DEF CON 32 - Where’s the Money-Defeating ATM Disk Encryption - Matt Burch

[@Asdayasman]

Imagine if we could see the slides for the first eight minutes, that'd be crazy.

[@zoc]

💀

[@toooes]

Wish granted media.defcon.org/DEF%20CON%2032/DEF%20CON%2032%20presentations/DEF%20CON%2032%20-%20Matt%20Burch%20-%20Where’s%20the%20Money%20-%20Defeating%20ATM%20Disk%20Encryption-white%20paper.pdf

[@rekhyl]

defcon in a nutshell

[@WrknOnLvnTheLvn]

Get glasses nerd

[@CGoody564]

​@@rekhyl meh, considering how it's been the last 5 years, I'd say it's a step up

[@edgeeffect]

It'd be hard enough giving a talk when there's another one going on on the other side of the room... but when the other talk starts blasting out over-amplified noise it must be so difficult to not yell "shut the ____ up!" across the room to them.

[@EvilGPT]

I hope they paid the researchers a fat bounty on this one!

[@youreabigguy]

That's what I was thinking 😂😂 Especially for so many exploits that's crazy

[@harrytsang1501]

By the forth cve we need yo stop being surprised...... until he just chmod -x the executable

[@WeLoveWave]

Love how it's specifically a Ford pickup that is used in ram-raid attacks. hahah

[@Croissinate]

Love this talk. But what I really wanna know is where tf he got a copy of every single version of VSS

[@daviddunkelheit9952]

WindowsRM or Powershell exploit would provide volume shadow copies…

[@PeteBrubaker]

What the hell, where are the slides?

[@eyezikandexploits]

Loved this talk

[@MCasterAnd]

It's crazy that a conference this big has this shit technical quality

[@justanotherguy6359]

I feel like explosive attacks are seen less in the US due to access to explosives capable of doing the job more than the money being paper. Explosives generally shouldn't cause fire to the contents of the safe if the person using them knew what they were doing at all.

[@Bastard_Operator_From_Hell]

In Europe they use gas and oxygen from welding gas bottles with hoses they push inside the ATM. Then ignite the gas mix and boom goes the ATM. Often this is done in Germany and the Netherlands by organized gangs.

[@daviddunkelheit9952]

Proper tamping of charges helps…

[@uyscuti5118]

So sick!!!

[@Koutsie]

16:00 i wonder what that was lmao

[@WrknOnLvnTheLvn]

Legit scared me

[@WrknOnLvnTheLvn]

Thabk you for the talk. Very interesting.

[@unicodefox]

Someone please tell this company about Linux UKIs... Also, the part I don't understand is, they're runing windows right? How? He says it just reboots into Windows, but how does Windows get the encryption key, and how does it prevent an attacker from getting the key during the rebootv

[@emiliachan]

windows doesnt get the key, it is decrypted inside the linux os when the windows partition is being mounted

[@Croissinate]

The entire Windows partition is encrypted. The ATM first boots into a lightweight Linux distro (which is on a partition that is not encrypted) and that Linux distro runs a command that decrypts the Windows partition. Then with the newly decrypted Windows partition it simply reboots into Windows.

[@unicodefox]

@@emiliachan ...so they're just leaving the HDD partition unencrypted and hoping the reboot isn't interrupted?

[@AaronDedeystere]

Common this gold!

[@gunnargu]

How are they not seeing their current way of doing things is not working?

[@davel202]

Hot and smart AND knows diebold

[@szaszm_]

No slides in the first 9:15 minutes 😭

[@ABeautifulHeartBeat]

Dontcha Know

[@CCMiniBucks]

Its disappointing when you know the only people clapping are the flogs from the financial network security sector displaying their gratitude for someone else doing their job for them. We all know they are told, over and over again, but their gratitude only extends to the bonus giver, not the KPI extender who just made their life harder. White hatting aside, maybe we should just make life hard for them, and say that illicit money from ATMs via system penetration is never insurable, therefore prompting some sort of assurance from the sector providers to do their fucking jobs properly. Tell me im wrong 🤷‍♂️

[@bumbaloe]

The echo in this audio is giving me a headache

[@moretzsohn7701]

no jackpot?

[@StarsManny]

7:51 "AKA..."? What does that mean?

[@iainwade]

Also known as

[@TheCzarsoham]

Implying an alternate name. Example: Marshall Mathers aka Eminem

[@shmo9943]

😂😂

[@andrewdunbar828]

several simularities

[@swampdaddy4014]

We get it.... windows sucks

[@Eysvar]

Uhhh, that's not what the talk was about at all. All of the flaws were found in the security software's handling of the Linux partition that was doing validation before booting into Windows

[@coolm98]

This does not invalidate his statement, total extinction of the windows user landscape is still the only way out​ @@Eysvar

[@omarjimenezromero3463]

we know that since dos creation, even microsoft know it, why the surprised comment?

[@Irongrip62]

Absolute scrubs

[@MiddlePath007]

The way the audience just doesn't want to clap as the talk goes on, it really shows how little people want to hear about past versions and the patches that stopped the speaker. Can ya do anything now? No? Ok leave

[@muuraaja-e5k]

Should have used it to bring down dollar.

[@mrhassell]

Strongswan & Luks2 - Isn’t that difficult…

[@materialoperator]

Any binary we want wooo!! Accept for its been fixed. Nice

[@sunny_disposition]

huh, what, were you expecting him to show us a secret handshake and then we each race back from the conference hall to the casino and we get money too0ol!!!! hacking, free money, clout, smarter than the whole world, .... fucking criiiiiiinge

[@EvilGPT]

Lol

[@TESTA-CC]

ATM=IOT=JACKPOT 💳💰💵💸🪙

[@MultipleObjectSelector]

I don't think he says "architecture" enough