12

It was made by humans so there's a spec. I googled it. Here's a manual which talks about the Axial MX from Accom ~2005. If it's a series of edit controllers, they'll likely work the same under the hood and use the same protocol from one version to the next. Looks like an RS422 Serial. So you just need to hook it up to a computer with a serial port and take ...


11

Some information might be found in Barnaby Jack's BlackHat presentation: Jackpotting Automated Teller Machines (Youtube) The most prevalent attacks on Automated Teller Machines typically involve the use of card skimmers, or the physical theft of the machines themselves. Rarely do we see any targeted attacks on the underlying software. Can't find the ...


6

A 'side-channel attack' define any technique that will consider unintended and/or indirect information channels to reach his goal. It has been first defined in smart-card cryptography to describe attacks which are using unintentional information leak from the embedded chip on the card and that can be used in retrieval of keys and data. For example, it may be ...


5

All ATMs that I am aware of and have worked on in a past life have a way to get into 'admin' mode either from the front or a rear keypad. Methods vary. Sniffing a network probably won't help as the communication is encrypted. That said, buy one: http://www.atmexperts.com/used_atm_machines.html http://www.bellatm.net/Default.asp Then you'll have all the ...


5

You can't do much without physical access, if not to the specific machine you're attacking then to the same or similar model. That's what Barnaby Jack did - he ordered 3 ATM machines and investigated them at home. I suppose there may be service menus reachable from the normal screen by some key combinations but I wouldn't count on it. Once you know the ...


4

Fault Injection Attacks Basically, we assume here that we have a black-box that produces an output using a known algorithm but with some unknown parameters. In the case of cryptography, the black-box could be a chip on a smart-card, the know algorithm could be a cryptographic algorithm and the unknown parameters would be the key of the algorithm which lies ...


4

I would say this guide is a good place to start. However, this is assuming when you say "wifi-like" you mean very similar to authentication using WPA2. Cracking WPA2 is a little more complex than WEP, for example. The initialization code for WPA2 uses a four-way handshake to properly initialize all of the vectors that are used in the actual encrypting. So ...


3

If "something like wi-fi" means it's radio but not really 802.11, you might want to take a look at Software Defined Radio projects. As the question isn't really clear, your mileage may vary. There are numerous hardware tools you can use. From relatively expensive tools like bladeRF and hackRF to really cheap alternatives like rtl-sdr. You'd probably need ...


2

As far as I know, TPM 1.2 has something called Transport Protection/Security to establish a secure channel with the TPM but it's difficult to find documentation on it. It is most probably some variant on key exchange. Now of course a secure channel is useless per-se because you can still swap the TPM with a tempered oned. Thus a TPM comes with what is ...


1

I remember seeing a brute forcing device for iPhones a little while ago. There is also a device out there for breaking BIOS passwords on certain thinkpads by connecting to an IC of some sort but I can't find the article. Although those methods probably differ in some aspects from a MITM attack, the way you describe would seem perfectly valid based on those ...


Only top voted, non community-wiki answers of a minimum length are eligible