Juniper pulls researcher's Black Hat ATM talk

Share this article:
It's not very often in Las Vegas that the money stays inside the ATM. But that's exactly what will happen at the upcoming Black Hat conference after Juniper Networks decided to scrap a presentation by one of its researchers who was set to show how a cash machine software vulnerability could be used to spew twenty-dollar bills.

The planned talk by Barnaby Jack, titled "Jackpotting Automated Teller Machines," was pulled after the affected ATM maker raised concerns that it would not be able to fix the flaw in time. Juniper did not identify the ATM vendor but said in a statement that others may also be affected by this issue.

"Considering the scope and possible exposure of this issue on other vendors, Juniper decided to postpone Jack's presentation until all affected vendors have sufficiently addressed the issues found in his research," Steve Manzuik, Juniper's senior manager of security research, said in a statement. "As always, Juniper is committed to the responsible disclosure of security vulnerabilities.

It is unclear exactly what Jack planned to unveil in his presentation, but cash machine issues have made the news in recent months. In March, Diebold revealed that it issued a security update for its Windows-based ATMs after a number of its machines in Russia were infected with customized trojans.

"We are reaching out to other ATM vendors with the offer to assist them with promptly and diligently addressing the security risks and vulnerabilities uncovered in Jack's research," Manzuik said.

This is not the first time a Black Hat presentation was deemed too controversial to see the light of day. In 2005, Cisco and Internet Security Systems (ISS), now owned by IBM, threatened to sue researcher Michael Lynn just hours before he was to deliver a talk about vulnerabilities in the Cisco IOS. Lynn quit his job at ISS and proceeded anyway. Soon after, he settled with the two companies, essentially promising not to further discuss the exploit.

In 2007, security services consultant IOActive bowed to pressure from HID Global to withdraw its presentation. IOActive's director of research and development, Chris Paget, had planned to demonstrate security weaknesses in HID's RFID technology.

And last year, a judge in Boston issued a temporary restraining order against three Massachusetts Institute of Technology students who had planned to present their findings on vulnerabilities in the Massachusetts Bay Transportation Authority's subway fare collection system. The MBTA later dropped its lawsuit, but the talk never happened.
Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

More in News

WikiLeaks makes FinFisher surveillance software available to public

Copies of controversial surveillance software, called "FinFisher," were made available for public scrutiny by WikiLeaks.

Researcher challenges reports that BlackPOS variant struck Home Depot

Nuix believes the malware found on Home Depot's systems belongs to a different threat family.

Documents reveal NSA plans to map every internet connected device in the ...

Documents provided by Edward Snowden reveal that the NSA is looking to build a near real-time map of every single internet-connected device in the world.