to arrange pickups by other couriers, usually the same day they received it. The next courier shipped the parcels overseas, in our case, to the UK. We then contacted the banks about the credit cards he had given us and found out they didn't belong to him, but some unsuspecting people who were about to find some unusual transactions on their accounts. We were about to get hit with some huge chargebacks. In an effort to stop this shipment from getting to it's destination (and we weren't even sure where that was) we began calling all the law enforment agencies both locally and in Florida.
Not only were we facing a huge loss as a result of this theft, but our concern was also for who was actually behind obtaining these printers and what was there ultimate application going to be?
The printers are capable of printing identifications cards, ATM cards, etc Our local police they said they couldn't do anything as the shipment went to Florida, and not in their jurisdiction. We contacted Florida police...they said they couldn't do anything since there was no 'crime' . You see, the money was deposited in our account, as the banks had not yet charged us back. We contacted Homeland Security...they had NO interest in even hearing any part of what happened. As I recall, the person I spoke to said, " Listen, we deal with terrorism...this hasn't anything to do with terrorism..good day." We called the FBI...same thing...they had no interest in pursuing this either. We managed to get the tracking number from the storage facility in Florida, and tracked the parcel to the UK, to yet another storage facility. We called the UK police near the desitnation city and explained the situation. They actually went to investigate, but found no business, warehouse, person or package. All very, very strange indeed.
It was only after contacting a local office of the Secret Service here in New York that someone seemed to take an interest in investigating this situation. They asked for all our paperwork and whatever other details we could provide. Although we followed up with them for months afterward, all they could tell us was that what we had experienced was only a small part of a much larger 'operation' that was 'ongoing'. Maybe these printers and the cards they produced were the very same mentioned in this segment. MAYBE IF SOMEONE, like HOMELAND SECURITY or the FBI had LISTENED us and taken some action, they could have prevented what we believe was in fact an act of terrorism, not the kind of terrorism with a bomb or weapons, but more insidious and in some ways more destructive.
* We learned the hard way that an 'authorized' credit card transaction means virtually nothing. We were charged back the entire amount we processed. The merchant processor told us they were not liable regardless of the 'authorization' we received upon processing these payments. "Authorization" we were told, simply meant the card was recognized as having a valid number; that it was stolen or being used fraudulently was not their problem, but ours.