Winnipeg ATM hacked by 14-year-olds using manual found online

[lurch234]

A pair of precocious Winnipeg high school students are making headlines this week for hacking into a Bank of Montreal ATM using an old operators manual found online.

Neither Matthew Hewlett or Caleb Turon, both 14, are facing any type of charges related to the incident, however. Quite the contrary — they're actually being applauded for exposing a security risk to the bank.

According to the Winnipeg Sun, Hewlett and Turon successfully hacked the BMO ATM at a local Safeway store during their lunch hour on Wednesday.

The Grade 9 students had previously found an old manual for the machine on the internet and were curious to see if they'd actually be able to put the ATM into "operators mode."

"We thought it would be fun to try it, but we were not expecting it to work," Hewlett told The Sun. "When it did, it asked for a password."

That password turned out to be a common, six-digit "default password" guessed by the students on their first try. The password was not revealed to media, but The Daily Dot speculates

that it was probably "123456."

The students immediately went to a nearby BMO branch to report their findings, but were told by management that what they'd done "wasn't really possible."

"So we both went back to the ATM and I got into the operator mode again," said Hewlett. "Then I started printing off documentation like how much money is currently in the machine, how many withdrawals have happened that day, how much it's made off surcharges."

They also changed the ATM's welcome greeting to "Go away. This ATM has been hacked," and changed the ATM's surcharge amount to one cent.

One would think that BMO would be displeased with the boys' activity, but instead, when Hewlett and Turon returned with evidence of their hack, the bank responded gratefully.

After calling head office to report the security flaw, the branch manager even wrote the students a note explaining their tardiness to school administrators.

"Please excuse Mr. Caleb Turon and Matthew Hewlett for being late during their lunch hour due to assisting BMO with security," the note began, according to the Sun.

Representatives from BMO confirmed to the Calgary Herald that no customer information was exposed when Turon and Hewlett probed the ATM's system

Many online are applauding the duo for their cleverness and honesty, as well as BMO for responding positively (school note and all!) to the stunt.

Source

Edited June 10, 2014 by lurch234