Bank of America has been installing new ATMs all over California and Florida. These new ATMs have a variety of new features such as:
- Being able to scan your cash checks and detect their amounts automatically
- Not requiring deposit envelopes
- Audible prompts for the visually impaired
- More user-friendly menus
Being a technologist, I’m always excited about new technology. In particular, I’m always thrilled when something becomes more accessible to people with disabilities. However, when I went to use one of these new machines, I noticed that stamped at the top it was its maker: Diebold. Diebold, if you don’t recognize the name, is the company that makes the voting machines now used in many states across the US.
If you’ve been following the news over the last several years, you may know that these Diebold voting machines are woefully insecure. It’s been shown that, among other things:
- You can install malicious software to make untraceable change to votes with only a memory card
- The locking mechanism over the memory card slots can be opened with a hotel mini-bar key
- A picture of the master key was posted on the Diebold website, and based on that an actual key was made that successfully opened the lock on a Diebold voting machine
- Nearly all Diebold machines across the US use the same key
You can find the full report that Princeton did on these machines along with videos of these machines being hacked and broken into at http://itpolicy.princeton.edu/voting. On several occasions, the Diebold machines have been shown to be insecure, inadequate, and poorly thought out. Yet, Diebold has had no good solutions, no good responses, and has made no useful improvements.
So, imagine my surprise that a company that’s been publicly berated for poor security and losing votes all of a sudden is making and servicing the ATM I’m using! Can it lose my money as easily as the voting machines can lose my votes? Why would Bank of America pick such a company to provide machines that handle millions of dollars of their customers’ money? Diebold already had a contract to service over 3,000 of BofAs ATMs, and in February of 2002 that deal was expanded to 10,000 ATMs. But now Diebold is a installing 2,500 of their own ATMs. All I can say is that this scares the crap out of me, and it should scare the crap out of you.
You know why it does not scare the crap out of me? Diebolds ATMs are the most secure devices that are available. I have not seen any other devices that can even touch it.
While this may come as a surprise to you, but Diebold has been making ATM’s for years now. This is not something new.
Do some research on the Diebold ATMs, there are a few good papers out there about attacks that have been attempted.
They started by making safes over 100 years ago, as I understand it. In more recent history they were servicing ATMs but I couldn’t find any evidence of them making ATMs prior to the early 1990s. I certainly didn’t find anything showing security testing of their ATMs, so please point me to reading to back up your bold un-cited security statements. What I do know is that regardless of the company’s good history prior to the last 5+ years, they’re recent track record shows an utter disregard for security. Companies can change and Diebold’s current status is not one that inspires confidence.