ATMs running Windows XP robbed with infected USB sticks – yes, most ATMs still run Windows

A high-tech criminal group in Europe has been infecting ATMs (cash machines) with malware, and then completely emptying the machines without a trace. The group has not yet been caught and the attacks continue — and thus very few details have been released — but we assume that they’ve already made off with millions of pounds/euros. The best bit: The hack is carried out by plugging an infected USB stick into ATMs that run Windows XP.

Not many people know this, but most of the world’s ATMs run some flavor of Windows. In the olden days, it wasn’t too unusual to find an ATM that had crashed with a blue screen of death (BSOD), and to this day it’s still fairly common to hear the standard Windows “ding” when interacting with an ATM. A conventional ATM might consist of a standard Windows XP PC (or perhaps XP Embedded), connected to a display, a secure keypad, cryptoprocessor, various other bits of hardware, and of course the vault (where the money is stored). The ATM boots up normally, then launches into a full-screen program that manages all of the tasks that a customer might want to carry out.

Unfortunately, just like your Windows PC, some ATMs also have USB sockets — and just like your PC, some ATMs will automatically boot whatever’s plugged into the USB socket. The USB socket is hidden behind the ATM’s fascia, but it can be revealed if you know where to cut — and once you’ve loaded the malware on, you can easily cover up the hole. If you have knowledge of the ATM’s software, it’s possible to use malware to inject new features, or disable existing ones. In a word, once you’ve infected the ATM, it’s fairly easy to steal its money with complete impunity. (Read: Black Hat hacker gains access to 4 million hotel rooms with Arduino microcontroller.)

You may have noticed that we’re talking in generalities here — but that’s because it’s all we have. Two German researchers, who have asked to remain anonymous, were contacted by the European bank that had discovered this attack earlier in the year. They analyzed the disk image of an infected cash machine, and worked out that the high-tech criminals must’ve reverse-engineered the ATM’s client software and injected a new menu. When triggered by a code entered on the keypad, the menu gives the criminals direct access to the ATM’s cash-dispensing functions. ”For sure, they had to have a profound knowledge of ATMs,” said one member of the research team. “Most likely they actually had one to test. Either they stole one and reverse engineered the cash client, or most likely, they had someone on the inside.”

Security personnel refil an ATM

As you can imagine, given the fact that most ATMs are powered by Windows XP, this isn’t exactly a new attack vector. According to Wired, some banks have upgraded their ATMs to prevent them from booting from external USB drives. This particular attack only affects the cash machines of a sole (undisclosed) bank in Europe, and the researchers say that the malware doesn’t appear to harvest customer PINs or other sensitive data. Basically, they install the malware, wait for the machine to be refilled with cash, and then empty the machine out — presumably in the middle of the night, as it takes quite a while to withdraw thousands of bills. (See: Black hat down: What happened to the world’s most famous hackers?)

Moving forward, there isn’t a whole lot banks can do, except for upgrade their ATMs — but, as you can imagine, that’s a slow and expensive task. The upgrades filter out slowly, too, so while the ATMs in Berlin might be safe, ATMs deployed in developing countries might take a lot longer to be updated. The only saving grace is that developing a hack like this requires a lot of time and expertise — but considering the attack appears to be untraceable, and can be used repeatedly to accrue millions of euros/dollars, it’s probably worth it. Some other operating systems, including Linux, are used by ATMs, but it’s mostly a Windows-dominated market.

NASA beginning next generation of space communication with laser broadband

Orbiting high over the lunar surface is LADEE, the Lunar Atmosphere and Dust Environment Explorer, with a mission to probe the moon’s exosphere and dust clouds. It will take readings using a number of spectrometers and specialized pieces of equipment, piling up stores of data as quickly as it can manage. In just 100 days of primary operation, it will compile enough information to change how we understand our only moon — but how to get that data back to us? File sizes have ballooned as sensing technology has advanced, but as of last year NASA could only download those files at about 10 kilobytes per second; even if we were so cruel as to ask the astronauts to go without streaming Game of Thrones premieres, the simple science demands a better, faster solution.

This week, NASA successfully tested just such an alternative, replacing traditional radio communications with specialized lasers and laser detection units. The Lunar Laser Communications Demonstration (LLCD) spent about 30 days sending information between lunar orbit and three receiving stations in the US and Spain. At an orbital distance of over 400,000 kilometers, this is a respectable distance over which to test communications — but Mars lies between 50 and 400 million kilometers from Earth, so don’t get cocky.

Last October, the LLCD was clocked at 622 megabits per second — or over 75 megabytes per second — but this 30-day test was a much more comprehensive check of its utility for all-purpose communication. This time, rather than simply downloading a pre-arranged file, NASA used the device for real communication with LADEE, and real collection of data. The lunar dust experiment was able to wake the LLCD in order to get its messages to Earth, an automated process that went off without a hitch, legitimizing its use for general-purpose missions. Check out a short video announcement from NASA’s Charles Bolden, the file of which was transmitted to the moon and back before posting to YouTube.

It took NASA just five minutes to transfer a gigabyte of information, and in fact the limiting factor in transfer speed turned out not to be the LLCD’s transmission from the moon to the Earth, but LADEE’s transmission to the LLCD just a few short miles away. This means that not only is the LLCD a workable solution today, but it already has a certain amount of future-proofing built in, ready to take advantage of speed upgrades in the components around it.

This latest test looked for more than just raw download speed, prioritizing things like signal reliability and accuracy, along with possible distance effects. There were quite a few problems that could have hurt this technology’s chances, but none seem to have materialized as a major issue. Even in broad daylight and through light clouds, the lasersignal could be read without error. NASA was reportedly surprised to find so few impediments to their new laser ideas, finding that it worked well even at extremely oblique angles, when the satellite near the Earth’s horizon and its signals were forced to move through the thickest portions of the atmosphere. Thick clouds, or anything that blocks the majority of visible light obviously stops the lasers cold.

One of several types of ground terminal for the LLCD.

The LLCD is hardly the only method of space communication that suffers periods of black-out, and in general the LLCD represents not just an upgrade in bandwidth but also in versatility. The downside is, as mentioned, range; simply boosting power to the laser to make it cohere better over a longer distance is a losing game. A more reasonable solution, and one that NASA just so happens to be ramping up as their next experiment in this line, is the Lunar Communications Relay Demonstration (LCRD). This would see NASA pepper space with laser-routers to read and re-transmit laser signals from a new transmitter.

Even if NASA never significantly increases the range of these individual transmitters (unlikely), it will still only take a handful of them to allow total communication with Mars. Additionally, the more the agnecy launches, the easier it becomes to expand the system as a whole; the comms system  is designed to be a general-purpose routing network, rather than a hardline from Mars to Earth.

These sorts of upgrades aren’t the sexiest, since they don’t directly reveal anything about the universe or allow us to explore some previously inaccessible portion of our solar system. On the other hand, they make our current efforts immensely faster and, more importantly, allow NASA to plan future missions without restrictions. Data is quickly becoming the most important commodity on Earth — which makes LLCD a gold mine in space.

Happy New Year to everyone, I wish you well

Drinking Vodka With Style

Jim Carrey - Players Club

Alcohol + Fireworks + Lack Of Judgement =

Too drunk?

iPad Air

At first glance, with the Apple Reality Distortion Field at full power, the iPad Air seems like an impeccable, immaculate device that could only ever be conceived by the magicians at Apple in California. The iPad Air is some 30% lighter and 20% thinner than the iPad that it replaces, while still retaining the same Retina display and 10 hours of battery life. Somehow, just somehow, Apple made us feel that it had yet again pulled off the impossible. In reality, the iPad Air, while very attractive, isn’t remarkable at all. The new Kindle Fire HDX, for example, has a higher-resolution screen, more battery life, weighs less, and even costs less than the iPad Air.

Apple has this amazing ability to dress up mundane advances in software and hardware as remarkable, life-changing features. This isn’t to say that Apple doesn’t have an industry-leading industrial design department and supply chain, but objectively the lead that Apple has over the software, design, and manufacturing departments of other companies is nowhere near as large as we think. This is what we refer to as the Apple Reality Distortion Field (RDF).

The cause of the RDF is multifaceted. The term was originally applied to Steve Jobs himself, who used a mix of charisma, hyperbole, and cult of personality to convince people — colleagues, developers, an adoring audience — that Apple was capable of regularly making the impossible possible. At some point, though, following a slew of beautiful and functional products — the iPod, the iPhone, the iPad — Apple itself became the source of the RDF. Without going into the sociological and psychological causes of the RDF, it’s simply enough to say this: If you sell hundreds of millions of devices that regularly score the highest marks in customer satisfaction surveys, and often provide the first high-quality computing experience the person has ever had, those devices become revered — and the maker of those devices is deified.

As you probably know, when reverence, faith, or love enter the equation, all hope of objectivity goes out the window. For those inside the RDF — for those who look at Apple with rose-tinted glasses — there is nothing particularly unusual about this behavior. Much in the same way that we find a lover’s mannerisms disproportionately adorable, or put up with friends and loved ones treating us poorly, Apple appears to be capable of doing no wrong. For those of us outside Apple’s RDF, however, this blind belief and adherence to a corporate and massively profitable god is puzzling at best and intolerably stupid at worst.

Which leads us neatly onto the topic of Apple’s latest illusory masterpiece: The iPad Air. If you take a quick look at your favorite tech websites, or ask a devout Apple fan for their opinion, you would think that the iPad Air is the thinnest, lightest, and most marvellous slab of technology to ever grace this planet of ours. If we take a step back and look at it objectively, though, we can see the Air for what it truly is: A very well designed tablet that is ultimately no better, and much more expensive, than an 8.9-inch Kindle Fire HDX.

8.9-inch Kindle Fire HDX. Not quite as sexy as the iPad Air, but still a mean machine.

The 8.9-inch Kindle Fire HDX ($400) has a quad-core Snapdragon 800 SoC, a 2560×1600 (339 PPI) display, and battery life of between 12 (mixed use) and 18 hours (reading). Perhaps most importantly, though, the HDX is just 7.8mm thick and weighs 374 grams. The iPad Air is slightly thinner (7.5mm), but in almost every other way — weight, resolution, battery life — it is inferior to the HDX. The Snapdragon 800 is perhaps a little slower than the Air’s A7 SoC, depending on the benchmark. It’s also important to note that the iPad Air’s display is 10.1 inches at a 4:3 aspect ratio, while the HDX is only 8.9 inches at 16:10, which works out at around 20% more screen real estate for the iPad. The larger display could explain the iPad Air’s extra heft (469 grams), but the HDX’s svelte dimensions and better battery life are still very noteworthy.

It’s unfair, however, to naively compare the hardware without also looking at the rest of the package — and even the most hardened haters have to admit that Apple has a mighty fine package. Again, to put it in the most simple terms, if Apple didn’t produce devices that look and feel good, and operate almost flawlessly, then the Reality Distortion Field would’ve long ago faded. For those of us outside the RDF, we constantly look for flaws, no matter how small or meaningless, that can be thrown in the face of the Apple devotees — anything, really anything, to deconstruct their blind faith.

Deep down, though, we know such efforts are in vain. It will always be possible to find flaws in Apple’s software and hardware, but it’s evident that they’re ultimately of little or no consequence. Apple’s sales figures continue to swell. New users are trying Apple devices for the first time, being blown away by the experience, and becoming zealots in record quantities. Despite the continuing protestations of detractors who will do or say anything to push Apple from its pedestal, the Reality Distortion Field remains in place and in full effect.

Maybe the RDF isn’t around Apple any more, though. Maybe… the Reality Distortion Field has moved so that it’s now around us, around those who stubbornly refuse to admit how awesome Apple actually is.

Chinese monetize the moon

The Chinese space push is in full swing, but the CNSA (Chinese NASA) is nowhere near ready to compete in terms of PR. When Chang’e 3 — China’s first lunar rover — rolled from its lander this week, it made its country one of just three to ever drive a lander on the Moon. In celebration of the event, Chinese national news services broadcast some incredible live video of the rover (named Yutu, which means “Jade Rabbit”). However, the video does not seem to have been released to anyone but the Chinese media, and right now the internet has no adequate recording we can find. Two reports show the lander begin from two different angles, though both are low quality. Check out the videos below; fuzzy or not, they really are something.

Yutu rode to the Moon aboard China’s Chang’e 3 mission. The Chang’e series has been the standard-bearer for the Chinese space program for some time, and it will continue to be for at least two more missions. There are two more rovers planned, each with a different mission to research and survey. The ultimate goal is to land a Taikonaut (Chinese astronaut) on the Moon, and beyond that to set up a permanent lunar base. Their timeline for doing this isn’t so far removed from NASA’s musings about a mission to Mars. As the American space agency tries to drum up support for a mission to another planet, its Chinese counterpart could undercut them by focusing on a base much more likely to have economic benefits.

In fact, that’s a large part of China’s motivation to explore the Moon: the economic benefits. When the Apollo astronauts collected moon rocks for study, there was only the vaguest of ideas about the possible resources for exploitation. Now, this rover has an explicit mission to (among other things) survey the Moon for helium-3, a rare element that could be a clean, easily used fuel for nuclear fusion reactors. Only about 15 tons of the stuff is thought to exist on Earth, but estimates for the total compliment of the isotope on Luna range up to five million tons. A leader of the Chinese lunar program estimated that about 100 tons could provide for the world’s current energy needs for one year. Assuming we could extract 100% of that five million tons, that’s quite a bit of time to come up with the next stop-gap energy solution.

The Moon is also known to be home to rich deposits of titanium and other precious metals, and there’s no telling what other, unexpected wonders it might hold. Another lander on schedule for 2017 will attempt to collect and bring back rock and soil samples for analysis, and you can bet traces of precious or useful materials are first on their list of targets. China has said that it plans to spend the next couple of decades scouring our only satellite for helium-3 and anything else worthwhile, possibly securing an energy-independent future for China — that is, assuming fusion comes into its own and that the United States chooses to quietly accept Chinese dominance of the lunar oil fields. This is the stuff of which world wars and science fiction epics are made. Below is a video of the lander’s initial approach, in much higher quality than the footage above.

Yutu is equipped with a ground penetrating radar (GPR) that can probe several hundred meters into the Moon’s crust, and a spectrometer for basic sample analysis. That’s useless, of course, unless we find a more cost-effective way of getting material to and from the Moon. A space elevator would probably work best, but at present that’s almost as harebrained an idea as fusion itself. Perhaps the country’s population problems have made long-term problems more difficult to ignore, but the Chinese space agency appears to see the value of long-term investments and, if you’ll pardon the expression, moonshots.

Purely on its merits today, the Moon is anything but an investor’s dream. Still, an advantage based on the moon would be trivially easy to keep under a monopoly, and to exploit for extreme economic benefit.