Tanzania Association of Wichita

As the Automated Teller Machines continue to expand in Tanzania, serving nearly 2 million customers, computer hackers this week discovered serious security loopholes, casting bleak future to the ATMs safety.

According to a report by Associated Press, a hacker in Las Vegas has discovered a way to force ATMs to disgorge their cash by hijacking the computers inside them.

The attacks demonstrated Wednesday targeted standalone ATMs. But they could potentially be used against the ATMs operated by mainstream banks, according to a report filed by Associated Press News Agency over the weekend.

Criminals have long known that ATMs aren't tamperproof.

There are many types of attacks in use today, ranging from sophisticated to foolhardy: installing fake card readers to steal card numbers, hiding tiny surveillance cameras to capture PIN codes, covering the dispensing slot to intercept money and even hauling the ATMs away with trucks in hopes of cracking them open later.

According to the report, computer hacker Barnaby Jack spent two years tinkering in his Silicon Valley apartment with ATMs he bought online. These were standalone machines, the type seen in front of convenience stores, rather than the ones in bank branches.

His goal was to find ways to take control of ATMs by exploiting weaknesses in the computers that run the machines.

He showed off his results in Las Vegas, this week, at the Black Hat conference, an annual gathering devoted to exposing the latest computer-security vulnerabilities.

His attacks have wide implications because they affect multiple types of ATMs and exploit weaknesses in software and security measures that are used throughout the industry. His talk was one of the conference's most widely anticipated, as it had been pulled a year ago over concerns that fixes for the ATMs wouldn't be in place in time. He used the extra year to craft more dangerous attacks.

Jack, who works as director of security research for Seattle-based IOActive Inc., showed in a theatrical demonstration two ways he can get ATMs to spit out money:

-- Jack found that the physical keys that came with his machines were the same for all ATMs of that type made by that manufacturer. He figured this out by ordering three ATMs from different manufacturers for a few thousand dollars each. Then he compared the keys he got to pictures of other keys, found on the Internet. He used his key to unlock a compartment in the ATM that had standard USB slots. He then inserted a program he had written into one of them, commanding the ATM to dump its vaults.

Jack also hacked into ATMs by exploiting weaknesses in the way ATM makers communicate with the machines over the Internet. Jack said the problem is that outsiders are permitted to bypass the need for a password. He didn't go into much more detail because he said the goal of his talk "isn't to teach everybody how to hack ATMs. It's to raise the issue and have ATM manufacturers be proactive about implementing fixes."

The remote style of attack is more dangerous because an attacker doesn't need to open up the ATMs.

It allows an attacker to gain full control of the ATMs. Besides ordering it to spit out money, attackers can silently harvest account data from anyone who uses the machines. It also affects more than just the standalone ATMs vulnerable to the physical attack; the method could potentially be used against the kinds of ATMs used by mainstream banks.

Jack said he didn't think he'd be able to break the ATMs when he first started probing them.

"My reaction was, 'this is the game-over vulnerability right here,'" he said of the remote hack. "Every ATM I've looked at, I've been able to find a flaw in. It's a scary thing."

Kurt Baumgartner, a senior security researcher with antivirus software maker Kaspersky Lab, called the demonstration a "thrill" to watch and said it is important to improving the security of machines that can each hold tens of thousands of dollars in cash. However, he said he doesn't think it will result in widespread attacks because banks don't use the standalone systems and Jack didn't release his attack code.

Jack wouldn't identify the ATM makers. He put stickers over the ATM makers' names on the two machines used in his demonstration. But the audience, which burst into applause when he made the machines spit out money, could see from the screen prompts on the ATM that one of the machines was made by Tranax Technologies Inc., based in Hayward, Calif. Tranax did not immediately respond to e-mail messages from The Associated Press.

Triton Systems, of Long Beach, Miss., confirmed that one of its ATMs was used in the demonstration. It said Jack alerted the company to the problems and that Triton now has a software update in place that prevents unauthorized software from running on its ATMs. Bob Douglas, Triton's vice president of engineering, said customers can buy ATMs with unique keys but generally don't, preferring to have a master key for cost and convenience.

"Imagine if you have an estate of several thousand ATMs and you want to access 20 or so of them in one day," he wrote in an e-mail to the AP. "It would be a logistical nightmare to have all the right keys at just the right place at just the right time."

Other ATM manufacturers contacted by the AP also did not immediately respond to messages.

Jack said the manufacturers whose machines he studied are deploying software fixes for both vulnerabilities, but added that the prevalence of remote-management software broadly opens up ATMs to hacker attacks.

Saturday`s decision by the people of Zanzibar to vote overwhelmingly for the formation of a government of national unity is hailed as a major step towards durable peace in the Isles.

Most experts, academicians, diplomats and other members of the public have said in separate interviews with this paper that the decision would usher in a more just and inclusive political system in Zanzibar.

“Zanzibaris have wisely chosen to move beyond bitter divisions to build a new Zanzibar founded on a peaceful, just, and inclusive political system,” Johnnie Carson, US Assistant Secretary of State, Bureau of African Affairs, said in an official statement yesterday.

He praised the people of Zanzibar for conducting a peaceful referendum which, he said, represented the culmination of a difficult reconciliation process.

Carson also noted that, while the US joined other friends of Tanzania in supporting the process, “it was Zanzibari leaders and legislators from the Isles’ two main political parties (the ruling CCM and opposition Civic United Front - (CUF), the Zanzibar Electoral Commission, civil societies, political parties, religious leaders and the people of Zanzibar who made it succeed.”

He said by adopting pragmatic solutions to longstanding problems, the people of Zanzibar had set a powerful example to others around the world facing seemingly intractable and divisive challenges.

Carson said the people of Zanzibar now had the opportunity to build on the historic achievement as they approach General Election in October.

“As Zanzibaris continue to choose the rule of law and peaceful political participation over division and violence, they can count on the support of the American people,” he stated.

Britain’s Minister for Africa, Henry Billingham, meanwhile congratulated Zanzibar President Amani Abeid Karume and CUF Secretary General Seif Shariff Hamad on their having overcome decades of political confrontation in the Isles.

He commended President Jakaya Kikwete, whose vision and efforts he said led to the achievement of the desired unitary government in the Isles.

Erik Solheim, Norway’s Environment and International Development minister, said the people of Zanzibar had spoken and their voice was clear, adding: “They stand ready to overcome the difficulties of the past and to forge unity for Zanzibar’s future.”

He expressed optimism that the Zanzibaris’ decision would pave the way for development and prosperity in the Isles.

Solheim also commended Kikwete, Karume and Hamad for their strong commitment to finding a peaceful solution to the drawn-out political impasse in Zanzibar.

He said he was confident that the joint efforts of the three leaders would enable all Zanzibaris to enjoy the fruits of a government of national unity.

“With confidence, I now look forward to free, fair and peaceful elections in October elections that will reflect the will of the Zanzibari people,” he noted.

Donald Kasongi, country director of Mwanza-based international non-governmental organisation Agency for Cooperation and Research in Development (ACORD), hailed the citizens of Zanzibar “for demonstrating self-determination of their sovereignty within a sovereign state”.

He described the referendum as “a landmark step sure to provide ample room for the people of Zanzibar to decide how they want to be governed, effectively giving them a chance to have a say on matters that affect them directly”.

Warning that this could defuse tension in the Isles only for a time, Kasongi called upon policy makers to review the structure of the Union government and make it operate more smoothly.

Dr Mariam Nchimbi, a director at the University of Dar es Salaam Entrepreneurship Centre (UDEC), also expressed hope that the referendum will have reduced tension between the residents of Pemba and those of Unguja.

But she wondered whether things would run that smoothly should CUF win the upcoming General Election.

She said the Zanzibar Constitution indicated that the President would come from Pemba, in which case the first Vice President would be a CCM candidate hailing from Pemba too.

Osman Salum, who said he was “an ordinary person”, said the outcome of the referendum was a clear demonstration of political maturity and democracy, elements which had been missing for years in Zanzibar.

“I believe that the referendum will serve as a very potent tool in restoring lost political peace,” he said, adding; “This will give opportunity to both opposition and the ruling party to effectively participate in the country’s leadership, thus minimising the likelihood of political crises erupting.”

Emmanuel Manyerere of Dar es Salaam also described the power-sharing government expected to be formed in Zanzibar after the October General Election as a good step towards to all-inclusive leadership in the Isles.

“Zanzibar’s social and economic development has been facing numerous setbacks because of the protracted political stand-off between CCM and CUF. I am confident that the installation of a government of national unity will speed up the development,” he said.