Man Used MP3 Player To Hack Cash Machines

Juha-Matti Laurio writes "A man in Manchester, England has been convicted of using an MP3 player to hack cash machines. The MP3 player was plugged into the back of free standing cash machines in bars. Tones being recorded from the phone line were decoded with special software to a readable format. Later this information was used to clone credit cards."

Um...

[Spazntwich]

So he performed a generic man in the middle attack, recording information transmitted by modem and decoding it?

Hasn't this been done a million times before? Wouldn't it be easily performed with any sort of sound recorder?

Re:Um...

[Anonymous Coward]

Wouldn't it be easily performed with any sort of sound recorder?

Yes. The problem here is the bank machine manufacturer failed to insulate the device from leaking this information to the outside. Any remotely competent electrical engineer with a computer science background would be aware of this defect. Why a device containing a modem and requiring security was not subject to the scrutiny necessary to reveal this flaw is probably a matter of cost cutting. Sort of like American vote machines.

What brand of mp3 player?

[xwizbt]

It's just me wondering what brand of mp3 player he used, then, is it?

I don't suppose it matters if he's just capturing audio data; in fact it's hardly even important that he was using an mp3 player - he could just have easily used one of those handheld cassette recorders.

Re:Police found fake card.

[hey!]

TFA doesn't say that they went through his wallet. Only that they "They found a fake bank card in his possession..."

Whether it was proper or not depends on how they found the bank card, and what the rules in UK say about searches. Remember -- clever doesn't necessarily mean smart. It took a clever person to dream up the scam. But a smart person wouldn't travel around with incriminating evidence unless it is well hidden. For all we know he may have had a pile of loose credit cards on the passenger seat. That's the kind of blunder many clever people I know would be likely to commit.

Re:Police found fake card.

[hey!]

I don't know about the rules regarding searches in the UK.

To do the kind of home search performed by the Manchester England police in the US, you need a warrant supported by probable cause. Probable cause is not definitive proof, it is "Information sufficient to warrant a prudent person's belief that the wanted individual had committed a crime or that evidence of a crime or contraband would be found in a search."

A credit card in the name "Donald Duck" might not be enough to raise a prudent person's suspicion, but one in the name of "Donald Trump" might be, especially if the person can give no reasonable explanation of why he should have such a card.

This seems to be a reaonable conpromise to me. People are not subjcted to invasive searches on a police officer's whim, he has to show to an independent authority that he has reasonable grounds, and then can only perform the specific search necessary to confirm that evidence. On the other hand, the police aren't caught in a catch-22 of having to have definitive proof in order to seek definitive proof.

This is probably the single most important idea in western civilization: while it is sometimes necessary to grant individuals extraordinary powers, those individuals are held accountable and must justify their use of those powers, and his use of those powers may not exceed what he can justify. Think of the things you like and dislike about government; chances are most have to do with how well or poorly the government adheres to this principle.

Whose liability is it?

[Myria]

When this man stole the money, whose liability was it? To the bank, the withdrawals looked like those customers, and they couldn't have known it was fraud. When the victims find out, can they go to the bank to get their money back, or is the bank immune?

Melissa

Re:So the criminal is convicted...

[Limax Maximus]

I've always used the idea of an act such as that as a piss take for whenever we see hacked boxes that is clearly the users fault. Obviously such an act would never come into force and nor would I support it (except on 1st April). On the whole theft of details business I'd disagree over it being worse to steal details than making them available. Banks are always blaming their customers for leaving details in bins and so on yet when they make such a monumental fuck up all they do is get the person prosecuted (good thing, I'd agree) and quite happily sweep it under the carpet. They've made it easy for someone to do it so they have. Crime pays, however the cost to the criminal also increases as it gets harder - Organised criminals are bussinessmen - if it doesn't pay well enough they're not going to do it.

So going back to your anology of leaving a car unlocked (with the keys in too?) would you get any sympathy from the Police or insurance company? Oh no, you'd be laughed out of the building and charged far more on next years premium. Sorry, thats wrong - you'd lie and make a claim increasing everyone elses premium.

Re:Police found fake card.

[aoteoroa]

Another possibility is that this crook is neither clever, nor smart, and is not the one who dreamed up the scheme but is just a lacky who doing the dirty work for somebody else. From the article:

Though £200,000 was spent on the cards, police said they believed that Parsons himself only earned £14,000 through it.

This implies that there are more people involved.