+-------------------------------+
                  |                               |
                  |   A. T. M.  Fraud Made Easy   |
                  |                               |
                  |   summary and research by     |
                  |         Count Zero            |
                  |                               |
                  |    (A CHiNA Info-Net Prod)    |
                  |                               |
                  +-------------------------------+
 
Have you ever looked longingly upon the sight of your local PULSE machine
and thought, "There must be some way that I can make some money REAL easy
here."?
 
Well, there is.  But it won't be easy.  Protection methods can be overcome,
but the technology involved must be understood IN ITS ENTIRETY before an
[PAUSE]       attempt at illegal access is to be made.  There are hundreds of people,
guests of the state, that figured their plans infallible, only to fall
victim to a well-hidden camera.
 
This article will not be a lesson on HOW to break into the machine, it is
merely a summary of the operations involved with a normal ATM transaction.
This information is being presented on a "for information's sake"-only
basis.  I, Count Zero, do not promote nor remotely condone any illegal
acts of any sort.  So there.
 
 
 
I.  MAGNETIC STRIP FORMAT
 
This would seem to be the most efficient method of trying to access illegal
sums of cash.  You could:
 
                a. steal somebody's card and PIN code
                b. synthesize a card
                c. attempt to "jackpot" the system
 
We will only look at option B.  As "A" is up to your own devices and "C" has
several good text files written about it already.  So "B" it is.
 
[PAUSE]       Let's look at the format of the data written to the magnetic strips.  This
has been taken from a recent HARTWELL, INC manual.
 
[ XX XX XX XX XX XX XX XX ] [ YYYY ] [ - 20 CHARS - ] [ ZZ ZZ ZZ ] [ CC CC ]
 \-----------------------/  \------/ \--------------/ \----------/ \-------/
   Your individual acct.      PIN      Name of card    Bank route    CHKSUM
     number/serial code       Code        issuee       code/rem.
                                                       access #
 
For validation, each entry is written twice but not written here for
ease of typing.  But it is repeated in the form of:
"ACCT NUM" "ACCT NUM" "PIN CODE" "PIN CODE" etc...
 
These codes may be examined by building a simple code-reader as many
have done which can be easily interfaced to your IBM-PC.  Full plans
to be put into a future CHiNA newsletter.
 
If you were to attempt to write a magnetic strip or change a currently
existing one, you would need to be using a head-write circuit based on
the popular Motorola BCX119221-A...C series of head control chips.
 
NOTE: Make sure to change the last 2 values!  They constitute the
checksum of the entry.
Merely add all existing characters written (only the first entry, not both
[PAUSE]       of them) using the following chart:
 
                CHARACTER               VALUE
                --------------------------------
                0..9                    0..9
                A..Z                    10..36
                EOL                     37
                EOT                     38
                CLR                     39
                HMX                     40
                PTT                     41
                RIA-1                   42
                RIA-2                   43
 
I doubt anyone in the communications biz needs an explanation of these terms
so I'll move on.
 
 
II.  ATM HARDWARE
 
Usually consists of:
 
               ------------------------------------
               |                                  |
[PAUSE]       \-----\        |                B                 |
|  A  |        |                                  |
\-----\        ------------------------------------
               |                                  |
               |     -----------     /---/  E     |
               |    /          /    /   /    ---- |
               |   /    C     /    / D /   F      |
               |  /          /    /   /     ----  |
               | ------------    /---/            |
               |                                  |
               ------------------------------------
 
 
A. Camera Mount
B. Hidden Voice-Activated recorder & printout link
C. Display Monitor
D. Options buttons
E. Card Slot
F. Receipt Slot
 
Your machine may vary slightly.  But the concept will almost always hold true.
Simple rules for each.
 
A. Wear a paper bag or mask.  See also Part II A
[PAUSE]       B. Do NOT speak.  This is the most crucial part!  See also Part II A
C. Nothing
D. Wear gloves
E. See Part I
F. TAKE YOUR RECEIPT AND BURN IT!!
 
One of the neat flaws in many machines made prior to 1989 involved the
use of the "CANCEL" button.  This button was made to be pressed when the
user decided, at any time during the transaction, that he didn't wish
to continue.  The display would jump immediately to:
 
"TRANSACTION CANCELLED - CHOOSE ANOTHER?"
 
This was all well and good, but the machines did not disable this feature
between the time your cash was dispensed and you were prompted for your
next activity.  In effect, you could push the "CANCEL" button after your
money has been withdrawn and it would not be added to your account record!
 
THIS STILL WORKS IN MANY PLACES!  OVER 85% OF ALL MACHINES MADE BEFORE MAR. 
1989
STILL HAVE NOT BEEN UPGRADED.
 
Although most machines of that period would only work if you were withdrawing
amounts larger than $20 (usually $25 is the next possible choice!)
[PAUSE]       This is ideal if you are using another's card!
 
 
II A.  CAMERA/SOUND HARDWARE
 
You can go other routes when dealing with camera systems.  You do not have
to wear a bag on your head (unless the cosmetic improvement is quite large)
Thin alloy metal such as common aluminum/tin foil, which are full of 
impurities,
react in a bizarre way when photographed through the special lenses that are
commonly used.  The effect is to "blur" or "bleed" the image, rendering it
indestinguishable from an accident in your local Sherwin-Williams store.
Most people prefer to make a "headband" of this metal, lined with copper
wire in a sine wave pattern when accosting a machine.  You should
seriously consider this possibility!
For further reading on this subject, consult:
 
                BANKER'S WORLD - Apr 1989
                        "Where Have All the Dollars Gone?"
                        pp 24-29
 
                P. I. - Apr 1989
                        "The Last Straw"
                        pp 37-41 (p 38 in particular has a nice
[PAUSE]                                               diagram.  Fig 1)
 
 
Sounds, these articles also suggest an indirect method of dealing with the
voice-activated recording device.  Oddly, a pure square wave tone (roughly
around 3100 hz) will cause a major screwup in the sound-sensing abilities
of the recorder.  It usually will have to be replaced.  Suggested volume,
given at 6" range is 8.5+ db.  Obviously, anything louder will do.
 
An interesting side-note is that this has become a past-time of suburban
teenagers!
 
Well, hope this gets you started!  More will be coming in the next
exciting file!
 
---------------------------> OVER AND OUT! -----------> COUNT ZERO
 
HAHAHAHA NAPPA IS A BUNCH OF FLY-BY-NIGHT LOSERS, EH CONFLICT?!
 
Call us on:
 
                HYPERCARD BBS   (406) 538-2101
                                1200/2400 BAUD
(CHiNA Node #3)                 SYSOP: GEORGE VON JUNGLE
[PAUSE]        
 
                FAWLTY TOWERS   (202) 781-6420
                                2400 BAUD ONLY
(CHiNA Node #9)                 SYSOP: BASIL FAWLTY
 
A big hello to:
           Rubix the Cube, The Conflict, Monalisa Overdrive